# PhishDestroy domain threat record: agenciaonline-sabesp.site

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/agenciaonline-sabesp.site/
Machine-readable companion: https://phishdestroy.io/domain/agenciaonline-sabesp.site/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: not observed active
- First observed by PhishDestroy: 2026-08-31 14:46:52 UTC
- Last availability or vendor check: 2026-10-21 01:14:25 UTC
- Stored record updated: 2026-10-22 14:20:38 UTC
- VirusTotal detections in the stored snapshot: 7/89
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored infrastructure

- Observed IP address: 172.67.188.147
- Registrar in stored WHOIS data: Nicnames, Inc.
- Registration date (registry RDAP, agenciaonline-sabesp.site): 2026-08-29 15:34:15 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a05879-6bd2-714a-ac7f-2514abf28be0/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/agenciaonline-sabesp.site
- Certificate Transparency search: https://crt.sh/?q=%25.agenciaonline-sabesp.site
- Web Archive lookup: https://web.archive.org/web/*/https://agenciaonline-sabesp.site/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
agenciaonline-sabesp.site is an impersonation phishing page. Its name copies "Agência Online", the customer portal of Sabesp, São Paulo's water and sanitation utility. The target is ordinary Sabesp customers who pay water bills or manage their accounts online. PhishDestroy first flagged the domain on 2026-08-31. It went offline on 2026-09-16, and its DNS was still inactive at the last check on 2026-10-19.

How the scam works
Utility-portal clones follow a familiar pattern. The victim reaches a page styled as the official service, usually through a search ad or a message about an overdue bill or a supposed discount. The page asks for identifying details such as a CPF or account number, then presents a fake bill or settlement offer to pay. Victims who pay send money to the fraudsters while their real account stays unpaid, and any personal or card data they typed in is harvested. The page's title read "Just a moment...", the wording of a Cloudflare browser-check screen, rather than Sabesp branding. We classified it as Sabesp impersonation based on the domain itself.

Evidence
On 2026-09-12, 7 of 89 VirusTotal engines flagged the domain. The flagging vendors were CRDF, Forcepoint ThreatSeeker, Fortinet, Gridinsoft, SOCRadar, VIPRE and Webroot. That is a modest share, but it is independent confirmation from several unrelated security vendors. The domain also appears in 4 AlienVault OTX threat pulses, which shows other researchers tracked it too. Among blocklists, it is listed by PhishDestroy.

Infrastructure
The domain was registered through Nicnames, Inc. on a .site extension, a cheap and generic choice that suits disposable lookalike domains. Traffic went through Cloudflare, Inc. on an address geolocated to Canada. This hides the real origin server, and it explains the "Just a moment..." title. The Google Trust Services certificate gave the page a padlock, which says nothing about whether the site was legitimate. The domain lasted about two weeks from our first sighting to going offline, a typical lifespan for this kind of campaign.

What to do
If you paid a bill or "negotiated debt" through this site, contact your bank immediately to dispute the payment. Then check your real balance only through Sabesp's official app or website. If you entered card details, block the card. If you shared your CPF or other personal data, watch for fraud attempts using your identity. If you reused a password there, change it everywhere you use it. Security teams should block the domain and watch for new lookalikes pairing "sabesp" or "agenciaonline" with low-cost extensions.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a05879-6bd2-714a-ac7f-2514abf28be0/
VirusTotal report: https://www.virustotal.com/gui/domain/agenciaonline-sabesp.site
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=agenciaonline-sabesp.site
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 10:24:58 UTC

