staticfile-b12aa[.]wasmer[.]app

Analysis of staticfile-b12aa.wasmer.app shows an infrastructure that has been actively flagged by multiple security services. The domain was registered on October 16, 2018 through Squarespace Domains II LLC and is currently marked offline with an HTTP 410 response code, indicating the content has been removed. The page title returned during the last observation was "App Disabled," which provides no functional content but confirms the site was reachable before takedown. The domain resolves to the IPv6 address 2001:bc8:701:70a:d604:e6ff:fed6:89d0, hosted in France under AS12876 (SCALEWAY S.A.S.).

The hosting provider supplies a Let’s Encrypt certificate (issuer E7), suggesting the site employed TLS encryption. Nameserver records point to alpha.ns.wasmernet.com and beta.ns.wasmernet.com, tying the domain to the Wasmer hosting platform. VirusTotal scans report that 15 of 93 antivirus and URL‑filtering vendors flag the domain as malicious, and PhishDestroy has listed it as a blocked source. It also appears on a single external security blocklist.

The documented scam type is "Account Takeover," indicating attackers may have used the site to harvest credentials for the purpose of hijacking user accounts. While the site is no longer serving content, the underlying infrastructure—domain registration details, hosting provider, and TLS certificate—remains observable and could be reused for future campaigns. Defenders should continue to block the domain at perimeter defenses, monitor the associated IPv6 host for any reactivation, and add the nameservers to watchlists for potential new subdomains. Threat intelligence teams should correlate any login attempts or credential leaks with the observed indicator set, and incident responders should treat any related traffic as high‑confidence evidence of an account‑takeover attempt.