wter[.]io

This domain wter.io is currently flagged as a high‑risk generic phishing site. The site was registered on 2026-03-03 through NiceNIC International Group Co., Limited and is hosted behind Cloudflare (AS13335) with the IP address 188.114.96.3. DNS resolution points to Cloudflare nameservers margaret.ns.cloudflare.com and tim.ns.cloudflare.com, and the service advertises HTTP/3 support. TLS is provided by a Let’s Encrypt certificate (E7). An HTTP 308 response indicates a permanent redirect, and the page title returned by the server is “Buy”. Email infrastructure uses privateemail.com MX hosts (mx1 and mx2). The domain is listed on at least one public blocklist and has been blocked by the PhishDestroy sinkhole. VirusTotal reports four detections out of 94 scanners, and AlienVault OTX shows inclusion in 23 threat‑intel pulses. Technologies observed on the page include Chart.js, jsDelivr, Facebook Pixel, cdnjs, and Cloudflare Browser Insights. The indicator set is sparse; no payload, credential‑harvesting page, or specific target brand has been observed. Defenders should add 188.114.96.3 and wter.io to outbound and inbound block lists, monitor for DNS queries to the domain, and enforce TLS inspection to capture any redirected content. Continuous threat‑intel feeds should be consulted for any new detections, and any email flows that resolve to the listed MX hosts should be scrutinized for malicious attachments or phishing attempts.