## Stored page captures

- Primary capture: https://urlscan.io/screenshots/01a05879-6bd2-714a-ac7f-2514abf28be0.png
  Captured: 2026-08-31 14:46:52 UTC
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/3f08a63b-1dae-4836-b1b4-a586de99aba3.png
  Captured: 2026-09-11 00:20:27 UTC
  Source report: https://radar.cloudflare.com/scan/3f08a63b-1dae-4836-b1b4-a586de99aba3
  SHA-256: faeee989d355d61c8d3b9a29a43913d39de270f9103edd271ad2e2751e8b5eba
- URLScan · 2026-08-30: https://screenshots.phishdestroy.io/us/01a050ae-368a-748c-835b-7c2fe2f37beb.png
  Captured: 2026-08-30 03:19:55 UTC
  Source report: https://urlscan.io/result/01a050ae-368a-748c-835b-7c2fe2f37beb/
  SHA-256: 435df7ea1b51224a933a98f2ca3fef3f78df7ad983354ba6b4c61706f8ff5c1f
- URLScan · 2026-08-31: https://screenshots.phishdestroy.io/us/01a0584f-6ecf-74a5-9ff0-10af8666bb48.png
  Captured: 2026-08-31 14:53:21 UTC
  Source report: https://urlscan.io/result/01a0584f-6ecf-74a5-9ff0-10af8666bb48/
  SHA-256: 9352736e6a750f48699875fb03890d64fcea9d6936929ef6839363242eea580a
- URLScan · 2026-08-31: https://screenshots.phishdestroy.io/us/01a0585e-ad2e-766d-891d-c673e3577d09.png
  Captured: 2026-08-31 15:10:00 UTC
  Source report: https://urlscan.io/result/01a0585e-ad2e-766d-891d-c673e3577d09/
  SHA-256: f0f8ad173b8c03c6d761417ee9cda0b0bb435350f4a44fcf9818e80f6bc8e748
- URLScan · 2026-08-31: https://screenshots.phishdestroy.io/us/01a0586c-3c63-760d-8866-c4533d219830.png
  Captured: 2026-08-31 15:24:53 UTC
  Source report: https://urlscan.io/result/01a0586c-3c63-760d-8866-c4533d219830/
  SHA-256: 9dc2639a0efe1312d22785b1a9cd24eb40c4754deb8d7e4433471a817fec92aa
- URLScan · 2026-08-31: https://screenshots.phishdestroy.io/us/01a05871-a577-73df-9feb-e18c8b78dda0.png
  Captured: 2026-08-31 15:30:43 UTC
  Source report: https://urlscan.io/result/01a05871-a577-73df-9feb-e18c8b78dda0/
  SHA-256: ac3719756889d9bc894c3a5e73c3d7aea5cb7ac89a08383573657f22aa5cfe5f

