us05[.]eu

PhishDestroy first observed us05.eu on Mar 11, 2026. Stored content metadata identifies Facebook as the apparent target. The captured page title is “Welcome to XAMPP”. Stored page analysis classifies the content as social media phishing. Current evidence score: 66/100 (high).

Positive findings are stored from 3 sources: VirusTotal, MetaMask, and SEAL. VirusTotal recorded 1 detections among 94 engines: SOCRadar on Mar 12, 2026 at 05:00 UTC. MetaMask and SEAL listed the hostname in the external-blocklist snapshot on Aug 7, 2026 at 22:20 UTC. Non-positive and contextual checks: Google Safe Browsing returned no flag on Mar 12, 2026 at 07:00 UTC. URLScan completed without a malicious verdict on Jul 29, 2026 at 03:13 UTC.

HTTP 502 was recorded on Aug 7, 2026 at 01:27 UTC; content was unavailable. Registration records for the domain list Dynadot LLC as the registrar and Mar 11, 2026 as the creation date. Registration and first observation occurred on the same UTC date. At collection time, the hostname resolved to 172.86.91.195 on AS14956 (ROUTERHOSTING - RouterHosting LLC, US). The recorded endpoint location is Dallas, US. The stored server header is Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12. DOM analysis on Mar 23, 2026 at 23:11 UTC returned 63/100. The evidence archive retains 2 visual captures from PhishDestroy and URLScan. TLS metadata lists localhost as the certificate issuer with validity through Nov 8, 2019; checked Mar 15, 2026 at 08:12 UTC.

The content indicators and 3 positive source findings support the current Facebook-themed social media phishing classification.