# PhishDestroy domain threat record: rweenergy-pl.fyi

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/rweenergy-pl.fyi/
Machine-readable companion: https://phishdestroy.io/domain/rweenergy-pl.fyi/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-09-23 09:04:52 UTC
- Last availability or vendor check: 2026-10-22 10:33:28 UTC
- Stored record updated: 2026-10-22 16:07:29 UTC
- VirusTotal detections in the stored snapshot: 15/91
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored infrastructure

- Observed IP address: 209.196.146.115
- Registrar in stored WHOIS data: Epik LLC
- Registrar country in stored WHOIS data: Unknown
- Last stored HTTP status: 200
- Registration date (registry RDAP, rweenergy-pl.fyi): 2026-03-16 13:45:12 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a0cd8a-62c9-758d-9450-f8474ad798ce/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/rweenergy-pl.fyi
- Certificate Transparency search: https://crt.sh/?q=%25.rweenergy-pl.fyi
- Web Archive lookup: https://web.archive.org/web/*/https://rweenergy-pl.fyi/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
rweenergy-pl.fyi is an impersonation phishing domain whose name pairs the RWE energy brand with a Polish "pl" tag. This points to Polish-speaking users who might trust a familiar utility name. PhishDestroy first flagged it on 2026-09-23. The site was still up and serving content when last checked on 2026-10-19. Its current page title reads "rweenergy-pl.fyi - contact with domain owner | Epik.com", a registrar contact page rather than a branded site, while our classification remains impersonation phishing.

How the scam works
Domains that borrow a major energy company's name are typically used to front fake investment schemes. Victims are drawn in through ads or messages promising guaranteed returns from a well-known utility. They are then pushed to register, hand over personal and contact details, and send deposits, often in cryptocurrency. Money sent this way goes straight to the operators, and "fees" or "taxes" demanded to unlock withdrawals are simply further losses. RWE has no connection to this domain.

Evidence
On 2026-10-02, VirusTotal showed 15 of 91 security engines flagging the domain. That is a meaningful minority for a site with no branded content on its front page. The vendors flagging it include alphaMountain.ai, BitDefender, Chong Lua Dao, CyRadar, ESET, Forcepoint ThreatSeeker, Fortinet and G-Data. The domain also appears in five AlienVault OTX threat pulses, so other researchers have tracked it independently. It is listed on the PhishDestroy blocklist.

Infrastructure
The domain was registered on 2026-03-16, roughly six months before PhishDestroy detected it. That long gap is consistent with names bought in advance and activated for campaigns later. Registration and hosting both sit with Epik LLC, on a US-based server. The Let's Encrypt certificate is free and automated, so the padlock in the browser says nothing about who runs the site.

What to do
If you sent money to anything tied to rweenergy-pl.fyi, stop all further payments, especially any "withdrawal fee". Contact your bank or the exchange you paid through immediately. Report the fraud to the police and to CERT Polska, and keep screenshots, chat logs and transaction IDs. If you entered an email address or password, change it everywhere you reused it, enable two-factor authentication, and treat follow-up calls offering to "recover" your funds as a second scam. Defenders should block the domain at DNS and proxy level and watch for similar RWE-themed lookalike names.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a0cd8a-62c9-758d-9450-f8474ad798ce/
VirusTotal report: https://www.virustotal.com/gui/domain/rweenergy-pl.fyi
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=rweenergy-pl.fyi
Archived copy: https://web.archive.org/web/20260923090811/https://rweenergy-pl.fyi/
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 09:35:51 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/mVb1H0RP/daf6842c44ca.png
  Captured: 2026-09-23 09:15:03 UTC
- URLScan capture 1: https://screenshots.phishdestroy.io/01a0cd8a-62c9-758d-9450-f8474ad798ce.png
  Captured: 2026-09-23 09:15:03 UTC
  Source report: https://urlscan.io/result/01a0cd8a-62c9-758d-9450-f8474ad798ce/
- URLScan capture 2: https://urlscan.io/screenshots/019cffc2-0583-71d7-b9d9-88929f16ab13.png
  Captured: 2026-09-23 09:04:52 UTC
  Source report: https://urlscan.io/result/01a0cd8a-62c9-758d-9450-f8474ad798ce/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/18e1911c-4390-4158-aa6a-42dd30e742e2.png
  Captured: 2026-09-23 09:15:51 UTC
  Source report: https://radar.cloudflare.com/scan/18e1911c-4390-4158-aa6a-42dd30e742e2
  SHA-256: 9dbb2c7c09fea1b0e939b75476a316240e6a496b9b83b56cf32ba260bbde7399
- URLScan · 2026-09-23: https://screenshots.phishdestroy.io/us/01a0cd8d-9629-76eb-949c-90faf4695ad7.png
  Captured: 2026-09-23 09:16:50 UTC
  Source report: https://urlscan.io/result/01a0cd8d-9629-76eb-949c-90faf4695ad7/
  SHA-256: d225ab90162c856605d74121f33669fe6b3a03ba359f502aae17a9d0458b9bca

