wh1497652[.]ispot[.]cc

The domain wh1497652.ispot.cc was created on October 24, 2014 and is registered through Tucows Domains Inc. It resolves to the IPv4 address 205.209.118.139, which is owned by Interserver, Inc. (AS19318) and geolocated to the United States. The authoritative name‑servers for the zone are cdns1.interserver.net, cdns2.interserver.net, and cdns3.interserver.net, indicating that the hosting infrastructure is provided by the same provider. No TLS certificate is associated with the host, and an HTTP request returns a 408 Request Time‑out page title, suggesting that the server is either unresponsive or deliberately returning an error page. The domain is listed on a single security blocklist and has been actively blocked by the PhishDestroy mitigation service.

Gridinsoft assigns a trust score of 0 out of 100, reflecting a lack of confidence in the host’s legitimacy. VirusTotal analysis shows that six of ninety‑three scanned security vendors have flagged the domain, reinforcing the suspicion of malicious use. The threat classification is a generic phishing campaign, and the risk level is marked as elevated.

While the available data confirms the infrastructure and the presence of multiple detections, the exact phishing content, target brand, or delivery vectors have not been publicly disclosed. Defenders should continue to block the domain at DNS and proxy layers, monitor the associated IP address for any new activity, and update intrusion‑prevention signatures to include the observed indicators of compromise. Additional telemetry, such as HTTP request payloads or sinkhole redirects, would be required to fully characterize the campaign’s operation.