getupdate[.]help

PhishDestroy first observed getupdate.help on Apr 13, 2026. The captured page title is “getupdate.help”. Stored page analysis classifies the content as credential phishing. Current evidence score: 66/100 (high).

Positive findings are stored from 5 sources: VirusTotal, MetaMask, SEAL, Spamhaus DBL, and DNS security resolvers. VirusTotal recorded 3 detections among 94 engines: Fortinet, Seclookup, SOCRadar on Jul 18, 2026 at 18:45 UTC. MetaMask and SEAL listed the hostname in the separate external-blocklist snapshot on Aug 8, 2026 at 02:20 UTC. Spamhaus DBL: DBL_SPAM on Jul 13, 2026 at 18:37 UTC. DNS security checks returned 3 blocking results across 12 tested policies: Control D Adblock, Control D Family, Control D Malware; no observation timestamp was retained. Non-positive and contextual checks: URLQuery recorded no positive detection; no observation timestamp was retained. Google Safe Browsing returned no flag on Apr 13, 2026 at 08:01 UTC. URLScan completed without a malicious verdict (score 0) on Jul 29, 2026 at 02:42 UTC. PhishStats returned no feed match on Apr 13, 2026 at 08:02 UTC.

The collector marked the hostname reachable on Aug 7, 2026 at 22:14 UTC, but did not retain the HTTP response code. Registration records for the domain list NameSilo, LLC as the registrar and Apr 13, 2026 as the creation date. Registration and first observation occurred on the same UTC date. At collection time, the hostname resolved to 178.16.55.171 on AS202412 (Omegatech LTD). The recorded endpoint location is New York, US. The stored server header is Apache/2.4.58 (Ubuntu). The evidence archive retains 2 visual captures from PhishDestroy and URLScan.

The content indicators and 5 positive source findings support the current credential phishing classification.