2bl4o9lfpk3ii1[.]dynv6[.]net

Analysis of 2bl4o9lfpk3ii1.dynv6.net indicates that the domain is being used for a brand‑impersonation campaign targeting WeTransfer. The site presents the page title "WeTransfer", matching the declared brand target, and is classified as a brand impersonation scam in the supplied intelligence. The domain resolves to IP address 196.251.115.69, which geolocates to the Netherlands and is hosted by Hetzner Online GmbH, the registrar listed for the domain. No SSL certificate is presented, leaving the connection unencrypted and exposing visitors to potential credential capture.

Trust metrics are extremely low: Gridinsoft assigns a score of 0 / 100, Scamadviser a score of 1 / 100, and VirusTotal reports that 17 of 95 security vendors have flagged the domain, confirming malicious behavior. The domain appears on one security blocklist and has been explicitly blocked by PhishDestroy. DNS resolution is handled by the dynv6 nameserver cluster (ns1.dynv6.com, ns2.dynv6.net, ns3.dynv6.net). The domain was created on 24 October 2014, suggesting the infrastructure may be long‑standing or repurposed for current abuse.

Current status is offline, which may indicate takedown or temporary suspension, but the recorded indicators remain relevant for defensive controls. Uncertainty remains around the exact phishing kit or login flow, as no page content beyond the title is available. Defenders should continue to block the domain and its associated IP, monitor for any re‑registration or resurrection of the host, and incorporate the observed trust scores and vendor flags into automated detection rules. Additional investigation of traffic to the IP and correlation with other known WeTransfer impersonation campaigns is advisable to assess broader campaign scope.