wml[.]rlj[.]mybluehost[.]me

The domain wml.rlj.mybluehost.me is currently classified as a high‑risk generic phishing infrastructure. Analysis shows the site returns an HTTP 302 redirect and the only visible page title is “Welcome — Coming Soon”. No additional content has been disclosed publicly, so the exact phishing vector remains unverified.

Infrastructure data links the domain to the IP address 50.6.2.39, which resolves to a server located in the United States and announced by ASN 31898, an Oracle Corporation network. The host presents a DV SSL certificate issued by Sectigo Limited under the Sectigo Public Server Authentication CA R36. MX records point to mail.wml.rlj.mybluehost.me, and the authoritative nameservers are ns1.mybluehost.me and ns2.mybluehost.me. Registration was performed through Domain.com – Network Solutions, LLC on 5 October 2016.

Reputation services provide strong corroboration of malicious intent: VirusTotal reports 13 out of 95 scanners flagging the domain, while Gridinsoft assigns a trust score of 0 / 100. The domain appears on two security blocklists and is actively blocked by PhishDestroy and PhishingDB. Its status is listed as active, indicating ongoing operation. The lack of publicly observed content beyond the placeholder title introduces uncertainty about the specific credential‑harvesting or payload delivery mechanisms employed.

Defenders should treat wml.rlj.mybluehost.me as a credible threat and incorporate it into perimeter defenses. Immediate actions include adding the domain and its resolving IP to URL filtering and DNS block lists, configuring intrusion detection signatures to alert on HTTP 302 redirects from this host, and monitoring mail traffic directed to its MX host. Continuous surveillance of the Oracle‑hosted IP range and periodic re‑evaluation of the domain’s reputation scores are recommended to capture any evolution of the phishing campaign.