wh1504037[.]ispot[.]cc

Analysis of wh1504037.ispot.cc indicates that the domain was registered on February 21, 2026 through Tucows Domains Inc. and is currently taken offline, having been blocked by PhishDestroy. The authoritative nameservers cdns1.interserver.net, cdns2.interserver.net and cdns3.interserver.net resolve the domain to IP address 174.138.181.182, which belongs to AS19318 Interserver, Inc. in the United States. The web server presents a LiteSpeed stack with HTTP/3 support and serves a response with HTTP status code 200. The only content observed is the default directory listing titled “Index of /”.

The site employs a Let’s Encrypt R12 certificate, which confirms the presence of TLS encryption but does not provide any additional trust signals. Gridinsoft assigns a trust score of 0 out of 100, and the domain appears on one external blocklist. VirusTotal reports that eleven of ninety‑three scanning engines flag the domain, consistent with its classification as a generic phishing site. The risk level is listed as elevated.

The available evidence points to a classic phishing infrastructure: a recently created domain, use of a reputable hosting provider, encrypted HTTP, and a minimal page that likely served as a drop‑off for malicious payloads or credential harvesting before the takedown. No further artifacts such as specific brand impersonation, phishing kits, or observed payloads are publicly disclosed, leaving the exact content of the phishing campaign uncertain. Defenders should continue to block the domain at network perimeter devices, update URL filtering lists, and monitor the associated IP address for any resurgence of malicious activity. Because the domain is already offline, incident response teams should focus on any residual artifacts that may have been delivered to victims, such as malicious emails or compromised credentials, and apply standard phishing mitigation procedures, including user education and credential reset where appropriate.