# PhishDestroy domain threat record: alcantaradesign.pt

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/alcantaradesign.pt/
Machine-readable companion: https://phishdestroy.io/domain/alcantaradesign.pt/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: not observed active
- First observed by PhishDestroy: 2026-09-21 09:48:40 UTC
- Last availability or vendor check: 2026-10-22 10:30:04 UTC
- Stored record updated: 2026-10-22 16:07:29 UTC
- VirusTotal detections in the stored snapshot: 15/91
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: manta

## Stored infrastructure

- Observed IP address: 31.22.7.7
- Registrar in stored WHOIS data: REGISTRAR_NOT_FOUND
- Last stored HTTP status: 302
- Registration date in stored WHOIS data: 2026-06-11 08:28:51 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a0c366-c05c-706a-8b47-bfe500be5aa7/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/alcantaradesign.pt
- Certificate Transparency search: https://crt.sh/?q=%25.alcantaradesign.pt
- Web Archive lookup: https://web.archive.org/web/*/https://alcantaradesign.pt/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
Despite its Portuguese, design-studio-sounding name, alcantaradesign.pt served an Indonesian-language online slot portal branded PAKONG86. The page billed itself as a trusted "slot gacor" site where players could "easily win maxwin today," which targets Indonesian-speaking gamblers searching for hot slot games. PhishDestroy classified it as a fraudulent gambling site and first saw it on 2026-09-21. The site has been offline since 2026-10-08 and still was not serving the gambling content at the last check on 2026-10-19.

How the scam works
Portals like PAKONG86 lean on slang such as "gacor" (slots said to be paying out) and "maxwin" (the top jackpot) to convince players that winning is easy and imminent. Victims register, deposit through bank transfer, e-wallet or similar channels, and often see early balances grow to build trust. When they try to cash out, withdrawals tend to stall, accounts get frozen, or new deposits and "turnover" requirements are demanded first. What players lose is the money they deposited, and often the personal and payment details they handed over at sign-up.

Evidence
Fifteen of 91 VirusTotal engines flagged the domain as of 2026-09-30. The vendors include alphaMountain.ai, BitDefender, CyRadar, ESET, Forcepoint ThreatSeeker, Fortinet, G-Data and Gridinsoft. Several independent security companies reached the same verdict, so this is not a single-source call. The domain also appears in five AlienVault OTX threat pulses, which shows other researchers have tracked it, and it is listed on the PhishDestroy blocklist.

Infrastructure
The domain was registered on 2026-06-11, roughly three months before PhishDestroy detected the gambling portal on it. It resolved to 31.22.7.7 on the Wildcard UK Limited network in Great Britain. That means an Indonesian slot operation was running on a Portuguese domain from UK hosting. The site used a free Let's Encrypt certificate, so the browser padlock only meant the connection was encrypted and said nothing about whether the operator was legitimate.

