Domain security and threat intelligence

royalegemgen.web.app

Name: royalegemgen.web.app — PhishDestroy evidence record
Published: 2026-09-08
License: https://creativecommons.org/licenses/by/4.0/

In short

PhishDestroy stores a record for royalegemgen.web.app. Source observations are dated separately; missing checks do not establish safety.

“games”

Review the evidence

Registrar: Google Domains
Resolved IP: 199.36.158.100FASTLY - Fastly, Inc., US · CDN
First observed: Sep 8, 2026

PhishDestroy assessment Critical

100/100

Evidence score

Availability Last known active Latest stored reachability observation Observed Nov 1, 2026 · 03:11 UTCHTTP probe

Risk signals

VirusTotal detections: 13/92

VirusTotal

13 / 92

engine detections · 2026-09-18

URLQuery

detections

URLScan

Malicious

engine verdict · score 84

Page captures

open gallery

Questions about royalegemgen.web.app

Is royalegemgen.web.app legit?

PhishDestroy stores a record for royalegemgen.web.app. Source observations are dated separately; missing checks do not establish safety.

Is royalegemgen.web.app safe to connect a wallet?

This report does not record which wallet requests royalegemgen.web.app makes. Because of the risk signals above, do not connect a wallet, sign messages or approve token permissions there. A confirmed blockchain transaction cannot be reversed.

What should I do if I used royalegemgen.web.app?

It depends on what you did. If you entered a password, change it, and also on every other site where you used the same password; turn on two-factor authentication where it is offered. If you paid or gave card or bank details, contact your bank or payment service through the contacts on your card or its official website. If you only connected a wallet, disconnect the site in the wallet and reject pending requests; a connection by itself does not move funds. If you signed a token approval or permit, revoke it with a token-approval checker. If you shared a seed phrase or private key, treat the wallet as compromised and move the remaining funds to a new wallet with a new seed phrase. If you downloaded a file, do not open it and scan the device with security software. Keep the address, dates, payment or transaction details and messages for a report to the police or another competent authority; a report does not guarantee that money is returned. Step-by-step help: emergency guide.

Explore

Source evidenceVirusTotal 13 / 92 8 sources

VirusTotal

13 / 92 engine detections · stored summary

2026-09-18 02:08 UTC

Open report

VirusTotalOriginal source recordObserved: 2026-09-18 02:03:14 UTC14 fields

Observed: 2026-09-18T02:03:14Z · Retrieved: 2026-10-22T23:32:33Z

Vendor result counts

Timeout: 0
Harmless: 45
Malicious: 13
Suspicious: 0
Undetected: 34

Vendor labels

VIPRE: malware
G-Data: phishing
Lionic: phishing
Sophos: phishing
CyRadar: phishing
Webroot: malicious
Fortinet: phishing
Kaspersky: phishing
BitDefender: phishing
Chong Lua Dao: malicious
desenmascara.me: malicious
alphaMountain.ai: phishing
Forcepoint ThreatSeeker: phishing

Reputation score

Registrar

MarkMonitor Inc.

Created

2019-01-08 22:05:04 UTC

Expires

2026-01-08 22:05:04 UTC

Updated

2024-12-12 10:14:49 UTC

First seen

2023-12-12 20:22:30 UTC

DNS records

TTL, seconds
21600
Type
A
Value
199.36.158.100
TTL, seconds
21600
Type
AAAA
Value
2620:0:890::100

DNS records observed

2026-09-18 02:03:24 UTC

JARM fingerprint

29d3fd00029d29d00041d41d00041d6b5eefa2404a56c2ced79a0d16afe36c

Certificate

Subject alternative names: web.app
*.web.app
Issuer: Google Trust Services / WR4
Serial: 93ab2a7aed4acb210af6c0fb093163bc
SHA-256: d69d48c3edf1af146f82e0e40950ba1d2c2a6ac9875657536c51cd7e9b82591b
Subject: web.app
Valid until: 2026-10-18 14:59:54 UTC
Valid from: 2026-07-20 14:59:55 UTC

