cedjtas[.]wellease[.]site

On July 22, 2026, the domain cedjtas.wellease.site was observed as an offline infrastructure used for brand impersonation targeting WhatsApp users. The domain was registered on April 9, 2025 through Go Daddy, LLC and is hosted on the IP address 62.60.226.175, which resolves to an autonomous system (AS214351) owned by FEMO IT SOLUTIONS LIMITED in Germany. The authoritative name servers are jay.ns.cloudflare.com and suzanne.ns.cloudflare.com, indicating reliance on Cloudflare DNS services. No TLS certificate is presented for the site, and the Gridinsoft trust score is recorded as 0 out of 100, reflecting a lack of legitimacy. The page title returned from the HTTP response is “CREDITAS Banking - internetové bankovnictví”, which does not reference the advertised WhatsApp brand and suggests a possible mismatch between the visible content and the intended impersonation.

VirusTotal analyses have identified the domain as malicious in five out of ninety‑five scanning engines, and the domain appears on a single external security blocklist. PhishDestroy has also taken the domain offline and listed it as blocked. The limited detection by VirusTotal suggests that the payload or phishing kit may be lightweight or recently deployed, but the presence of five independent detections indicates that at least some security vendors have identified malicious behavior, such as URL redirection or credential harvesting. The single blocklist entry confirms that at least one external reputation service has catalogued the domain, reinforcing the need for proactive blocking. The use of Cloudflare name servers is a common tactic to obscure the true origin of malicious traffic, and the German‑based hosting provider may be leveraged for other related campaigns.

Although the page title references a Czech banking service, the declared impersonation of WhatsApp highlights a potential multi‑brand strategy where the attacker reuses the same infrastructure for different social‑media lures.