What to do
If you deposited money on PAKONG86, do not send more to unlock a withdrawal, pay a "verification" or "tax" fee, or meet a turnover target. Contact your bank or e-wallet provider right away to dispute recent transfers, and keep screenshots of your balance, chats and payment receipts. If you reused a password from this site anywhere else, change it there. Watch for follow-up messages offering to recover your funds, because these are a common second scam. Security teams should block the domain and its hosting IP and treat the PAKONG86 branding as an indicator if it reappears on other domains.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a0c366-c05c-706a-8b47-bfe500be5aa7/
VirusTotal report: https://www.virustotal.com/gui/domain/alcantaradesign.pt
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=alcantaradesign.pt
Archived copy: https://web.archive.org/web/20260921102140/https://alcantaradesign.pt/
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 10:52:14 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/1Y5rBsYj/ed4928653bed.png
  Captured: 2026-09-21 09:59:58 UTC
- URLScan capture 1: https://screenshots.phishdestroy.io/01a0c366-c05c-706a-8b47-bfe500be5aa7.png
  Captured: 2026-09-21 09:59:58 UTC
  Source report: https://urlscan.io/result/01a0c366-c05c-706a-8b47-bfe500be5aa7/
- URLScan capture 2: https://urlscan.io/screenshots/01a00020-89cb-74e9-9a0b-5b4b4cc10e5d.png
  Captured: 2026-09-21 09:48:40 UTC
  Source report: https://urlscan.io/result/01a0c366-c05c-706a-8b47-bfe500be5aa7/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/25f9f1b3-d0e9-4e04-bb50-159b04748818.png
  Captured: 2026-09-21 10:00:28 UTC
  Source report: https://radar.cloudflare.com/scan/25f9f1b3-d0e9-4e04-bb50-159b04748818
  SHA-256: 0ef367db66e7349a2e2200b3a506c7e1f0cfaf50a280f253c615c9d897c83306
- URLScan · 2026-07-24: https://screenshots.phishdestroy.io/us/019f91a5-4005-77d0-be47-ecb819921d8a.png
  Captured: 2026-07-24 01:02:40 UTC
  Source report: https://urlscan.io/result/019f91a5-4005-77d0-be47-ecb819921d8a/
  SHA-256: 9824acee62975ba18bdd30f3e9d7dd787d759364a6d151e452d8913ec859fa25
- URLScan · 2026-07-24: https://screenshots.phishdestroy.io/us/019f91bd-c116-7266-ac54-2caeeb7a17d4.png
  Captured: 2026-07-24 01:29:28 UTC
  Source report: https://urlscan.io/result/019f91bd-c116-7266-ac54-2caeeb7a17d4/
  SHA-256: 9fd3c16c7010a08218c9de7102f94dd928d9a4e6aff616539a58ec3431fe483c
- URLScan · 2026-07-24: https://screenshots.phishdestroy.io/us/019f91ce-b523-75eb-918b-4e0c5222e0ff.png
  Captured: 2026-07-24 01:48:00 UTC
  Source report: https://urlscan.io/result/019f91ce-b523-75eb-918b-4e0c5222e0ff/
  SHA-256: 4e0c87a889a7d524c4ac898e005a1392655cf94ef1efbf98b246afe7a26aa1fd
- URLScan · 2026-08-14: https://screenshots.phishdestroy.io/us/01a00020-89cb-74e9-9a0b-5b4b4cc10e5d.png
  Captured: 2026-08-14 11:55:32 UTC
  Source report: https://urlscan.io/result/01a00020-89cb-74e9-9a0b-5b4b4cc10e5d/
  SHA-256: 1c4046d15a15b90063ba48c69ab4e7e2d11581ef10c1b053e727419d85f10804
- URLScan · 2026-09-21: https://screenshots.phishdestroy.io/us/01a0c366-559e-70ee-bd20-656929d8aeff.png
  Captured: 2026-09-21 09:57:45 UTC
  Source report: https://urlscan.io/result/01a0c366-559e-70ee-bd20-656929d8aeff/
  SHA-256: f6638645ec74cb2fa2a5300b04c6c22a8c0aa11f9bcbb877422b163cfa68302c

