azuremods[.]shop

PhishDestroy first observed azuremods.shop on Sep 3, 2026. Stored content metadata identifies Microsoft as the apparent target. The captured page title is “AzureMods — Premium Game Mods”. Stored page analysis classifies the content as impersonation. Current evidence score: 81/100 (critical).

Positive findings are stored from 5 sources: VirusTotal, Spamhaus DBL, Cloudflare Radar, URLQuery, and URLScan. VirusTotal recorded 2 detections among 91 engines: alphaMountain.ai, Fortinet on Sep 3, 2026 at 04:50 UTC. Spamhaus DBL: DBL_SPAM on Sep 3, 2026 at 02:30 UTC. Cloudflare Radar classified the hostname as malicious and placed it in the malware category; its verdict timestamp was not retained. URLQuery recorded 2 detections; no observation timestamp was retained. URLScan returned a malicious verdict with score 100; scan metadata linked the capture to Microsoft and assigned phishing as its category on Sep 3, 2026 at 05:08 UTC. Non-positive and contextual checks: On Sep 3, 2026 at 15:45 UTC, AlienVault OTX listed 4 community pulse references (not vendor detections); Google Safe Browsing returned no flag. The separate external-blocklist snapshot contained no matches on Sep 3, 2026 at 14:20 UTC.

The collector marked the hostname reachable on Sep 3, 2026 at 01:06 UTC, but did not retain the HTTP response code. Registration records for the domain list PDR Ltd. d/b/a PublicDomainRegistry.com as the registrar. At collection time, the hostname resolved to 2.26.122.117 on AS201988 (VPSPay ASN). The recorded endpoint location is Helsinki, FI. The stored server header is nginx/1.18.0 (Ubuntu). The evidence archive retains 2 visual captures from PhishDestroy and URLScan. TLS metadata lists Let's Encrypt as the certificate issuer with validity through Nov 27, 2026; checked Sep 3, 2026 at 04:02 UTC.

The content indicators and 5 positive source findings support the current Microsoft-themed impersonation classification.