Verificação de phishing e segurança de urlwatch.com

The domain urlwatch.com is currently listed as a high‑risk phishing infrastructure in the July 22 2026 intelligence feed. The domain was originally registered on 9 March 2000 through MarkMonitor, Inc., and remains active despite its age, a pattern frequently observed in long‑standing abuse campaigns that repurpose legacy domains. DNS resolution points to the IPv4 address 18.245.86.12, hosted on Amazon Web Services as indicated by the four authoritative name servers (ns-1168.awsdns-18.org, ns-1967.awsdns-53.co.uk, ns-421.awsdns-52.com, ns-931.awsdns). The same address is currently observed in active network traffic associated with phishing distribution. Reputation services have flagged the domain on two independent blocklists, specifically PhishDestroy and OpenPhish, confirming that it is already recognized as malicious by external sink‑hole feeds.

VirusTotal analysis shows that four of ninety‑five scanning engines have generated a detection for urlwatch.com, reinforcing the blocklist evidence. No additional public threat‑intel platforms such as OTX or Google Safe Browsing are referenced in the supplied data. The available evidence does not include a page title, SSL certificate details, HTTP response codes, or any observed payload, leaving the exact phishing lure undefined. Consequently, the precise target brand or credential‑stealing technique cannot be confirmed at this time.

Nevertheless, the convergence of blocklist entries, partial VirusTotal detections, and the association with a cloud‑hosted IP address warrants immediate defensive action. Defenders should add urlwatch.com to network‑level deny lists, configure DNS filters to block resolution to 18.245.86.12, and ensure that endpoint security products are updated to reflect the four VirusTotal detections. Continuous monitoring of the domain’s DNS records and any future blocklist inclusions is recommended to capture potential changes in hosting or activity patterns.