# PhishDestroy domain threat record: contact.zoecondominios.com.br Content language: English Canonical HTML report: https://phishdestroy.io/domain/contact.zoecondominios.com.br/ Machine-readable companion: https://phishdestroy.io/domain/contact.zoecondominios.com.br/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-09-03 00:46:34 UTC - Last availability or vendor check: 2026-10-22 10:12:31 UTC - Stored record updated: 2026-10-22 15:44:48 UTC - VirusTotal detections in the stored snapshot: 18/89 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: no stored flag ## Stored classification - Targeted brand: microsoft ## Stored infrastructure - Observed IP address: 216.126.227.232 - Registrar in stored WHOIS data: REGISTRAR_NOT_FOUND - Registrar country in stored WHOIS data: BR - Registration date (registry RDAP, zoecondominios.com.br): 2019-05-21 19:09:22 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a064b9-c11f-7385-a040-4b54dbe1819e/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/contact.zoecondominios.com.br - Certificate Transparency search: https://crt.sh/?q=%25.contact.zoecondominios.com.br - Web Archive lookup: https://web.archive.org/web/*/https://contact.zoecondominios.com.br/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview contact.zoecondominios.com.br is an impersonation phishing page that poses as a Microsoft sign-in under the title "Office 365". It targets people who use Microsoft 365 for work email, documents and Teams. PhishDestroy first detected it on 2026-09-03. As of 2026-10-19 the site was still online and serving its phishing content. How the scam works Victims usually arrive through an email or message that claims a document is waiting, a mailbox is full, or a password is about to expire. The link opens a copy of the Office 365 login screen, and whatever address and password the victim types go straight to the operators. With a working Microsoft 365 login, attackers can read mail, send invoice fraud or more phishing from a trusted address, and reach files stored in OneDrive and SharePoint. Some kits also ask for the one-time code, which lets the attackers get past two-factor authentication in real time. Evidence Eighteen of 89 VirusTotal engines flagged the site as of 2026-09-11. They include BitDefender, ESET, Fortinet, Forcepoint ThreatSeeker, Emsisoft, G-Data, CyRadar and Chong Lua Dao, so the verdict does not rest on one vendor. urlscan.io rated the page malicious and independently recognised Microsoft branding on it. Spamhaus lists the domain in its DBL under the phishing category, which means mail filters that use that feed can block messages carrying the link. The domain is also on the PhishDestroy blocklist. Infrastructure The parent domain zoecondominios.com.br was registered on 2019-05-21, more than seven years before the phishing page appeared. This is not a throwaway name bought for the campaign; the fake login sits on a "contact" subdomain of an older Brazilian .com.br domain. The page is hosted on RouterHosting LLC in the United States. It carries a free Let's Encrypt certificate, so the browser padlock it shows says nothing about whether the page is genuine. What to do If you entered your Microsoft credentials here, change your Microsoft 365 password right away from the official sign-in page. Then sign out all active sessions and check your two-factor authentication methods for any device or phone number you don't recognise. Look in your mailbox for forwarding rules, new inbox rules or sent messages you didn't write, and tell your IT team, because a stolen work login is often used to phish your contacts. Administrators should block the domain at mail and web gateways and review sign-in logs for logins from unusual locations after 2026-09-03. They should also require phishing-resistant MFA for Microsoft 365 accounts where possible. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a064b9-c11f-7385-a040-4b54dbe1819e/ VirusTotal report: https://www.virustotal.com/gui/domain/contact.zoecondominios.com.br Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=contact.zoecondominios.com.br Archived copy: https://web.archive.org/web/20260903004835/https://contact.zoecondominios.com.br/ Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-19 09:51:19 UTC ## Stored page captures - Primary capture: https://i.ibb.co/hRZWZK2M/5789c5d906d3.png Captured: 2026-09-03 00:46:34 UTC - URLScan capture: https://screenshots.phishdestroy.io/01a064b9-c11f-7385-a040-4b54dbe1819e.png Captured: 2026-09-03 00:46:34 UTC Source report: https://urlscan.io/result/01a064b9-c11f-7385-a040-4b54dbe1819e/ - URLQuery: