realwoopt[.]live

On 24 July 2026 analysts observed that the domain realwoopt.live is currently offline but was previously serving a site titled “Real World Option – Real Estate, Cryptocurrency and Assets Trading company”. The domain was registered on 6 March 2026 through NameSilo, LLC and is delegated to the authoritative nameservers dns1.afeeshost.ltd, dns2.afeeshost.ltd and dns3.afeeshost.com. DNS resolution points to IP address 148.72.153.160, which is allocated to AS30083 (velia.net) and geolocated in the United States. The host runs an Apache Tomcat stack with Java, PHP, Bootstrap, Skolengo, MariaDB, Tiny Slider and loads external libraries from jsDelivr, indicating a typical web‑application environment rather than a specialized phishing kit.

The site presented a valid TLS certificate issued by Let’s Encrypt (R13), confirming encrypted HTTPS service when it was active. Threat intelligence sources have placed the domain on at least one security blocklist and it is explicitly blocked by PhishDestroy. VirusTotal scans returned a single positive detection out of 95 submitted samples, confirming that at least one security vendor flagged the domain as malicious. The combination of recent creation, rapid deployment, use of a reputable certificate, and the presence on a phishing‑specific blocklist aligns with a credential‑harvesting operation targeting users interested in real‑estate or cryptocurrency investments.

No further public reports, user‑submitted samples, or additional malware analyses are available, leaving the exact phishing payload and victim interaction unknown. Defenders should continue to block the domain at perimeter filters, monitor DNS queries for the listed nameservers, and consider adding the IP address 148.72.153.160 to host‑based deny lists. Ongoing watch of VirusTotal and other reputation feeds is recommended to detect any resurgence should the operators reactivate the site.