spookywsap[.]net

The domain spookywsap.net was registered on February 21, 2026 through NiceNIC International Group Co., Limited and is currently hosted behind Cloudflare, Inc. The authoritative nameservers april.ns.cloudflare.com and kayden.ns.cloudflare.com resolve the domain to the IP address 104.21.26.55, which is geolocated to Canada. The site’s page title, as observed in the limited scrape, is "www.www.spookywsap.net", indicating a likely attempt to obscure the true host name. VirusTotal analysis shows that two of ninety‑five scanning engines flagged the domain, confirming the presence of malicious indicators.

Independent blocklist monitoring records the domain on a single security blocklist and it has been explicitly blocked by the PhishDestroy service. As of the report date (July 23, 2026) the domain is listed as taken offline, suggesting that the operators have either abandoned the infrastructure or are rotating hosts. No additional intelligence such as Safe Browsing status, Open Threat Exchange entries, SSL certificate details, or HTTP response codes is available, leaving the full scope of the campaign’s infrastructure uncertain.

Defenders should continue to monitor the IP address 104.21.26.55 for any re‑use, enforce outbound filtering to block connections to the domain, and add the domain to internal blocklists. Organizations that rely on email or web gateways should ensure that their threat‑intel feeds incorporate the known indicators, including the registrar, nameservers, and the observed page title, to prevent future exposure to this phishing campaign.