wanbonline[.]com

Analysis of wanbonline.com indicates a confirmed brand impersonation campaign targeting Western Alliance National Bank, as evidenced by the page title 'Western Alliance National Bank - Money Transfer & Banking' and classification under 'brand impersonation' in threat intelligence sources. The domain was registered on October 3, 2025, through Dynadot LLC and resolved to IP address 198.23.193.170, hosted on AS36352 (HostPapa) in the United States. No SSL certificate was detected, increasing the risk of plaintext credential interception. The domain is currently offline, having been taken down following detection by PhishDestroy and inclusion in one security blocklist.

AlienVault OTX records the domain in a single threat intelligence pulse, while Gridinsoft assigns a trust score of 0/100, reflecting high confidence in malicious activity. Four of 95 security vendors on VirusTotal flagged the domain as malicious, consistent with phishing infrastructure. Nameservers dns1.geebytesdns.com and dns2.geebytesdns.com are associated with low-reputation DNS providers frequently used in phishing operations.

Defenders should treat this domain as compromised infrastructure and block both the domain and resolving IP at perimeter controls. Historical DNS logs should be reviewed for prior connections, and affected users should be alerted to potential credential exposure. Given the domain's recent creation and rapid takedown, additional related domains may still be active; monitoring for similar naming patterns and hosting providers is recommended.