# PhishDestroy domain threat record: spidervpn.online

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/spidervpn.online/
Machine-readable companion: https://phishdestroy.io/domain/spidervpn.online/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-12 23:35:55 UTC
- Last availability or vendor check: 2026-10-22 10:33:52 UTC
- Stored record updated: 2026-10-22 16:07:29 UTC
- VirusTotal detections in the stored snapshot: 16/92
- Independent public blocklist matches in the stored snapshot: 1
- Matching public blocklists: CryptoFirewall
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: telegram

## Stored infrastructure

- Observed IP address: 212.192.14.75
- Registrar in stored WHOIS data: Registrar of Domain Names REG.RU LLC
- Registrar country in stored WHOIS data: RU
- Last stored HTTP status: 200
- Registration date (registry RDAP, spidervpn.online): 2026-04-05 12:43:36 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a0380d-6ac3-7646-a7ad-cb4e27b13dba/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/spidervpn.online
- Certificate Transparency search: https://crt.sh/?q=%25.spidervpn.online
- Web Archive lookup: https://web.archive.org/web/*/https://spidervpn.online/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
spidervpn.online is an impersonation phishing page that presents itself as MYXA VPN. Its Russian-language title, "MYXA VPN — Premium бесплатно", translates to "Premium for free" and is aimed at Russian-speaking users looking for a no-cost VPN. PhishDestroy first flagged the site on 2026-10-13. As of 2026-10-19 the site was still online and serving its content.

How the scam works
The lure is a free premium tier of a VPN service, delivered under a brand name that does not match the domain it runs on. Sites like this exploit the trust people place in a familiar product. They push visitors to sign in with existing account details, enter payment information to "activate" the offer, or download a client that does not come from the real vendor. Victims risk losing account credentials, card data, or control of a device that installs an unofficial app. A VPN app is especially damaging in the wrong hands because it can see the traffic it routes.

Evidence
On 2026-10-13, 16 of 92 VirusTotal engines classified the site as malicious. The detecting vendors include alphaMountain.ai, BitDefender, Certego, CRDF, ESTsecurity, Forcepoint ThreatSeeker, Fortinet and G-Data. That is a meaningful spread of independent vendors, not a single outlier. The domain also appears on the PhishDestroy and CryptoFirewall blocklists. It is referenced in six AlienVault OTX threat pulses, which means other analysts have tracked it as well.

Infrastructure
The domain was registered on 2026-04-05 through REG.RU, roughly six months before PhishDestroy detected it. That long gap suggests the name was registered early and held before or during its use. The site is hosted in Russia on the GIR-AS Global Internet Solutions network. Together with the Russian-language page, this points to an operation built around a Russian-speaking audience. It uses a free Let's Encrypt certificate, so the padlock in the browser says nothing about whether the site is legitimate.

What to do
If you entered a password for any VPN or other account on this page, change it right away and enable two-factor authentication. Do the same anywhere else you reused that password. If you submitted card details, contact your bank to block the card and dispute any charges. If you downloaded and installed a client from the site, uninstall it, run a full malware scan, and get VPN software only from the official vendor's channels. Defenders should block spidervpn.online at the DNS and proxy level and check logs for users who contacted it. They should also report it to the hosting network for takedown while it remains live.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a0380d-6ac3-7646-a7ad-cb4e27b13dba/
VirusTotal report: https://www.virustotal.com/gui/domain/spidervpn.online
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=spidervpn.online
Archived copy: https://web.archive.org/web/20261008204726/https://spidervpn.online/
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 09:26:16 UTC

