waitttpanel[.]com

Analysis of waitttpanel.com indicates a phishing infrastructure leveraging Node.js and Express, detected on July 24, 2026. The domain, registered on March 2, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com, resolves to IP 45.144.53.193 (AS215730, H2NEXUS LTD, Finland). Nameservers are configured as dns1.regway.com through dns4.regway.com.

An SSL certificate issued by Let's Encrypt (R12) was present, though the domain is currently offline, returning an HTTP 404 status with a page title of 'Error.' Only one security blocklist, PhishDestroy, has flagged this domain. VirusTotal reports 5 of 93 security vendors marking it as malicious, though the specific payload or phishing kit remains unconfirmed. The use of Express suggests a lightweight server framework, potentially indicative of a disposable phishing endpoint rather than a long-term campaign.

Defenders should monitor for connections to 45.144.53.193 and correlate with other domains sharing the same nameserver set or hosting provider. Given its offline status, further forensic evidence may be limited, but historical DNS and SSL logs should be reviewed for prior activity. No brand or scam type is explicitly identified in available data, and the exact phishing target remains uncertain.