wh1488615[.]ispot[.]cc

This domain, wh1488615.ispot.cc, is actively flagged as a high-risk phishing endpoint targeting user credentials. Analysis indicates the domain was registered on October 24, 2014, through Tucows Domains Inc., and remains operational as of July 12, 2026. It resolves to the IP address 66.45.244.235, which has been associated with multiple phishing campaigns in recent threat intelligence feeds. Security vendors have detected malicious activity linked to this domain, with 14 out of 95 engines on VirusTotal identifying it as harmful, reinforcing its classification as a credible threat. The domain appears on two security blocklists and is explicitly blocked by at least two phishing detection systems, further validating its malicious intent. The SSL certificate is issued by Let’s Encrypt, a common tactic used by threat actors to lend superficial legitimacy to phishing sites. While the page title matches the domain name, the exact content and targeted brand or service remain unconfirmed, as no specific brand or scam type is identified in available data. This suggests the domain may be part of a broader, generic credential harvesting operation rather than a targeted impersonation of a known service. Infrastructure analysis reveals the domain has been active for nearly twelve years, an unusually long lifespan for a phishing site, which may indicate periodic reuse or persistence within threat actor infrastructure. Defenders should treat this domain as an active threat and prioritize blocking it at the network and endpoint levels. Monitoring for connections to the associated IP address, 66.45.244.235, is recommended to identify compromised systems or ongoing phishing attempts. Given the domain’s presence on multiple blocklists and its consistent detection by security vendors, organizations should also review logs for any historical interactions with this domain to assess potential exposure.