netflix-ch-regions-gn6vu[.]wstd[.]io

The domain netflix-ch-regions-gn6vu.wstd.io was registered through NameCheap on February 25, 2022 and is currently hosted on Cloudflare infrastructure (ASN 13335) in the United States, resolving to the IPv6 address 2606:4700::6813:a422. The authoritative nameservers are cosmin.ns.cloudflare.com and sandra.ns.cloudflare.com, both Cloudflare‑operated, and the site presented a valid Let’s Encrypt certificate (issuer E8) at the time of observation. HTTP requests returned a 401 Unauthorized status, and the page title reported "Home," offering no additional functional insight. Security telemetry indicates that the domain appears on one external blocklist and has been explicitly blocked by the PhishDestroy feed.

VirusTotal scans recorded 14 detections out of 93 submitted security vendors, reinforcing the suspicion of malicious intent. Independent scoring from Gridinsoft assigned a trust rating of 0 out of 100, the lowest possible score, consistent with a high‑confidence malicious classification. Intelligence tags the domain as a crypto‑related scam and notes that it impersonates the brand "base" as indicated in the brand‑target field.

The current operational status is offline, but historical evidence suggests the site was actively serving content prior to takedown. Defenders should add the domain and its associated IPv6 host to existing deny‑list policies, monitor for any resurgence of activity under the same Cloudflare edge, and consider broader sinkholing of the Cloudflare IP range if similar patterns emerge. Continuous re‑evaluation of threat feeds for updates on this indicator is advised, given the moderate detection count and the low trust score indicating a high risk of credential or crypto‑asset theft.