whales.network

whales.network is currently listed as a high‑risk generic phishing site. The domain was registered on February 21 2026 through Dynadot LLC and remains active as of the report date, July 12 2026. It resolves to the IPv4 address 153.92.1.1, which is assigned to AS47583 Hostinger International Limited and geolocated to Lithuania. The web server presents an Nginx stack augmented by OpenResty and enforces HTTP Strict Transport Security. TLS termination is provided by a Let’s Encrypt certificate (R13).

The authoritative name servers for the zone are launch1.spaceship.net and launch2.spaceship.net, indicating reliance on the “spaceship” hosting platform. The site returns HTTP 200 for the root request and presents the page title “whales.network for sale | Spaceship.com”. No additional content has been analysed, and the exact phishing payload or credential‑harvesting mechanism is not yet visible.

Reputation services have flagged the domain. VirusTotal recorded a single positive detection out of 95 scanners, and three independent blocklists—PhishDestroy, ScamSniffer, and Enkrypt—have already listed the domain as malicious. Gridinsoft assigns a trust score of 0 / 100, and AlienVault OTX references the domain in one threat‑intelligence pulse. The low trust score and presence on multiple blocklists reinforce the high‑risk rating despite the limited number of VT detections.

Given the confirmed infrastructure, the presence on established phishing blocklists, and the active TLS certificate, defenders should treat whales.network as a confirmed phishing endpoint. Network‑level filtering should block traffic to 153.92.1.1 and to the domain itself. Continuous monitoring of DNS queries for the two launch*.spaceship.net name servers is advised, as any changes may indicate a shift in hosting. Incident response teams should also incorporate the domain into phishing‑email detection rules and consider sharing the indicators of compromise with upstream threat‑sharing platforms.