wanmeid[.]at

The domain wanmeid.at is currently active and exhibits multiple indicators consistent with a high‑risk phishing operation. HTTP requests to the host return a 302 redirect, and the page title presented by the site is "Buff163 — Official Resource," suggesting an attempt to impersonate a service associated with the Buff163 brand. The domain resolves to IP address 209.74.82.247, which is registered to Namecheap Inc in Singapore. The TLS certificate is issued by Let’s Encrypt (YR1), a common choice for short‑lived malicious infrastructure. VirusTotal scans have flagged the domain in 4 of 91 vendor engines, and the host appears on three public blocklists. Additionally, AlienVault OTX records show the domain in two separate threat‑intel pulses, and it is actively blocked by PhishDestroy, MetaMask, and SEAL. While the exact content of the landing page has not been publicly dissected, the convergence of a brand‑specific title, redirection behavior, and multiple independent detections supports a conclusion that wanmeid.at is being used to harvest credentials or otherwise deceive users. Defenders should add wanmeid.at and its resolved IP 209.74.82.247 to network deny lists, monitor DNS queries for the domain, and update endpoint protection signatures to include the observed indicators. Continuous observation of related blocklist entries and OTX pulses is recommended to detect any infrastructure changes or additional payloads associated with this campaign.