espionwa[.]com

PhishDestroy first observed espionwa.com on Apr 17, 2026. The captured page title is “eSpionWA, by @PulseRoblox”. Stored page analysis classifies the content as credential phishing. Current evidence score: 100/100 (critical).

Positive findings are stored from 3 sources: VirusTotal, Cloudflare Radar, and URLQuery. VirusTotal recorded 15 detections among 91 engines: ADMINUSLabs, alphaMountain.ai, BitDefender, Cluster25, CyRadar, ESET, Forcepoint ThreatSeeker, Fortinet, G-Data, Gridinsoft, Kaspersky, Lionic, SOCRadar, Sophos, VIPRE on Jul 28, 2026 at 03:09 UTC. Cloudflare Radar classified the hostname as malicious and placed it in the phishing category; its verdict timestamp was not retained. URLQuery recorded 2 detections; no observation timestamp was retained. Non-positive and contextual checks: AlienVault OTX listed 1 community pulse reference (not vendor detections) on Apr 17, 2026 at 05:12 UTC. The separate external-blocklist snapshot contained no matches on Aug 8, 2026 at 06:20 UTC. Google Safe Browsing returned no flag on Jun 26, 2026 at 06:46 UTC. URLScan completed without a malicious verdict (score 0) on Jul 29, 2026 at 02:41 UTC.

HTTP 200 was recorded on Aug 7, 2026 at 22:14 UTC. Registration records for the domain list Global Domain Group LLC as the registrar and Apr 16, 2026 as the creation date. Registration and first observation occurred on the same UTC date. At collection time, the hostname resolved to 198.186.130.217 on AS13627 (Ambyre LLC). The recorded endpoint location is Frankfurt am Main, DE. The stored server header is Apache/2.4.58 (Ubuntu). The evidence archive retains 1 visual capture from PhishDestroy. TLS metadata lists Let's Encrypt as the certificate issuer with validity through Jun 4, 2026; checked Apr 17, 2026 at 02:00 UTC.

The content indicators and 3 positive source findings support the current credential phishing classification.