maq[.]khd[.]mybluehost[.]me

maq.khd.mybluehost.me was registered on 2026-03-04 through Domain.com. The authoritative nameservers ns1.mybluehost.me and ns2.mybluehost.me resolve the domain to IP 50.6.34.26, an address assigned to AS31898 (Oracle Corporation) and geolocated in Germany. The site serves HTTPS using a Let’s Encrypt (R12) certificate, indicating a recent certificate issuance typical of fast‑deployed malicious infrastructure.

A direct HTTP request receives a 302 redirect to a landing page whose title is “Welcome — À Venir Bientôt”. Underlying technologies detected include WordPress, MySQL, PHP, Nginx, Apache HTTP Server, jQuery and the Bluehost hosting stack. The coexistence of Nginx and Apache, together with a generic WordPress installation, is consistent with a quickly assembled phishing kit that leverages familiar web components to evade casual inspection.

Threat intelligence flags the domain as high‑risk and currently active. VirusTotal reports that 7 of 95 antivirus engines flag the site as malicious, while Gridinsoft assigns a trust score of 0/100. The domain appears on one public blocklist and has been blocked by PhishDestroy. These detections, combined with the recent registration date and active status, corroborate the generic_phishing classification.

Defenders should add maq.khd.mybluehost.me to network and email blocklists, monitor DNS queries for the domain, and consider sinkholing the associated IP address to disrupt traffic. Continuous traffic analysis is recommended to capture any credential‑harvesting attempts, and incident response teams should be prepared to remediate compromised accounts should user credentials be observed. Because the specific brand being spoofed is not disclosed, organizations should remain vigilant for phishing communications that reference the “Welcome — À Venir Bientôt” phrasing or similar French‑language cues and reinforce user awareness of unexpected login prompts.