home-8mhvx[.]wstd[.]io

Analysis of home-8mhvx.wstd.io indicates a confirmed brand impersonation campaign targeting AT&T, currently offline but previously flagged by multiple security mechanisms. The domain was registered on February 25, 2022, through NameCheap, Inc., and utilizes Cloudflare nameservers (cosmin.ns.cloudflare.com and sandra.ns.cloudflare.com), a common tactic to obscure hosting origins and evade takedowns. Infrastructure analysis reveals the domain resolved to IP 104.19.163.34, geolocated within the United States under Cloudflare’s AS13335, further suggesting the use of proxy services to mask malicious activity. The SSL certificate, issued by Let’s Encrypt, aligns with patterns observed in phishing operations leveraging short-lived, low-cost certificates to appear legitimate.

At the time of assessment, the domain returned an HTTP 401 status, indicating an unauthorized access attempt or a placeholder page, which may reflect a temporary takedown or a staging phase for future attacks. The page title 'Home' provides no additional context, and no specific phishing kit or payload has been publicly attributed to this domain. Detection data from Gridinsoft assigns a trust score of 0/100, reinforcing its classification as high-risk. The domain appears on at least one security blocklist (PhishDestroy), and 19 of 95 security vendors on VirusTotal flagged it as malicious, though the absence of recent scans or detailed reports limits granular insight into the exact threat vector.

Defenders should treat this domain as part of a broader AT&T impersonation campaign, particularly given its registration age and continued presence on blocklists despite its offline status. Organizations are advised to monitor for DNS resolution attempts, review logs for connections to 104.19.163.34, and update web filtering rules to block the domain preemptively. While the current HTTP status suggests inactivity, the infrastructure remains intact, and the domain could be reactivated with minimal effort.