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-20T21:01:38Z",
        "uuid": "01a0cd8a-62c9-758d-9450-f8474ad798ce",
        "scanned_at": "2026-09-23T09:13:20Z",
        "final_url": "https://rweenergy-pl.fyi/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://rweenergy-pl.fyi/",
                "from": "http://rweenergy-pl.fyi/",
                "status": 307
            }
        ],
        "ip": "209.196.146.115",
        "domains": [
            "fonts.gstatic.com",
            "fonts.googleapis.com",
            "www.epik.com"
        ],
        "ips": [
            "142.251.110.94",
            "104.18.2.159",
            "142.251.14.95",
            "209.196.146.115"
        ],
        "asns": [
            "15169",
            "13335",
            "394456"
        ],
        "countries": [
            "US"
        ],
        "link_domains": [
            "www.epik.com",
            "www.facebook.com",
            "twitter.com",
            "www.linkedin.com",
            "anonymize.com",
            "www.icann.org"
        ],
        "social": [
            "https://www.facebook.com/sharer.php",
            "https://twitter.com/intent/tweet"
        ],
        "doc_hash": "27f43577babc523df787a1f35bfbb7fa73d8fafee08e053f45910e83a9634572",
        "script_hashes": [
            "565169484eb0f13570db78742dcf091e83129a2a0471ae485aa13a890f378258",
            "24704d232f9937d71f8aec02c4308ed0b1e4fa237e144fc373fd520b6d935076"
        ],
        "globals": [
            "SSLExists",
            "$LAB",
            "gl"
        ],
        "tls": {
            "san": [
                "rweenergy-pl.fyi",
                "www.rweenergy-pl.fyi"
            ],
            "cipher": "AES_256_GCM",
            "issuer": "YR1",
            "subject": "rweenergy-pl.fyi",
            "protocol": "TLS 1.3",
            "valid_to": "2026-12-08T23:23:31Z",
            "valid_from": "2026-09-09T23:23:32Z"
        },
        "domain_age_days": 190,
        "apex_age_days": 190,
        "tls_age_days": 13,
        "tls_valid_days": 89,
        "requests": 18,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 65,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "nginx/1.22.1",
            "content-type": "text/html; charset=UTF-8",
            "x-powered-by": "PHP/7.1.33-64+ubuntu22.04.1+deb.sury.org+1"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-20T21:08:08Z",
        "uuid": "18e1911c-4390-4158-aa6a-42dd30e742e2",
        "scanned_at": "2026-09-23T09:15:51Z",
        "final_url": "https://rweenergy-pl.fyi/",
        "status": 200,
        "history": [
            {
                "url": "https://rweenergy-pl.fyi/",
                "status": 200
            }
        ],
        "dom_hash": "1b2a2d687dfa1e758f98927dd9c2764aa8d390236a8e7b96c532ae2f6fcb983d",
        "doc_hash": "849a50e0926dd727a073a3f84d181a17efafc3bdf89d9e803514006b6412fc1f",
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "rweenergy-pl.fyi",
                "type": "A",
                "value": "209.196.146.115"
            }
        ],
        "dnssec_valid": true,
        "ip": "209.196.146.115",
        "whois": {
            "registrar": "Epik LLC",
            "created": "2026-03-16T13:45:12Z",
            "updated": "2026-08-12T08:17:12Z",
            "expires": "2027-03-16T13:45:12Z",
            "nameservers": [
