waagent.net Safety Check — Cloudflare-Hosted Phishing Endpoint

This domain, waagent.net, is currently under investigation for phishing-related activity following its detection on one security blocklist and inclusion in a single threat intelligence pulse within the AlienVault OTX platform. Registered on April 28, 2026, through Fewmoretaps OU operating under Trustname.com, the domain resolves to the IP address 172.67.176.122, which is part of Cloudflare’s infrastructure in Canada. The use of Cloudflare nameservers (sage.ns.cloudflare.com and sarah.ns.cloudflare.com) and a Google Trust Services SSL certificate (WE1) aligns with common patterns observed in both legitimate and malicious web properties, offering no definitive indication of intent on its own. Infrastructure analysis reveals that the domain returns an HTTP 403 status, suggesting access restrictions or a placeholder configuration rather than an openly accessible phishing page. While VirusTotal reports zero detections across 95 engines, this absence of flags does not confirm safety, as newly registered domains often evade initial detection. The domain’s presence on one blocklist and its mention in a threat intelligence pulse indicate preliminary suspicion, though the specific nature of the phishing threat—whether credential harvesting, malware distribution, or another scheme—remains unconfirmed due to limited technical evidence. Defenders should treat waagent.net as a potential threat vector until further analysis clarifies its behavior. Network-level monitoring for connections to 172.67.176.122 or DNS queries for the domain is recommended, particularly in environments where phishing campaigns are a known risk. The domain’s recent registration and Cloudflare hosting are not inherently malicious but warrant heightened scrutiny given the available indicators. Additional telemetry, such as payload analysis or user reports, would be necessary to determine the exact threat posed by this infrastructure.