writingtoolai[.]com

writingtoolai.com was registered on 21 February 2026 through Spaceship, Inc. and is hosted on Cloudflare’s network (AS13335) with the IPv6 address 2606:4700:10::6816:3360 located in the United States. The domain uses Nginx with the OpenResty module, and its authoritative nameservers are ns73.domaincontrol.com and ns74.domaincontrol.com. No TLS certificate was observed, indicating the site served only HTTP. The domain is currently taken offline, which prevents real‑time verification of the content, but historical indicators point to a generic phishing operation.

Two of ninety‑three security engines on VirusTotal flagged the domain, and it appears on a single public blocklist. PhishDestroy has also listed the domain as malicious, and Gridinsoft assigned a trust score of 0 out of 100. The low trust score and the presence on blocklists suggest malicious intent, while the absence of an SSL certificate and the use of a generic hosting stack are consistent with a disposable phishing infrastructure. Because the site is offline, the exact payload or targeted brand cannot be confirmed, and no page title or additional content has been captured.

Defenders should block any traffic to writingtoolai.com at the network perimeter, add the IPv6 address to host‑based deny lists, and monitor for future resolutions that might point to new infrastructure. Continuous observation of the registrar Spaceship, Inc. for new domains created shortly after 21 February 2026 is advisable, as the same actor may reuse the same nameserver pair. Organizations using URL filtering should ensure that the domain is included in their blocklist feeds, and incident response teams should treat any emails or messages containing links to writingtoolai.com as malicious until proven otherwise.