8tzd4lvkbcj339cy[.]aht[.]io

Analysis as of July 20 2026 indicates that the domain 8tzd4lvkbcj339cy.aht.io is currently active and associated with a generic phishing campaign classified as high risk. The domain was registered on October 5 2017 through GoDaddy.com, LLC and is served by the hostgator.com nameservers ns8077.hostgator.com and ns8078.hostgator.com. DNS resolution points to the IPv4 address 192.185.5.219, which is the same host listed on two public phishing blocklists, PhishDestroy and OpenPhish. VirusTotal scans show that seven of ninety‑five security engines flagged the domain, reinforcing the suspicion of malicious use. Infrastructure analysis reveals no additional hosting or CDN layers; the IP address appears to be a single‑point hosting location, suggesting limited mitigation options for the attacker. Uncertainty remains regarding the exact payload or credential‑stealing mechanisms employed, as no page content has been publicly disclosed. Defenders are advised to block the domain and its resolving IP at network perimeter devices, add the host to internal threat intelligence feeds, and monitor for any related traffic patterns. Continuous re‑evaluation is recommended should further indicators, such as additional detections or changes in hosting, emerge.