PhishDestroy first observed 4ww-umb.com on Jul 30, 2026. The captured page title is “4ww-umb.com”. Current evidence score: 88/100 (critical).
Positive findings are stored from 3 sources: VirusTotal, Spamhaus DBL, and Cloudflare Radar. VirusTotal recorded 6 detections among 91 engines: alphaMountain.ai, Emsisoft, Fortinet, Netcraft, SOCRadar, Webroot on Jul 30, 2026 at 12:29 UTC. Spamhaus DBL: DBL_SPAM on Jul 30, 2026 at 14:30 UTC. Cloudflare Radar classified the hostname as malicious and assigned the categories phishing, security threats, and dga domains; its verdict timestamp was not retained. Non-positive and contextual checks: The separate external-blocklist snapshot contained no matches on Aug 8, 2026 at 10:20 UTC. Google Safe Browsing returned no flag on Jul 30, 2026 at 12:29 UTC. URLScan completed without a malicious verdict (score 0) on Aug 1, 2026 at 03:30 UTC.
HTTP 502 was recorded on Aug 8, 2026 at 02:36 UTC; content was unavailable. Latest classified outcome: registration hold observed; cause registrar client hold; mechanism client hold; observed actor NICENIC INTERNATIONAL GROUP CO., LIMITED on Aug 8, 2026 at 01:45 UTC. Registration records for the domain list NICENIC INTERNATIONAL GROUP CO., LIMITED as the registrar and Jul 29, 2026 as the creation date. Registration preceded first observation by 1 day. At collection time, the hostname resolved to 87.251.64.218 on AS200730 (ISAEV Igor). The recorded endpoint location is Warsaw, PL. The stored server header is nginx/1.30.2. DOM analysis on Jul 30, 2026 at 14:20 UTC returned 88/100. The evidence archive retains 3 visual captures from PhishDestroy and URLScan. TLS metadata lists FASTPANEL as the certificate issuer with validity through May 28, 2027; checked Jul 30, 2026 at 13:02 UTC.
The content indicators and 3 positive source findings support the current phishing classification. The stored fields do not identify an impersonated brand or victim interaction.