## Stored page captures

- Primary capture: https://urlscan.io/screenshots/01a0380d-6ac3-7646-a7ad-cb4e27b13dba.png
  Captured: 2026-10-12 23:35:55 UTC
- URLScan capture: https://screenshots.phishdestroy.io/01a0380d-6ac3-7646-a7ad-cb4e27b13dba.png
  Captured: 2026-10-13 03:30:05 UTC
  Source report: https://urlscan.io/result/01a0380d-6ac3-7646-a7ad-cb4e27b13dba/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/446ee01a-f0f7-474c-9224-27b9debbe9d1.png
  Captured: 2026-10-12 23:54:19 UTC
  Source report: https://radar.cloudflare.com/scan/446ee01a-f0f7-474c-9224-27b9debbe9d1
  SHA-256: d078f679f7f7e9966967447b4d23bfb4cce3cd1392fb46b465cdc20165a8f671
- URLScan · 2026-08-04: https://screenshots.phishdestroy.io/us/019fccf6-e914-7589-90d8-a7fc98833502.png
  Captured: 2026-08-04 13:29:39 UTC
  Source report: https://urlscan.io/result/019fccf6-e914-7589-90d8-a7fc98833502/
  SHA-256: 36a5b17467f2818a728ba921e73257426919baa1e7bcb32011e465ec45145491
- URLScan · 2026-08-07: https://screenshots.phishdestroy.io/us/019fdc52-d57b-73a1-9245-13d6344dba7b.png
  Captured: 2026-08-07 13:04:13 UTC
  Source report: https://urlscan.io/result/019fdc52-d57b-73a1-9245-13d6344dba7b/
  SHA-256: 36a5b17467f2818a728ba921e73257426919baa1e7bcb32011e465ec45145491
- URLScan · 2026-08-13: https://screenshots.phishdestroy.io/us/019ffb1c-3c46-7320-8f14-a36e3b7bdf19.png
  Captured: 2026-08-13 12:32:46 UTC
  Source report: https://urlscan.io/result/019ffb1c-3c46-7320-8f14-a36e3b7bdf19/
  SHA-256: 36a5b17467f2818a728ba921e73257426919baa1e7bcb32011e465ec45145491
- URLScan · 2026-08-19: https://screenshots.phishdestroy.io/us/01a01a0a-c7ed-70df-85dc-6f9652470ed3.png
  Captured: 2026-08-19 12:41:55 UTC
  Source report: https://urlscan.io/result/01a01a0a-c7ed-70df-85dc-6f9652470ed3/
  SHA-256: 36a5b17467f2818a728ba921e73257426919baa1e7bcb32011e465ec45145491
- URLScan · 2026-10-12: https://screenshots.phishdestroy.io/us/01a13289-378d-72b9-bf8d-b91d7d782710.png
  Captured: 2026-10-12 23:53:42 UTC
  Source report: https://urlscan.io/result/01a13289-378d-72b9-bf8d-b91d7d782710/
  SHA-256: 36a5b17467f2818a728ba921e73257426919baa1e7bcb32011e465ec45145491
- URLScan · 2026-10-13: https://screenshots.phishdestroy.io/us/01a132a6-81ad-73de-aeee-ba8fc0997eef.png
  Captured: 2026-10-13 00:25:42 UTC
  Source report: https://urlscan.io/result/01a132a6-81ad-73de-aeee-ba8fc0997eef/
  SHA-256: 36a5b17467f2818a728ba921e73257426919baa1e7bcb32011e465ec45145491

