autodiscover[.]whistlingtree3[.]com

Analysis of autodiscover.whistlingtree3.com indicates that the domain is currently active and hosted by Bluehost Inc., as reflected in the registrar record. The authoritative nameservers ns1.bluehost.com and ns2.bluehost.com resolve the domain, confirming the hosting relationship. HTTP probing returns a 302 redirect, a pattern commonly observed in credential‑harvesting campaigns that forward victims to malicious payloads after initial contact. Threat intelligence aggregators have recorded 16 of 91 security vendors flagging the domain on VirusTotal, demonstrating moderate consensus of malicious intent.

Google Safe Browsing classifies the site under social engineering, and the domain is listed on a single security blocklist. Independent phishing‑remediation service PhishDestroy has also blocked the domain, reinforcing the assessment of active abuse. The available data does not disclose the underlying IP address, geographic location, SSL certificate details, or the exact landing page content, leaving those infrastructure aspects uncertain. No page title or brand targeting information has been published, limiting insight into the specific lure employed.

Given the high risk rating and the convergence of multiple detection sources, defenders should treat autodiscover.whistlingtree3.com as a confirmed generic phishing indicator. Recommended actions include adding the domain to outbound and inbound web filtering policies, updating DNS‑based blocklists, and monitoring for any related subdomains that may share the same registrar or nameserver configuration. Continuous re‑evaluation is advised, as changes to the hosting environment or detection counts could modify the threat posture.