Registration record

Registrar: MarkMonitor Inc.
Registrar IANA ID: 292
Registrar URL: http://www.markmonitor.com
Registered: 2019-01-08 22:05:04 UTC
Updated: 2024-12-12 10:14:49 UTC
Expires: 2026-01-08 22:05:04 UTC
Status: clientDeleteProhibited
clientTransferProhibited
clientUpdateProhibited
Nameservers: ns1.googledomains.com
ns2.googledomains.com
ns3.googledomains.com
ns4.googledomains.com
DNSSEC: unsigned

Original source fields · JSON

Vendor result counts	{ "timeout": 0, "harmless": 45, "malicious": 13, "suspicious": 0, "undetected": 34 }
Vendor labels	{ "VIPRE": "malware", "G-Data": "phishing", "Lionic": "phishing", "Sophos": "phishing", "CyRadar": "phishing", "Webroot": "malicious", "Fortinet": "phishing", "Kaspersky": "phishing", "BitDefender": "phishing", "Chong Lua Dao": "malicious", "desenmascara.me": "malicious", "alphaMountain.ai": "phishing", "Forcepoint ThreatSeeker": "phishing" }
Reputation	0
Categories	{ "Sophos": "phishing and fraud", "Webroot": "Phishing and Other Frauds", "alphaMountain.ai": "Phishing (alphaMountain.ai)", "Xcitium Verdict Cloud": "computing & technology", "Forcepoint ThreatSeeker": "phishing and other frauds" }
Registrar	MarkMonitor Inc.
Created	2019-01-08T22:05:04Z
Expires	2026-01-08T22:05:04Z
Updated	2024-12-12T10:14:49Z
First seen	2023-12-12T20:22:30Z
DNS records	[ { "ttl": 21600, "type": "A", "value": "199.36.158.100" }, { "ttl": 21600, "type": "AAAA", "value": "2620:0:890::100" } ]
Dns at	2026-09-18T02:03:24Z
Jarm	29d3fd00029d29d00041d41d00041d6b5eefa2404a56c2ced79a0d16afe36c
Certificate	{ "san": [ "web.app", "*.web.app" ], "issuer": "Google Trust Services / WR4", "serial": "93ab2a7aed4acb210af6c0fb093163bc", "sha256": "d69d48c3edf1af146f82e0e40950ba1d2c2a6ac9875657536c51cd7e9b82591b", "subject": "web.app", "valid_to": "2026-10-18T14:59:54Z", "valid_from": "2026-07-20T14:59:55Z" }
Registration record	{ "registrar": "MarkMonitor Inc.", "registrar_iana_id": "292", "registrar_url": "http://www.markmonitor.com", "created": "2019-01-08T22:05:04Z", "updated": "2024-12-12T10:14:49Z", "expires": "2026-01-08T22:05:04Z", "status": [ "clientDeleteProhibited", "clientTransferProhibited", "clientUpdateProhibited" ], "nameservers": [ "ns1.googledomains.com", "ns2.googledomains.com", "ns3.googledomains.com", "ns4.googledomains.com" ], "dnssec": "unsigned" }

Separate source record · 13 malicious + 0 suspicious / 92 · 2026-09-18 02:03:14 UTC

The summary above and this provider record were collected at different times. Both remain available; malicious and suspicious classifications are shown separately.

record_source: collected_observations.vt
analysis_at: 2026-09-18T02:03:14Z
fetched_at: 2026-10-22T23:32:33Z
stats: {"timeout":0,"harmless":45,"malicious":13,"suspicious":0,"undetected":34}

URLQuery

1 det.

