staticfile-sntandre[.]wasmer[.]app

Analysis of staticfile-sntandre.wasmer.app indicates that the domain is actively used for phishing operations as of the report date, July 25, 2026. The domain remains live and is currently blocked by the PhishDestroy mitigation service. VirusTotal scans show that nine out of ninety‑one participating security vendors have flagged the domain, confirming that multiple independent detection engines recognize malicious behavior. The domain resolves to the IPv4 address 62.210.172.150, providing a concrete network indicator that can be incorporated into firewall or DNS sinkhole policies.

The authoritative name servers, alpha.ns.wasmernet.com and beta.ns.wasmernet.com, are hosted by Wasmer Inc., the registrar listed for the domain, suggesting the infrastructure is tied to a legitimate hosting provider but is being abused for malicious purposes. The domain appears on a single security blocklist, indicating that at least one external threat‑intelligence feed has already identified it as hostile. No additional public intelligence such as Safe Browsing, OTX, SSL certificate details, HTTP status codes, or page title information is available at this time, leaving the exact content and landing‑page characteristics unverified. Defenders should prioritize immediate remediation by adding staticfile-sntandre.wasmer.app and its resolved IP address to outbound blocklists and DNS filtering rules.

Continuous monitoring of the associated IP and name server activity is advised, as changes could indicate further expansion of the phishing infrastructure. Correlating internal logs for any DNS queries or HTTP requests to this domain will help identify compromised endpoints. Integration of the nine vendor detections into existing SIEM correlation rules will improve detection fidelity for related traffic. Given the active status and multiple vendor flags, the risk posture remains high, and organizations should treat any interaction with the domain as malicious.