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-20T22:21:19Z",
        "uuid": "01a0c366-c05c-706a-8b47-bfe500be5aa7",
        "scanned_at": "2026-09-21T09:58:14Z",
        "final_url": "https://www.alcantaradesign.pt/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://www.alcantaradesign.pt/",
                "from": "http://www.alcantaradesign.pt/",
                "status": 307
            }
        ],
        "ip": "31.22.7.7",
        "ptr": "sv01.ultraserver1.com",
        "domains": [
            "simcerebic.com",
            "fonts.googleapis.com",
            "static.cloudflareinsights.com",
            "background-private.pages.dev",
            "imgstore.io"
        ],
        "ips": [
            "172.217.197.95",
            "104.16.79.73",
            "104.21.75.82",
            "172.66.44.229",
            "31.22.7.7"
        ],
        "asns": [
            "15169",
            "13335",
            "34119"
        ],
        "countries": [
            "US",
            "GB"
        ],
        "link_domains": [
            "alcantaradesign.pt",
            "pakong86-kalcer.pages.dev"
        ],
        "doc_hash": "1faf279522b49e36c147b00d034b1d1f0b806f928a46d7cd2d54e918db59d8f5",
        "globals": [
            "__cfBeacon"
        ],
        "cookies": [
            "filehosting"
        ],
        "tls": {
            "san": [
                "alcantaradesign.pt",
                "mail.alcantaradesign.pt",
                "www.alcantaradesign.pt"
            ],
            "cipher": "AES_256_GCM",
            "issuer": "YR1",
            "subject": "alcantaradesign.pt",
            "protocol": "TLS 1.3",
            "valid_to": "2026-11-23T03:20:03Z",
            "valid_from": "2026-08-25T03:20:04Z"
        },
        "domain_age_days": 88,
        "apex_age_days": 1406,
        "tls_age_days": 27,
        "tls_valid_days": 89,
        "requests": 20,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 72,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "openresty",
            "content-type": "text/html; charset=UTF-8"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-20T22:29:47Z",
        "uuid": "25f9f1b3-d0e9-4e04-bb50-159b04748818",
        "scanned_at": "2026-09-21T10:00:28Z",
        "final_url": "https://alcantaradesign.pt/",
        "status": 200,
        "history": [
            {
                "url": "https://alcantaradesign.pt/",
                "status": 200
            }
        ],
        "dom_hash": "066b4f6a7a6d8a2715bc5f17cb67ad6c0a8edbb9a4e78110768da1837bc6095b",
        "doc_hash": "1faf279522b49e36c147b00d034b1d1f0b806f928a46d7cd2d54e918db59d8f5",
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "alcantaradesign.pt",
                "type": "A",
                "value": "31.22.7.7"
            }
        ],
        "dnssec_valid": false,
        "ip": "31.22.7.7",
        "whois": {
            "created": "2026-06-11T10:28:51Z",
            "expires": "2027-06-11T10:28:51Z",
            "nameservers": [
                "ns2.ultraserver3.com",
                "ns1.ultraserver3.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-22T00:28:19Z",
        "analysis_at": "2026-10-13T16:11:41Z",
        "stats": {
            "timeout": 0,
            "harmless": 43,
            "malicious": 15,
            "suspicious": 2,
            "undetected": 32
        },
        "detections": {
            "DNS8": "phishing",
            "ESET": "suspicious",
            "VIPRE": "phishing",
            "G-Data": "phishing",
            "Lionic": "phishing",
            "Sophos": "phishing",
            "CyRadar": "phishing",
            "Webroot": "malicious",
            "Fortinet": "phishing",
            "SOCRadar": "phishing",
            "URLQuery": "suspicious",
            "Kaspersky": "phishing",
            "Gridinsoft": "phishing",
            "BitDefender": "phishing",
            "Chong Lua Dao": "malicious",
            "alphaMountain.ai": "phishing",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": -1,
        "votes": {
            "malicious": 1
        },
        "first_seen": "2024-05-01T06:08:52Z",
        "dns": [
            {
                "ttl": 21600,
                "type": "SOA",
                "rname": "root.localhost",
                "value": "ns1.ultraserver1.com"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "ns2.ultraserver1.com"
            },
            {
                "ttl": 200,
                "type": "TXT",
                "value": "v=spf1 ip4:185.2.168.4 include:relay.mailchannels.net +ip4:82.163.176.254 +a +mx +ip4:31.22.4.169 +ip4:31.22.7.7 -all"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "ns1.ultraserver1.com"
            },
            {
                "ttl": 200,
                "type": "A",
                "value": "31.22.7.7"
            },
            {
                "ttl": 200,
                "type": "MX",
                "value": "alcantaradesign.pt",
                "priority": 0
            }
        ],
        "dns_at": "2026-10-13T16:17:08Z",
        "jarm": "29d29d00029d29d00042d42d0000002059a3b916699461c5923779b77cf06b",
        "cert": {
            "san": [
                "alcantaradesign.pt",
                "mail.alcantaradesign.pt",
                "www.alcantaradesign.pt"
            ],
            "issuer": "Let's Encrypt / YR1",
            "serial": "6a4b20260897d804bc117cf27a68d61eb87",
            "sha256": "38a664a00234988ebaa485431f364d2ce9fcf108e7d4c34c195fd770ded80705",
            "subject": "alcantaradesign.pt",
            "valid_to": "2026-11-23T03:20:03Z",
            "valid_from": "2026-08-25T03:20:04Z"
        }
    }
}
```