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-20T17:51:20Z",
        "uuid": "01a0380d-6ac3-7646-a7ad-cb4e27b13dba",
        "scanned_at": "2026-08-25T08:33:27Z",
        "final_url": "https://spidervpn.online/",
        "status": 200,
        "redirected": "off-domain",
        "redirects": [
            {
                "to": "https://spidervpn.online/",
                "from": "https://www.ghostpathvpn.space/",
                "status": 301
            }
        ],
        "ip": "212.192.14.75",
        "ptr": "23052.ip-ptr.tech",
        "domains": [
            "mc.yandex.com",
            "mc.yandex.ru",
            "www.ghostpathvpn.space",
            "hdrc.yandex.net"
        ],
        "ips": [
            "87.250.251.119",
            "87.250.250.119",
            "212.192.14.75"
        ],
        "asns": [
            "13238",
            "207713"
        ],
        "countries": [
            "RU"
        ],
        "link_domains": [
            "telegram.me",
            "app.myxavpn.pro"
        ],
        "social": [
            "https://telegram.me/myxavpn_bot"
        ],
        "doc_hash": "060b1e9ea2764e9e1219414ef71e94571454ca471387d9b0daca6a50bb614149",
        "globals": [
            "ym",
            "Ya",
            "yaCounter109270715",
            "dataLayer"
        ],
        "cookies": [
            "bh",
            "_ym_uid",
            "_ym_d",
            "sync_cookie_csrf",
            "_ym_isad",
            "yabs-sid",
            "i",
            "yandexuid",
            "yuidss",
            "ymex",
            "receive-cookie-deprecation",
            "sync_cookie_csrf_secondary",
            "sync_cookie_ok_secondary",
            "_ym_visorc",
            "mdd"
        ],
        "storage_keys": [
            "_ymBRC",
            "_ym_synced",
            "_ym109270715_lsid",
            "_ym109270715:0_reqNum",
            "_ym_uid",
            "_ym_retryReqs",
            "_ym_wv2rf:109270715:0",
            "__ym_tab_guid"
        ],
        "tls": {
            "san": [
                "spidervpn.online",
                "www.spidervpn.online"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "YE2",
            "subject": "spidervpn.online",
            "protocol": "TLS 1.3",
            "valid_to": "2026-11-02T07:35:37Z",
            "valid_from": "2026-08-04T07:35:38Z"
        },
        "domain_age_days": 141,
        "apex_age_days": 141,
        "tls_age_days": 21,
        "tls_valid_days": 89,
        "requests": 11,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 99,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "nginx/1.24.0 (Ubuntu)",
            "content-type": "text/html"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-20T18:02:45Z",
        "uuid": "446ee01a-f0f7-474c-9224-27b9debbe9d1",
        "scanned_at": "2026-10-12T23:54:19Z",
        "final_url": "https://spidervpn.online/",
        "status": 200,
        "history": [
            {
                "url": "https://spidervpn.online/",
                "status": 200
            }
        ],
        "dom_hash": "e17e4149cdf5b95266930a761788ea97a137cade92f0952c9669913f082feace",
        "doc_hash": "060b1e9ea2764e9e1219414ef71e94571454ca471387d9b0daca6a50bb614149",
        "phishing_v2": [
            "phishing"
        ],
        "domain_risks": [
            "Malware",
            "Security threats",
            "CIPA Filter",
            "CIPA"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "spidervpn.online",
                "type": "A",
                "value": "212.192.14.75"
            }
        ],
        "dnssec_valid": false,
        "ip": "212.192.14.75",
        "verdict": {
            "tags": [
                "malware"
            ],
            "malicious": true,
            "categories": [
                "malware"
            ]
        },
        "whois": {
            "registrar": "Registrar of Domain Names REG.RU LLC",
            "created": "2026-04-05T12:43:36Z",
            "updated": "2026-04-10T12:44:12Z",
            "expires": "2027-04-05T12:43:36Z",
            "nameservers": [
                "ns1.reg.ru",
                "ns2.reg.ru"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-20T22:37:50Z",
        "analysis_at": "2026-10-16T23:49:52Z",
        "stats": {
            "timeout": 0,
            "harmless": 42,
            "malicious": 16,
            "suspicious": 3,
            "undetected": 31
        },
        "detections": {
            "CRDF": "malicious",
            "VIPRE": "malware",
            "G-Data": "phishing",
            "Lionic": "malware",
            "Sophos": "phishing",
            "Certego": "suspicious",
            "CyRadar": "malicious",
            "Webroot": "malicious",
            "Fortinet": "malware",
            "SOCRadar": "phishing",
            "URLQuery": "malicious",
            "Kaspersky": "malware",
            "LevelBlue": "phishing",
            "Seclookup": "malicious",
            "Gridinsoft": "suspicious",
            "BitDefender": "phishing",
            "ESTsecurity": "malicious",
            "alphaMountain.ai": "suspicious",
            "Forcepoint ThreatSeeker": "malicious"
        },
        "reputation": 0,
        "categories": {
            "Sophos": "phishing and fraud",
            "Webroot": "Malware Sites",
            "alphaMountain.ai": "Suspicious (alphaMountain.ai)",
            "Forcepoint ThreatSeeker": "malicious web sites"
        },
        "created": "2026-04-05T00:00:00Z",
        "updated": "2026-04-05T00:00:00Z",
        "first_seen": "2026-04-05T15:39:11Z",
        "dns": [
            {
                "ttl": 21600,
                "type": "NS",
                "value": "ns2.reg.ru"
            },
            {
                "ttl": 21600,
                "type": "SOA",
                "rname": "hostmaster.ns1.reg.ru",
                "value": "ns1.reg.ru"
            },
            {
                "ttl": 19188,
                "type": "A",
                "value": "212.192.14.75"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "ns1.reg.ru"
            }
        ],
        "dns_at": "2026-10-16T23:50:07Z",
        "jarm": "27d40d40d00040d00042d43d0000007d20e9b9a3e87aa1ec17cb4d646ce9a5",
        "cert": {
            "san": [
                "spidervpn.online",
                "www.spidervpn.online"
            ],
            "issuer": "Let's Encrypt / YE1",
            "serial": "6a0722679d981e37aabfa72f69c79883fcb",
            "sha256": "07e1f466bfd0646eb0d2f8f453cad10167ea91f8d768d53c0f4e92444654d44d",
            "subject": "spidervpn.online",
            "valid_to": "2027-01-01T18:05:32Z",
            "valid_from": "2026-10-03T18:05:33Z"
        },
        "rdap": {
            "status": [
                "client transfer prohibited"
            ],
            "events": {
                "expiration": "2027-04-05T12:43:37Z",
                "registration": "2026-04-05T12:43:37Z",
                "registrar expiration": "2027-04-05T12:43:37Z",
                "last update of RDAP database": "2026-10-15T19:03:55Z"
            },
            "registrar": "Registrar of Domain Names REG.RU LLC",
            "registrar_iana_id": "1606"
        }
    }
}
```