waitlist-hit[.]one

Analysis as of July 24, 2026 indicates that the domain waitlist-hit.one is associated with a generic phishing campaign and is currently offline. The domain was registered through Dynadot LLC on 25 November 2025 and resolves to the Cloudflare‑owned address 172.67.217.213, which belongs to AS13335 (Cloudflare, Inc.) in the United States. The authoritative name servers are alexa.ns.cloudflare.com and randall.ns.cloudflare.com, confirming that the site was hosted behind Cloudflare’s edge network and was delivering content over HTTP/3. The TLS certificate presented is issued by Google Trust Services under the WE1 label, a common certificate for Cloudflare‑proxied sites, and does not provide any additional trust signals beyond standard encryption.

Passive scans recorded an HTTP 404 response and a page title of “waitlist-hit.one | 504: Gateway time‑out”, suggesting that the backend service was unavailable at the time of observation. VirusTotal reports that two out of ninety‑five scanning engines flagged the domain, indicating a low but non‑zero detection rate among automated malware scanners. The domain is listed on a single public blocklist and has been actively blocked by the PhishDestroy remediation service, reinforcing the classification as malicious. The evidence confirms that the infrastructure is typical of short‑lived phishing sites that rely on Cloudflare’s CDN to mask origin IPs and to obtain a valid SSL certificate quickly.

However, the limited number of detections and the presence of only one blocklist entry leave uncertainty regarding the scale of the campaign and the specific lures used. Defenders should continue to deny traffic to the domain, add it to local deny lists, and monitor for any re‑registration or resurrection of the same host name. Additional investigative steps include checking recent URL‑shortening services, email phishing reports, and any payload hashes associated with the two VirusTotal detections to correlate with ongoing incidents.