wordpress-209642-0[.]cloudclusters[.]net

PhishDestroy identifies wordpress-209642-0.cloudclusters.net as hosting an active fake WordPress login portal designed to harvest credentials. This domain mimics legitimate WordPress infrastructure to trick users into entering their credentials under the guise of site management. The threat actor leverages cloud hosting (cloudclusters.net) to evade traditional detection while maintaining a plausible appearance. Users who encounter this site may unknowingly submit their login details to a malicious server controlled by the attacker.

This domain was flagged by 5 out of 95 security vendors on VirusTotal, indicating partial but not universal detection. Registered through NetEarth One, Inc. on November 30, 2018, the domain has operated for over five years, allowing the threat actor to establish infrastructure longevity. It resolves to IP address 108.181.157.242 and holds a valid SSL certificate issued by DigiCert Inc, which may further deceive users by displaying a padlock icon in their browser. The combination of partial blocklist coverage, long operational history, and HTTPS support increases the risk of successful credential theft.

If you visited this domain and entered any credentials, immediately change your passwords on all accounts using the same or similar login details. Enable multi-factor authentication wherever possible to prevent unauthorized access. Scan your device for malware using reputable antivirus software and monitor accounts for suspicious activity. Avoid reusing passwords across different services to limit exposure. Report the domain to your security team or platform provider to aid in broader threat mitigation.