https://screenshots.phishdestroy.io/uq/965d69b2-2fba-480f-8788-470bdf861a3a.png Captured: 2026-09-03 00:51:21 UTC Source report: https://urlquery.net/report/965d69b2-2fba-480f-8788-470bdf861a3a SHA-256: 7be4acedab17bbb3b5324d8ef30174161751e0f9d2f87f1332a19acb804b5b21 - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/33bb3d59-c7b1-477b-9085-fc5fce4fa089.png Captured: 2026-09-03 01:01:16 UTC Source report: https://radar.cloudflare.com/scan/33bb3d59-c7b1-477b-9085-fc5fce4fa089 SHA-256: ec724ebffd244b562d5fbecf23b6ceb67929cfdf1c006310b5319ab67574ee23 - URLScan · 2026-08-23: https://screenshots.phishdestroy.io/us/01a02c25-8335-765f-b443-77914e244065.png Captured: 2026-08-23 01:04:17 UTC Source report: https://urlscan.io/result/01a02c25-8335-765f-b443-77914e244065/ SHA-256: 984c9c4795fc8166f731990ea818f9f5fda940f27262ba61e9c3bdeadee62896 - URLScan · 2026-08-23: https://screenshots.phishdestroy.io/us/01a02d5b-18ba-74a6-b31a-ace77c18a598.png Captured: 2026-08-23 06:42:25 UTC Source report: https://urlscan.io/result/01a02d5b-18ba-74a6-b31a-ace77c18a598/ SHA-256: c9d8853535320d508f2afade3cb891ac705bc2a10f26d45ac305c58d9908be01 - URLScan · 2026-08-23: https://screenshots.phishdestroy.io/us/01a02fa9-2510-7232-8fe5-93425c73cc13.png Captured: 2026-08-23 17:26:55 UTC Source report: https://urlscan.io/result/01a02fa9-2510-7232-8fe5-93425c73cc13/ SHA-256: 079f7965d1ea60cf4aafed2fcaaf958cda9fd4607da895d0778559b28c2840e9 - URLScan · 2026-09-03: https://screenshots.phishdestroy.io/us/01a065c6-4c1d-7741-85b4-2d56961f9fc2.png Captured: 2026-09-03 05:38:16 UTC Source report: https://urlscan.io/result/01a065c6-4c1d-7741-85b4-2d56961f9fc2/ SHA-256: 30980ea1b26fd129735510b969205b966abc4eb91e2b5a1d47c137be66aa9ba7 - URLScan · 2026-10-07: https://screenshots.phishdestroy.io/us/01a11619-609e-709f-8fe7-c263b9387a7f.png Captured: 2026-10-07 11:22:12 UTC Source report: https://urlscan.io/result/01a11619-609e-709f-8fe7-c263b9387a7f/ SHA-256: d7232fc2cb3d2910dbbbdb873af47174107b6c15a62e2ae02ae4ae9fac0d5e2d ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-21T03:53:40Z", "uuid": "01a064b9-c11f-7385-a040-4b54dbe1819e", "scanned_at": "2026-09-03T00:44:56Z", "final_url": "https://contact.zoecondominios.com.br/", "status": 200, "redirected": "https-only", "redirects": [ { "to": "https://contact.zoecondominios.com.br/", "from": "http://contact.zoecondominios.com.br/", "status": 307 } ], "ip": "216.126.227.232", "ptr": "232.227.126.216.static.cloudzy.com", "domains": [ "img.icons8.com", "www.vectorlogo.zone" ], "ips": [ "195.181.175.41", "104.21.17.125", "216.126.227.232" ], "asns": [ "60068", "13335", "14956" ], "countries": [ "DE", "US" ], "doc_hash": "945e682c9637d505e40a3a73a8203d3d8a72873f6795401dd009015c3b3afd24", "cookies": [ "PHPSESSID" ], "tls": { "san": [ "*.zoecondominios.com.br", "contentson.help", "zoecondominios.com.br" ], "cipher": "AES_256_GCM", "issuer": "YR1", "subject": "*.zoecondominios.com.br", "protocol": "TLS 1.3", "valid_to": "2026-11-17T13:31:53Z", "valid_from": "2026-08-19T13:31:54Z" }, "domain_age_days": 10, "apex_age_days": 2638, "tls_age_days": 14, "tls_valid_days": 89, "requests": 4, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 83, "malicious": true }, "overall": { "tags": [ "phishing" ], "score": 100, "brands": [ "microsoft" ], "malicious": true, "categories": [ "phishing" ] }, "urlscan": { "tags": [ "phishing" ], "score": 100, "brands": [ "Microsoft" ], "malicious": true, "categories": [ "phishing" ] } }, "headers": { "server": "nginx/1.30.4", "content-type": "text/html; charset=UTF-8" } }, "cf": { "v": 1, "fetched_at": "2026-10-21T04:34:23Z", "uuid": "33bb3d59-c7b1-477b-9085-fc5fce4fa089", "scanned_at": "2026-09-03T01:01:16Z", "final_url": "https://contact.zoecondominios.com.br/", "status": 200, "redirected": "https-only", "history": [ { "url": "http://contact.zoecondominios.com.br/", "status": 307 }, { "url": "https://contact.zoecondominios.com.br/", "status": 200 } ], "dom_hash": "da27716600e62f60e64bec0ccc046a7b242f575c09d7ca0dee011e4848b5ccd5", "doc_hash": "9096539ab652820208cb2f691daed006483065d02c45b0dc065cc6eea802fb2e", "phishing_v2": [ "phishing" ], "url_risks": [ "Phishing" ], "domain_risks": [ "Phishing", "Security threats", "CIPA Filter", "CIPA" ], "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "contact.zoecondominios.com.br", "type": "A", "value": "216.126.227.232" } ], "dnssec_valid": false, "ip": "216.126.227.232", "verdict": { "tags": [ "phishing" ], "malicious": true, "categories": [ "phishing" ] }, "whois": { "created": "2019-05-21T00:00:00Z", "updated": "2025-05-28T00:00:00Z", "expires": "2027-05-21T00:00:00Z", "nameservers": [ "ns1.paulosa.com.br", "ns2.paulosa.com.br" ] } } } ```