derlwynltd[.]com

This domain, derlwynltd.com, is currently classified as high risk with a specific threat type of generic phishing. The ongoing activity associated with this domain indicates a heightened likelihood of credential harvesting or user deception schemes. The risk assessment is elevated due to the active status and recent domain creation date.

Technical analysis confirms that derlwynltd.com remains operational. VirusTotal reports 1 out of 95 security vendors marking this domain as malicious, suggesting that detection is still limited and potentially underreported. The domain resolves to IP address 178.238.236.172. It uses an SSL certificate issued by Let's Encrypt, which is a common choice for both legitimate and malicious domains due to the ease of automated issuance. Registration records indicate Fewmoretaps OU d/b/a Trustname.com as the registrar. The domain's creation date is June 16, 2026, indicating it is newly registered and may be part of a short-lived campaign. The low detection count highlights the need for proactive caution, as most blocklists and trust scoring mechanisms have not yet widely recognized this threat.

To mitigate the risks associated with generic phishing from derlwynltd.com, network administrators should implement immediate blocking of the resolved IP (178.238.236.172) and the domain itself at the firewall and mail gateway levels. Security teams should monitor for related indicators across their environment, including similar domains and recent SSL certificate registrations. End users should be warned about the potential for deceptive web pages mimicking legitimate business services, and email filtering rules should be updated to recognize correspondence linking to or referencing derlwynltd.com. Continuous monitoring of threat intelligence feeds is recommended to detect related infrastructure or evolving tactics.