xbn[.]waz[.]mybluehost[.]me

The domain xbn.waz.mybluehost.me is currently classified as a generic phishing threat with a high risk rating. The domain was registered through Domain.com on 26 December 2025 and resolves to the IPv4 address 50.6.34.226, which is assigned to AS31898 owned by Oracle Corporation and geolocated to Germany. The hosting infrastructure uses the nameservers ns1.mybluehost.me and ns2.mybluehost.me, indicating the site is hosted on a shared Bluehost environment. An SSL certificate issued by Sectigo Limited (Sectigo Public Server Authentication CA DV R36) is present, but the certificate does not provide any additional trust beyond standard domain validation.

HTTP requests receive a 302 redirect response, and the page title returned is “Welcome — Coming Soon”, which offers no indication of malicious content beyond the generic placeholder. The domain appears on a single security blocklist and is actively blocked by the PhishDestroy feed. VirusTotal analysis shows that 8 of 93 scanning engines have flagged the domain, confirming that multiple security vendors have observed suspicious behavior. No additional public intelligence such as Safe Browsing or OTX entries is available at this time.

The combination of recent registration, shared‑hosting IP, active blocklist entry, multi‑vendor detection, and the presence of a generic placeholder page suggests the domain is being used for phishing campaigns, likely to host credential‑harvesting pages that have not yet been captured. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any new URL paths or payloads associated with the IP, and consider adding the domain to internal blocklists. Ongoing observation of the IP reputation and any changes to the HTTP response or page content is recommended to detect potential escalation.