# PhishDestroy threat dossier — webmail.bmediaagency.com ================================================================ Fetched: 2026-07-29 14:03:46 UTC Canonical: https://phishdestroy.io/domain/webmail.bmediaagency.com/ ## VERDICT ---------------------------------------------------------------- CRITICAL THREAT — DO NOT VISIT Composite threat score: 96/100 (PhishDestroy scoring — see methodology below) ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 7/91 security vendors flagged this domain Flagging vendors: Fortinet, LevelBlue, SOCRadar, Sophos, URLQuery, VIPRE, Webroot Public blocklists: listed on 1 independent blocklist ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 162.241.24.206 (US, Phoenix) ASN: AS31898 Oracle Corporation Hosting org: Unified Layer Registrar: GoDaddy.com, LLC Nameservers: ["ns1.bluehost.com", "ns2.bluehost.com"] Page title: Not Acceptable! HTTP response: 301 ## TLS CERTIFICATE ---------------------------------------------------------------- Issuer: Let's Encrypt / YR1 Expires: 2026-10-01 Status: INVALID chain Fingerprint: ae470f59096ff9bdd693b7965e875ef1648f44628522c08222e31a92b6d1e41d Subject Alternative Names (related infrastructure — often same operator): - autodiscover.bmediaagency.com - autodiscover.ems.ppf.mybluehost.me - bmedia.ems.ppf.mybluehost.me - bmediaagency.com - cpanel.bmediaagency.com - cpanel.ems.ppf.mybluehost.me - cpcalendars.bmediaagency.com - cpcalendars.ems.ppf.mybluehost.me - cpcontacts.bmediaagency.com - cpcontacts.ems.ppf.mybluehost.me - drsalmabargawi.ems.ppf.mybluehost.me - ems.ppf.mybluehost.me - mail.bmediaagency.com - mail.ems.ppf.mybluehost.me - webdisk.bmediaagency.com ... +6 more ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: pending notification queue. No abuse reports filed yet — this domain is waiting for the next cycle of our automated abuse-reporter. ## TIMELINE ---------------------------------------------------------------- First detected: 2026-07-25 11:53:09 UTC (by PhishDestroy tracker) Last verified: 2026-07-29 12:43:26 UTC Current status: ACTIVE / observable ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-07-25 11:54:36 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] Is webmail.bmediaagency.com a Phishing Domain? On July 25, 2026, the domain webmail.bmediaagency.com has been flagged as a high-risk generic phishing domain. Analysis indicates that the domain is currently active and has been registered through GoDaddy.com, LLC. The domain exhibits a HTTP status code of 301, which typically signifies a permanent redirect to another URL, a common tactic employed by phishing actors to mask the true destination of the site. The domain is blocked by PhishDestroy, a reputable security service, and appears on one security blocklist, further corroborating its malicious nature. While 7 of 91 security vendors on VirusTotal have flagged this domain, the low detection rate may not fully reflect its risk level, as phishing sites often evade initial detection. The nameservers for this domain are ns1.bluehost.com and ns2.bluehost.com, indicating that the domain is hosted by Bluehost, a popular web hosting service. Given the high risk level and active status, defenders should exercise caution and consider implementing additional security measures to protect against potential phishing attacks. The exact content and purpose of the webmail.bmediaagency.com site have not yet been analyzed in detail, but the domain's presence on blocklists and its HTTP status code suggest it is being used for malicious activities. Defenders are advised to monitor traffic to this domain and consider blocking it at the network level to mitigate potential threats. ## EVIDENCE HASHES ---------------------------------------------------------------- Favicon MD5: 827fd6c561d4b1f932f75e0f9a17f766 TLS cert SHA-256: ae470f59096ff9bdd693b7965e875ef1648f44628522c08222e31a92b6d1e41d ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (operator takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/webmail.bmediaagency.com/ JSON API: https://api.destroy.tools/v1/check?domain=webmail.bmediaagency.com Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: independent open-source threat-intelligence platform. Tracked: 195,478 domains (83,245 alive under monitoring, 109,716 confirmed takedowns/dead). Site: https://phishdestroy.io