# PhishDestroy domain threat record: virlexpanel.name.ng Content language: English Canonical HTML report: https://phishdestroy.io/domain/virlexpanel.name.ng/ Machine-readable companion: https://phishdestroy.io/domain/virlexpanel.name.ng/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: not observed active - First observed by PhishDestroy: 2026-09-28 08:09:12 UTC - Last availability or vendor check: 2026-10-21 22:32:54 UTC - Stored record updated: 2026-10-22 14:24:58 UTC - VirusTotal detections in the stored snapshot: 4/91 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: no stored flag ## Stored infrastructure - Observed IP address: 163.61.188.5 - Registrar in stored WHOIS data: TRUEHOST CLOUD - Registrar country in stored WHOIS data: Unknown - Registration date (registry RDAP, name.ng): 2009-01-06 04:20:16 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a0e710-b1b9-72a1-bf81-bdb26f914a65/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/virlexpanel.name.ng - Certificate Transparency search: https://crt.sh/?q=%25.virlexpanel.name.ng - Web Archive lookup: https://web.archive.org/web/*/https://virlexpanel.name.ng/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview virlexpanel.name.ng presented itself as Virlex, with the page title "Virlex | Social media growth, web and ads". It was aimed at people shopping for follower boosts, website work or ad campaigns. PhishDestroy first flagged it on 2026-09-28, two days after the domain was registered. The site has been offline since 2026-09-29 and was still unreachable on 2026-10-19. How the scam works The "panel" in the domain name and the growth-services title match the setup of a social media marketing panel. Visitors on these panels typically create an account, top up a balance and order engagement packages. An impersonation page copies a known brand's name and layout so that payments and logins go to the operator instead of the real service. Victims can lose the money they deposit. If they reuse passwords, or hand over social media logins to have growth applied to their accounts, they can lose those accounts as well. The title advertises a legitimate-looking marketing business, but we classified the domain as impersonation phishing. Evidence On 2026-10-01, four of 91 VirusTotal engines flagged the domain: alphaMountain.ai, CRDF, Forcepoint ThreatSeeker and SOCRadar. That is a modest count, but it comes from four unrelated vendors that reached a verdict within days of registration. Spamhaus lists the domain on its DBL as a spam domain, so mail filters relying on that list will reject messages that point to it. Four AlienVault OTX pulses reference the domain, which shows other researchers have tracked it. Among public blocklists, PhishDestroy currently carries it. Infrastructure The domain was registered on 2026-09-26 through TRUEHOST CLOUD under Nigeria's .name.ng namespace. It was detected two days later and went dark the day after that, a short lifespan typical of throwaway phishing domains. It was hosted on the NEW DHAKA HARDWARE network at an address located in the US. Its Let's Encrypt certificate gave visitors a padlock, which only means the connection was encrypted, not that the site was the real Virlex. What to do If you paid a balance or bought a package on this site, contact your card issuer or payment provider now and ask for a chargeback. Do not send further "activation" or "unlock" payments to recover funds. If you created an account there or entered social media credentials, change those passwords everywhere you reused them and turn on two-factor authentication. Then review the connected apps and active sessions on your social accounts. Defenders should block the domain, add it to mail filtering alongside the Spamhaus listing, and watch for new .ng registrations that combine "virlex" with "panel" or similar words. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a0e710-b1b9-72a1-bf81-bdb26f914a65/ VirusTotal report: https://www.virustotal.com/gui/domain/virlexpanel.name.ng Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=virlexpanel.name.ng Archived copy: https://web.archive.org/web/20260928081037/https://virlexpanel.name.ng/ Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-19 11:00:55 UTC ## Stored page captures - Primary capture: https://i.ibb.co/XxnTqtyb/15d1092bb157.png Captured: 2026-09-28 08:11:16 UTC - URLScan capture 1: https://screenshots.phishdestroy.io/01a0e710-b1b9-72a1-bf81-bdb26f914a65.png Captured: 2026-09-28 08:11:16 UTC Source report: https://urlscan.io/result/01a0e710-b1b9-72a1-bf81-bdb26f914a65/ - URLScan capture 2: https://urlscan.io/screenshots/01a0e70e-c563-703b-a6af-9f6f6dc6f0a6.png Captured: 2026-09-28 08:09:12 UTC Source report: https://urlscan.io/result/01a0e710-b1b9-72a1-bf81-bdb26f914a65/ - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/dc62bc72-bb4b-411e-a8df-abf7f4841b1f.png Captured: 2026-09-28 08:11:00 UTC Source report: https://radar.cloudflare.com/scan/dc62bc72-bb4b-411e-a8df-abf7f4841b1f SHA-256: 649a0f6c2ac8625231ffb43fe83995670da7b7044aaa489dff4e0261346f7a9d - URLQuery: https://screenshots.phishdestroy.io/uq/a9412c8d-4c7c-48f4-8699-c47c8d1c22ba.png Source report: https://urlquery.net/report/a9412c8d-4c7c-48f4-8699-c47c8d1c22ba SHA-256: 436def9773bc22f6c31958a9a0ae8985b0e41036f789f38aa7d26be2f1d3c600 - URLScan ยท 2026-09-28: https://screenshots.phishdestroy.io/us/01a0e70e-c563-703b-a6af-9f6f6dc6f0a6.png Captured: 2026-09-28 08:08:26 UTC Source report: https://urlscan.io/result/01a0e70e-c563-703b-a6af-9f6f6dc6f0a6/ SHA-256: 206f1f48a4b6d56772e04be9d99f4b5a566ad707fe77bf9946edce7ec46e7a80 ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-20T20:55:28Z", "uuid": "01a0e710-b1b9-72a1-bf81-bdb26f914a65", "scanned_at": "2026-09-28T08:10:32Z", "final_url": "https://virlexpanel.name.ng/", "status": 200, "ip": "163.61.188.5", "ptr": "s4.whitelabelclouds.com", "domains": [ "fonts.gstatic.com", "fonts.googleapis.com" ], "ips": [ "142.251.13.94", "2a00:1450:4001:c17::5f", "163.61.188.5" ], "asns": [ "15169", "153568" ], "countries": [ "US", "DE", "BD" ], "link_domains": [ "app.virlexpanel.name.ng" ], "doc_hash": "c722c42d24783b62bdcffb1521c367e4c26192969f38dea536450362fc16ac78", "globals": [ "requestResize", "btn", "drawer", "setMenu", "LIVE", "reduceMotion", "onlineEls", "liveCur", "paintOnline", "tweenOnline", "nextOnline", "realOnline", "reduce", "counters", "run", "io" ], "tls": { "san": [ "*.virlexpanel.name.ng", "virlexpanel.name.ng", "www.app.virlexpanel.name.ng" ], "cipher": "AES_128_GCM", "issuer": "YR2", "subject": "*.virlexpanel.name.ng", "protocol": "TLS 1.3", "valid_to": "2026-12-25T20:14:54Z", "valid_from": "2026-09-26T20:14:55Z" }, "domain_age_days": 1, "apex_age_days": 1, "tls_age_days": 1, "tls_valid_days": 89, "requests": 5, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 95, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "LiteSpeed", "content-type": "text/html" } }, "cf": { "v": 1, "fetched_at": "2026-10-20T21:04:02Z", "uuid": "dc62bc72-bb4b-411e-a8df-abf7f4841b1f", "scanned_at": "2026-09-28T08:11:00Z", "final_url": "https://virlexpanel.name.ng/", "status": 200, "history": [ { "url": "https://virlexpanel.name.ng/", "status": 200 } ], "dom_hash": "4fcef5ecfd5b5719390cd76acf5c0d5fa5d587d2e173bfc4d851cebb80558672", "doc_hash": "c722c42d24783b62bdcffb1521c367e4c26192969f38dea536450362fc16ac78", "domain_risks": [ "Newly Seen Domains", "Security Risks" ], "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "virlexpanel.name.ng", "type": "A", "value": "163.61.188.5" } ], "dnssec_valid": false, "ip": "163.61.188.5" }, "vt": { "v": 1, "fetched_at": "2026-10-21T16:44:39Z", "analysis_at": "2026-09-29T15:10:49Z", "stats": { "timeout": 0, "harmless": 54, "malicious": 0, "suspicious": 0, "undetected": 38 }, "reputation": 0, "categories": { "alphaMountain.ai": "Suspicious (alphaMountain.ai)" }, "first_seen": "2026-09-26T21:33:11Z", "dns": [ { "ttl": 21600, "type": "NS", "value": "dns4.lytehosting.com" }, { "ttl": 14400, "type": "A", "value": "163.61.188.5" }, { "ttl": 14400, "type": "TXT", "value": "v=spf1 +a +mx +ip4:163.61.188.5 include:relay.serverfoundation.com ~all" }, { "ttl": 21600, "type": "SOA", "rname": "atalha.lytehosting.net", "value": "dns1.lytehosting.com" }, { "ttl": 21600, "type": "NS", "value": "dns3.lytehosting.com" }, { "ttl": 21600, "type": "NS", "value": "dns2.lytehosting.com" }, { "ttl": 21600, "type": "NS", "value": "dns1.lytehosting.com" }, { "ttl": 14400, "type": "MX", "value": "virlexpanel.name.ng", "priority": 0 } ], "dns_at": "2026-09-28T08:54:16Z", "jarm": "29d29d00029d29d00042d43d00041d598ac0c1012db967bb1ad0ff2491b3ae", "cert": { "san": [ "*.virlexpanel.name.ng", "virlexpanel.name.ng", "www.app.virlexpanel.name.ng" ], "issuer": "Let's Encrypt / YR2", "serial": "5edc825f47d977c8d8d1eeedbd4ee133022", "sha256": "9a74618992998876dda6125190ed2eff719a6f2128f36573f2e7cdb7c85528db", "subject": "*.virlexpanel.name.ng", "valid_to": "2026-12-25T20:14:54Z", "valid_from": "2026-09-26T20:14:55Z" } } } ```