2026-10-25 11:50 UTC

Open report

URLScan

Malicious · engine verdict · score 84

2026-09-08 04:41 UTC

Open report

URLScanOriginal source recordObserved: 2026-09-08 04:41:30 UTC16 fields

Observed: 2026-09-08T04:41:30Z · Retrieved: 2026-10-21T02:28:30Z

Report ID

01a07f52-222f-7425-94bf-ac5dfcd526d5

Final URL

https://royalegemgen.web.app/

HTTP response

200

IP address

199.36.158.100

Contacted IP addresses

199.36.158.100

Autonomous systems (ASN)

54113

Server countries

Document hash

b9425ab6abcb3ade6a1547d4c8f3ec7828a089a21ac6e11a8c918a34721eb5a5

TLS session and certificate

Subject alternative names: web.app
*.web.app
Cipher: AES_128_GCM
Issuer: WR4
Subject: web.app
Protocol: TLS 1.3
Valid until: 2026-10-18 14:59:54 UTC
Valid from: 2026-07-20 14:59:55 UTC

Domain age, days

675

Registered domain age, days

675

Certificate age, days

Certificate validity, days

Page requests

Provider verdicts

Engine verdict

Tags: urlscan-ml
urlscan-ml-60c5e22
Score: 84
Malicious: Yes

Overall verdict

Score: 0
Malicious: No

HTTP headers

Content-type: text/html; charset=utf-8
Strict-transport-security: max-age=31556926; includeSubDomains; preload

Original source fields · JSON

Uuid	01a07f52-222f-7425-94bf-ac5dfcd526d5
Final url	https://royalegemgen.web.app/
Status	200
Ip	199.36.158.100
Contacted IP addresses	[ "199.36.158.100" ]
Asns	[ "54113" ]
Countries	[ "US" ]
Document hash	b9425ab6abcb3ade6a1547d4c8f3ec7828a089a21ac6e11a8c918a34721eb5a5
Tls	{ "san": [ "web.app", "*.web.app" ], "cipher": "AES_128_GCM", "issuer": "WR4", "subject": "web.app", "protocol": "TLS 1.3", "valid_to": "2026-10-18T14:59:54Z", "valid_from": "2026-07-20T14:59:55Z" }
Domain age days	675
Apex age days	675
Tls age days	49
Tls valid days	89
Requests	4
Provider verdicts	{ "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 84, "malicious": true }, "overall": { "score": 0, "malicious": false } }
HTTP headers	{ "content-type": "text/html; charset=utf-8", "strict-transport-security": "max-age=31556926; includeSubDomains; preload" }

Separate monitor record · 2026-09-08 05:08 UTC

Separate stored monitor snapshot; does not replace the primary report record or establish current availability.

record_source: domain_monitor.urlscan
uuid: 01a07f52-222f-7425-94bf-ac5dfcd526d5
report_url: https://urlscan.io/result/01a07f52-222f-7425-94bf-ac5dfcd526d5/
score: 0
malicious: false
result_at: 2026-09-08T05:08:04Z
enriched_at: 2026-09-08T08:11:14Z
source_timestamps: {"urlscan_result_at":"2026-09-08 07:08:04","urlscan_enriched_at":"2026-09-08 10:11:14"}
timestamp_basis: Europe/Berlin, as used by the existing report; source timestamps are retained verbatim

OTX

no community references

2026-10-11 04:40 UTC

Open report

Cloudflare Radar

provider verdict: clean

Open report

Cloudflare RadarOriginal source recordObserved: 2026-09-08 04:50:03 UTC12 fields

Observed: 2026-09-08T04:50:03Z · Retrieved: 2026-10-21T03:57:49Z

Report ID

745616ba-b8a1-48b0-9139-2bfdc6275b54

Final URL

https://royalegemgen.web.app/

HTTP response

200

Redirect type

https-only

Navigation history

URL
http://royalegemgen.web.app/
Status
307
URL
https://royalegemgen.web.app/
Status
200

DOM structure hash

232f0938cf92e12e0433dc5736b9824dc389bd0135a40a0b25e99bd3585cbf12

Document hash

b9425ab6abcb3ade6a1547d4c8f3ec7828a089a21ac6e11a8c918a34721eb5a5