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-21T02:21:24Z",
        "uuid": "01a05879-6bd2-714a-ac7f-2514abf28be0",
        "scanned_at": "2026-08-31T15:39:13Z",
        "final_url": "https://agenciaonline-sabesp.site/",
        "status": 403,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://agenciaonline-sabesp.site/",
                "from": "http://agenciaonline-sabesp.site/",
                "status": 307
            }
        ],
        "ip": "172.67.188.147",
        "ips": [
            "172.67.188.147"
        ],
        "asns": [
            "13335"
        ],
        "link_domains": [
            "www.cloudflare.com"
        ],
        "doc_hash": "dae0ce565ce6243046d3c9fff762a631eaca4038f9580d96edab5d55ba3eca15",
        "script_hashes": [
            "3a4042e7a13f661cf2b0be944807272e5c46a36879d600a4071a71c2115ecc3e"
        ],
        "globals": [
            "_cf_translation"
        ],
        "cookies": [
            "cf_clearance"
        ],
        "tls": {
            "san": [
                "agenciaonline-sabesp.site",
                "*.agenciaonline-sabesp.site"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "WE1",
            "subject": "agenciaonline-sabesp.site",
            "protocol": "QUIC",
            "valid_to": "2026-11-27T15:50:58Z",
            "valid_from": "2026-08-29T14:52:17Z"
        },
        "domain_age_days": 1,
        "apex_age_days": 1,
        "tls_age_days": 2,
        "tls_valid_days": 90,
        "requests": 7,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 97,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "cloudflare",
            "content-type": "text/html; charset=UTF-8",
            "x-frame-options": "SAMEORIGIN",
            "referrer-policy": "same-origin"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-21T02:33:02Z",
        "uuid": "3f08a63b-1dae-4836-b1b4-a586de99aba3",
        "scanned_at": "2026-09-11T00:20:27Z",
        "final_url": "https://agenciaonline-sabesp.site/",
        "status": 403,
        "redirected": "https-only",
        "history": [
            {
                "url": "http://agenciaonline-sabesp.site/",
                "status": 307
            },
            {
                "url": "https://agenciaonline-sabesp.site/",
                "status": 403
            }
        ],
        "dom_hash": "e1e0ec04ba2dccd9143717ccf431a0c9d267fac4083951806a2652b5fb5fcf8d",
        "doc_hash": "ca7b5d6d9e260701f75eb0f53c4d72d4c7a7f9ddf1deb7e3b786e9040b4fb129",
        "domain_risks": [
            "Newly Seen Domains",
            "Security Risks",
            "New Domains"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "agenciaonline-sabesp.site",
                "type": "A",
                "value": "172.67.188.147"
            },
            {
                "name": "agenciaonline-sabesp.site",
                "type": "A",
                "value": "104.21.19.193"
            },
            {
                "name": "agenciaonline-sabesp.site",
                "type": "AAAA",
                "value": "2606:4700:3031::6815:13c1"
            },
            {
                "name": "agenciaonline-sabesp.site",
                "type": "AAAA",
                "value": "2606:4700:3034::ac43:bc93"
            }
        ],
        "dnssec_valid": false,
        "ip": "172.67.188.147",
        "whois": {
            "registrar": "Nicnames, Inc.",
            "created": "2026-08-29T15:34:15Z",
            "updated": "2026-09-03T15:35:56Z",
            "expires": "2027-08-29T15:34:15Z",
            "nameservers": [
                "zelda.ns.cloudflare.com",
                "dakota.ns.cloudflare.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-22T17:44:00Z",
        "analysis_at": "2026-09-22T15:45:51Z",
        "stats": {
            "timeout": 0,
            "harmless": 49,
            "malicious": 7,
            "suspicious": 1,
            "undetected": 35
        },
        "detections": {
            "CRDF": "malicious",
            "VIPRE": "malware",
            "Webroot": "malicious",
            "Fortinet": "spam",
            "SOCRadar": "phishing",
            "LevelBlue": "phishing",
            "alphaMountain.ai": "phishing",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "categories": {
            "Google": "technology",
            "Webroot": "Phishing and Other Frauds",
            "alphaMountain.ai": "Phishing, Newly Registered (alphaMountain.ai)",
            "Forcepoint ThreatSeeker": "newly registered websites"
        },
        "registrar": "NicNames, Inc",
        "created": "2026-08-29T15:34:15Z",
        "expires": "2027-08-29T15:34:15Z",
        "updated": "2026-08-29T15:44:10Z",
        "first_seen": "2026-08-29T16:33:49Z",
        "dns": [
            {
                "ttl": 21600,
                "type": "NS",
                "value": "zelda.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3031::6815:13c1"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "dakota.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "172.67.188.147"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3034::ac43:bc93"
            },
            {
                "ttl": 1800,
                "type": "SOA",
                "rname": "dns.cloudflare.com",
                "value": "dakota.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "104.21.19.193"
            }
        ],
        "dns_at": "2026-09-13T10:12:58Z",
        "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c",
        "cert": {
            "san": [
                "agenciaonline-sabesp.site",
                "*.agenciaonline-sabesp.site"
            ],
            "issuer": "Google Trust Services / WE1",
            "serial": "eceb3e9be9ba2c3113fb20adf958f731",
            "sha256": "a33c849926300f4f258f35a395da2d997cc7461d3214b66a185901995e22db6b",
            "subject": "agenciaonline-sabesp.site",
            "valid_to": "2026-11-27T15:50:58Z",
            "valid_from": "2026-08-29T14:52:17Z"
        },
        "whois": {
            "registrar": "NicNames, Inc",
            "registrar_iana_id": "4156",
            "registrar_url": "http://www.nicnames.com",
            "created": "2026-08-29T15:34:15Z",
            "updated": "2026-08-29T15:44:10Z",
            "expires": "2027-08-29T15:34:15Z",
            "status": [
                "addPeriod",
                "clientTransferProhibited"
            ],
            "nameservers": [
                "dakota.ns.cloudflare.com",
                "zelda.ns.cloudflare.com"
            ],
            "dnssec": "unsigned"
        },
        "rdap": {
            "status": [
                "transfer prohibited"
            ],
            "events": {
                "last changed": "2026-08-29T15:44:10Z",
                "registration": "2026-08-29T15:34:15Z",
                "registrar expiration": "2027-08-29T15:34:15Z",
                "last update of RDAP database": "2026-09-27T17:19:15Z"
            }
        }
    }
}
```