wbmail[.]wahdabank[.]com[.]ly

The domain wbmail.wahdabank.com.ly was registered on March 11, 2026 and currently resolves to IP 31.172.80.245, an address belonging to AS214036 Ultahost, Inc. in Germany. The site serves a page titled "Wahda Bank Webmail - Secure Login" and returns an HTTP 302 redirect, indicating a probable credential‑capture flow. The host is secured with a Let’s Encrypt R12 certificate and runs PHP on an Nginx server with HSTS enabled. Infrastructure details show Cloudflare nameservers (coraline.ns.cloudflare.com, rodney.ns.cloudflare.com). Gridinsoft assigns a trust score of 0/100 and the domain is flagged as a high‑risk banking phishing operation. It is listed on one security blocklist and has been blocked by PhishDestroy; VirusTotal reports detections by 2 of 91 scanners. The site remains active. Analysts have not observed the page content directly, so the exact data‑exfiltration mechanisms and any ancillary domains remain unknown. Defenders should add wbmail.wahdabank.com.ly and its associated IP to deny‑list rules, monitor for outbound connections to the IP address, and enforce URL filtering for the "Wahda Bank" brand. Continuous DNS monitoring is advised to detect any future resolution changes, and endpoint protection should be tuned to flag the Let’s Encrypt certificate fingerprint associated with this host. User education campaigns should remind personnel that legitimate Wahda Bank communications do not use subdomains under ".com.ly" for webmail access.