                "ns3.epik.com",
                "ns4.epik.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-21T21:36:48Z",
        "analysis_at": "2026-10-21T08:47:51Z",
        "stats": {
            "timeout": 0,
            "harmless": 46,
            "malicious": 14,
            "suspicious": 2,
            "undetected": 30
        },
        "detections": {
            "ESET": "phishing",
            "VIPRE": "phishing",
            "G-Data": "phishing",
            "Lionic": "phishing",
            "Sophos": "phishing",
            "CyRadar": "phishing",
            "Webroot": "malicious",
            "Fortinet": "phishing",
            "SOCRadar": "phishing",
            "URLQuery": "suspicious",
            "Kaspersky": "phishing",
            "Gridinsoft": "suspicious",
            "BitDefender": "phishing",
            "Chong Lua Dao": "malicious",
            "alphaMountain.ai": "phishing",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "categories": {
            "Sophos": "phishing and fraud",
            "Webroot": "Phishing and Other Frauds",
            "BitDefender": "blogs",
            "alphaMountain.ai": "Phishing, Spam (alphaMountain.ai)",
            "Forcepoint ThreatSeeker": "phishing and other frauds"
        },
        "created": "2026-03-16T00:00:00Z",
        "updated": "2026-03-16T00:00:00Z",
        "first_seen": "2026-03-16T17:15:45Z",
        "dns": [
            {
                "ttl": 300,
                "type": "CAA",
                "value": "letsencrypt.org"
            },
            {
                "ttl": 300,
                "type": "NS",
                "value": "ns3.epik.com"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "209.196.146.115"
            },
            {
                "ttl": 300,
                "type": "NS",
                "value": "ns4.epik.com"
            },
            {
                "ttl": 300,
                "type": "CAA",
                "value": "trust-provider.com"
            },
            {
                "ttl": 3600,
                "type": "SOA",
                "rname": "hostmaster.rweenergy-pl.fyi",
                "value": "ns3.epik.com"
            }
        ],
        "dns_at": "2026-10-21T08:48:32Z",
        "jarm": "2ad2ad0002ad2ad00042d42d0000002059a3b916699461c5923779b77cf06b",
        "cert": {
            "san": [
                "rweenergy-pl.fyi",
                "www.rweenergy-pl.fyi"
            ],
            "issuer": "Let's Encrypt / YR1",
            "serial": "646de08397987fd5c7f8ccbeac3e70c266f",
            "sha256": "1afe06caff92305713aa405f6ed1ae55987e83d8ea322654bc02e76f2bfb4da5",
            "subject": "rweenergy-pl.fyi",
            "valid_to": "2026-12-08T23:23:31Z",
            "valid_from": "2026-09-09T23:23:32Z"
        },
        "whois": [],
        "rdap": {
            "status": [
                "client transfer prohibited"
            ],
            "events": {
                "expiration": "2027-03-16T13:45:12Z",
                "last changed": "2026-08-12T08:17:12Z",
                "registration": "2026-03-16T13:45:12Z",
                "registrar expiration": "2027-03-16T13:45:12Z",
                "last update of RDAP database": "2026-10-21T08:48:00Z"
            },
            "registrar": "Epik LLC",
            "registrar_iana_id": "617"
        }
    }
}
```