w9z1vupcj[.]localto[.]net

The domain w9z1vupcj.localto.net is actively serving a page titled "Email Verification" and has been classified as a generic phishing site. Infrastructure analysis shows the domain resolves to IP 212.64.215.198, which is hosted in Turkey under AS197450 (Sunucun Bilgi Iletisim Teknolojileri ve Ticaret Ltd. Sti.). The site presents a valid Let's Encrypt certificate (R13) and returns HTTP 200 responses, indicating a functional web service. Name resolution is handled by ns1.localtonet.com and ns2.localtonet.com. The domain was registered through NameCheap on February 10, 2023 and remains active. Security reputation is poor: Gridinsoft assigns a trust score of 0/100, the domain appears on two phishing blocklists (PhishDestroy and PhishingDB), and VirusTotal reports 20 of 95 scanners flagging the host. Detected server technologies include Microsoft ASP.NET and the Kestrel web server, which are commonly used for dynamic content delivery. No additional content analysis is available beyond the page title, so the exact phishing workflow and any credential‑harvesting mechanisms remain uncertain. Defenders should block the domain at perimeter firewalls and DNS filters, enforce email gateway rules that quarantine messages referencing "email verification" from this host, and monitor outbound traffic for connections to 212.64.215.198. Continuous threat‑intel feeds should be consulted for updates, and any compromised credentials reported by users should be reset promptly.