wlh[.]ywe[.]mybluehost[.]me

The domain wlh.ywe.mybluehost.me was registered on October 5, 2016 through Domain.com – Network Solutions, LLC and remains active as of the July 25, 2026 assessment. DNS resolution points to IP address 69.6.192.45, which is assigned to an Oracle Corporation network (AS31898) located in Spain. The domain uses the default MyBluehost nameservers ns1.mybluehost.me and ns2.mybluehost.me, indicating a typical shared‑hosting environment. An SSL certificate issued by Sectigo Limited (Sectigo Public Server Authentication CA DV R36) is present, providing transport‑layer encryption but not mitigating the malicious intent.

The HTTP response is a 302 redirect, a common technique for forwarding victims to credential‑harvesting pages. The page title returned from the server is "Welcome — Próximamente," offering no direct indication of the content hosted. Email infrastructure includes an MX record for mail.wlh.ywe.mybluehost.me, which could be abused for phishing‑related email delivery. Threat intelligence shows that PhishDestroy has already blocked the domain, and VirusTotal reports that 15 of 93 scanned security vendors flag the site as malicious, reflecting a consensus of suspicious activity.

Additionally, the domain appears on one external security blocklist, reinforcing its classification as a high‑risk phishing resource. While the exact phishing payload and targeted brand are not disclosed in the available data, the combination of a redirecting HTTP status, a valid SSL certificate, and multiple vendor detections indicates a purposeful attempt to deceive users. Defenders should immediately block the domain and its associated IP at perimeter firewalls and DNS filtering layers, add the MX host to email security policies, and monitor for any outbound connections to the IP address. Continuous re‑evaluation is advised, as further analysis of the landing page content could reveal additional indicators of compromise.