# PhishDestroy threat dossier — imobiliarealtfel.ro ================================================================ Fetched: 2026-07-06 12:27:00 UTC Canonical: https://phishdestroy.io/domain/imobiliarealtfel.ro/ ## VERDICT ---------------------------------------------------------------- TAKEN DOWN (neutralised) Composite threat score: 86/100 (PhishDestroy scoring — see methodology below) Scam classification: Generic Phishing ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 1/94 security vendors flagged this domain Flagging vendors: Netcraft Public blocklists: listed on 1 independent blocklist ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 86.107.78.47 (RO, Bucharest) ASN: AS203053 CLAUS WEB srl Hosting org: CLAUS WEB srl Registrar: Claus Web SRL Nameservers: ns.clausweb.ro, ns.registar.ro, ns.romania-webhosting.com Registered: 2026-04-02 Page title: Home - Imobiliare ## TLS CERTIFICATE ---------------------------------------------------------------- Issuer: Let's Encrypt / E7 Expires: 2026-06-09 Status: INVALID chain Fingerprint: 172ef862219daaf01d63c438432e8b52d89572b03fc39730fe849f2d4b1290d9 ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: REPORTS FILED. Domain eventually taken down after 3 abuse notice(s). Reports filed: 3 independent abuse notifications First report: 2026-04-05 01:17:40 UTC Latest report: 2026-04-14 17:27:47 UTC Days since first notice: 92 (eventually taken down) ICANN Compliance CC'd on at least one escalation — non-response is on record. Methodology: follow-up reports are sent ONLY when a victim re-submitted a re-report via our public form, our monitoring detected the domain resurfacing in SEO/feeds, OR our live-checker confirmed the domain is still technically active and fraudulent. Each report contains: VT verdict, URLScan snapshot, WHOIS, SSL metadata, IP/hosting chain, impersonated-brand evidence, drainer/kit classification, screenshots, and a cryptographic hash of the forensic PDF. ICANN RAA Sec. 3.18 applies. Per-report timeline: https://phishdestroy.io/domain/imobiliarealtfel.ro/#coordinated-suppression ## TIMELINE ---------------------------------------------------------------- Domain registered: 2026-04-02 (per WHOIS / CT — may reflect a renewal or transfer date, not first-ever registration) First detected: 2026-04-02 18:08:50 UTC (by PhishDestroy tracker) Earliest abuse rec: 2026-04-02 15:15:53 UTC — PREDATES current WHOIS registration; retained from a previous registration cycle of the same domain name Last verified: 2026-07-06 12:20:35 UTC Neutralised: 2026-04-23 00:28:36 UTC Current status: taken down (registrar suspended or DNS dead) Note: one or more events above predate the WHOIS creation date. This typically means the same domain name was previously registered, detected, dropped, and then re-registered by a new party. PhishDestroy preserves the full historical record for operator-attribution research even when the underlying infrastructure changes hands. ## EXTERNAL CORROBORATION (third-party evidence) ---------------------------------------------------------------- URLScan.io: https://urlscan.io/result/019d4ebc-1c53-733d-b603-3beea6ae1ddf/ URLQuery: https://urlquery.net/report/ddfc3eac-8f96-4da3-bed0-c144e7cfd2c3 Wayback Machine: https://web.archive.org/web/*/imobiliarealtfel.ro crt.sh CT logs: https://crt.sh/?q=%25.imobiliarealtfel.ro Google transparency: https://transparencyreport.google.com/safe-browsing/search?url=imobiliarealtfel.ro AlienVault OTX: https://otx.alienvault.com/indicator/domain/imobiliarealtfel.ro URLhaus: https://urlhaus.abuse.ch/host/imobiliarealtfel.ro/ ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-04-02 18:09:20 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] PhishDestroy identifies imobiliarealtfel.ro as a newly active crypto drainer domain under investigation. This site mimics real estate services to trick users into connecting crypto wallets, where malicious smart contracts silently drain funds upon approval. The domain was created on January 29, 2025, via Claus Web SRL and resolves to 86.107.78.47. As of the latest scan, it remains undetected on VirusTotal with 1/95 detections and holds a valid Let's Encrypt SSL certificate, increasing its perceived legitimacy. These factors suggest a rapidly evolving threat designed to evade initial detection while targeting cryptocurrency users. The domain’s recent registration and lack of detection stand in contrast to its active status. VirusTotal currently shows 1/95 security engines flagging imobiliarealtfel.ro, indicating it has not yet been widely recognized as malicious. The registrar, Claus Web SRL, is a common provider in the region, and the use of a legitimate SSL certificate from Let's Encrypt further enhances its deceptive appearance. This combination of newness, low detection, and plausible infrastructure makes it a high-risk vector for crypto drainer campaigns targeting unsuspecting real estate investors or users seeking property listings. If you visited imobiliarealtfel.ro, disconnect your crypto wallet immediately and revoke any permissions granted to unknown domains through your wallet’s dApp browser or settings. Do not interact with any prompts or transactions after visiting. Report the domain to PhishDestroy for further analysis using the unique seed 090f20. Monitor your wallet for unauthorized transactions and consider transferring remaining funds to a secure, offline wallet until the threat is fully resolved. Exercise extreme caution with newly registered domains offering financial or investment services. ## EVIDENCE HASHES ---------------------------------------------------------------- PhishDestroy Case ID: PD-20260402-1D782F Favicon MD5: 11e815fcc46522874043fec1a1423f31 TLS cert SHA-256: 172ef862219daaf01d63c438432e8b52d89572b03fc39730fe849f2d4b1290d9 ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (operator takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/imobiliarealtfel.ro/ JSON API: https://api.destroy.tools/v1/check?domain=imobiliarealtfel.ro Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: independent open-source threat-intelligence platform. Tracked: 175,147 domains (13,467 alive under monitoring, 160,778 confirmed takedowns/dead). Site: https://phishdestroy.io