# PhishDestroy domain threat record: creyt.cl

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/creyt.cl/
Machine-readable companion: https://phishdestroy.io/domain/creyt.cl/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-09-27 02:38:35 UTC
- Last availability or vendor check: 2026-10-22 10:26:57 UTC
- Stored record updated: 2026-10-22 16:07:29 UTC
- VirusTotal detections in the stored snapshot: 11/91
- Independent public blocklist matches in the stored snapshot: 1
- Matching public blocklists: Phishunt
- Google Safe Browsing stored result: flagged

## Stored classification

- Targeted brand: microsoft

## Stored infrastructure

- Observed IP address: 50.31.166.23
- Registrar in stored WHOIS data: REGISTRAR_NOT_FOUND
- Registrar country in stored WHOIS data: Unknown
- Last stored HTTP status: 200
- Registration date in stored WHOIS data: 2026-01-15 23:00:00 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a0e0c0-5705-72fb-85d7-680153a77c3f/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/creyt.cl
- Certificate Transparency search: https://crt.sh/?q=%25.creyt.cl
- Web Archive lookup: https://web.archive.org/web/*/https://creyt.cl/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
creyt.cl is an impersonation phishing page dressed up as Microsoft OneDrive. Its page title reads "Access your file - OneDrive", and it targets anyone who receives a shared-document link and expects a routine Microsoft sign-in. PhishDestroy first flagged the domain on 2026-09-27. It was still online with the phishing content live on 2026-10-19.

How the scam works
Lures of this type usually arrive by email or chat as a notice that someone has shared a file with you. The link opens a page styled as OneDrive, which says you must sign in with your Microsoft account to view the document. Whatever email and password you type go to the operators, not to Microsoft. A stolen Microsoft account can expose mail, OneDrive and SharePoint files, and every service that uses that login. Attackers often use a compromised mailbox to send the same lure to the victim's contacts, which makes the next message look trustworthy.

Evidence
Google Safe Browsing lists the site for social engineering. urlscan.io rated it malicious and recognised Microsoft branding on the page. On 2026-10-03, 11 of 91 VirusTotal engines flagged it, including alphaMountain.ai, Bfore.Ai PreCrime, CRDF, Forcepoint ThreatSeeker, Fortinet, G-Data, Gridinsoft and Lionic. That count is modest, so many security tools may still let the page through. Phishunt lists the domain alongside PhishDestroy, and six AlienVault OTX threat pulses reference it.

Infrastructure
The site resolves to 50.31.166.23 on the SERVERCENTRAL - DEFT.COM network in the United States. The .cl country-code domain has no connection to Microsoft, which is an immediate warning sign for a page claiming to be OneDrive. Its certificate comes from Let's Encrypt. The padlock only means the connection is encrypted, not that the site belongs to Microsoft.

What to do
If you entered your Microsoft credentials on this page, change your password right away from a device you trust. Turn on or re-check multi-factor authentication, then review recent sign-in activity and active sessions. Also check your mailbox for forwarding rules or inbox rules you did not create, and change the password anywhere else you reused it. Warn your contacts not to open file-share messages that seem to come from you. Defenders should block the domain and its IP, search mail logs for messages linking to it, and reset credentials for any user who clicked through.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a0e0c0-5705-72fb-85d7-680153a77c3f/
VirusTotal report: https://www.virustotal.com/gui/domain/creyt.cl
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=creyt.cl
Archived copy: https://web.archive.org/web/20260927024401/https://creyt.cl/
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 09:34:09 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/6cjJXNjB/398d2adccf39.png
  Captured: 2026-09-27 02:46:26 UTC
- URLScan capture 1: https://screenshots.phishdestroy.io/01a0e0c0-5705-72fb-85d7-680153a77c3f.png
  Captured: 2026-09-27 02:46:26 UTC
  Source report: https://urlscan.io/result/01a0e0c0-5705-72fb-85d7-680153a77c3f/
- URLScan capture 2: https://urlscan.io/screenshots/01a0df16-81e5-76d8-b135-510a98c261ce.png
  Captured: 2026-09-27 02:38:35 UTC
  Source report: https://urlscan.io/result/01a0e0c0-5705-72fb-85d7-680153a77c3f/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/886aec75-6502-49f0-a7a8-ddc8d46b5b86.png
  Captured: 2026-09-27 02:39:53 UTC
  Source report: https://radar.cloudflare.com/scan/886aec75-6502-49f0-a7a8-ddc8d46b5b86
  SHA-256: bab5c8a4979d97459bb3c9d03a6615c262fbc6ff31256a71aa8cd37999cff8a8
- URLQuery: https://screenshots.phishdestroy.io/uq/a501cc13-0ff5-46a3-9435-1fe80fb2f68c.png
  Source report: https://urlquery.net/report/a501cc13-0ff5-46a3-9435-1fe80fb2f68c
  SHA-256: 27e319857d487b9f3b6339eb1cc7549f78b25aa6b91892d4d0ab553b153eec4f
- URLScan · 2026-09-26: https://screenshots.phishdestroy.io/us/01a0ddce-1f0b-708a-bb8a-c6fef15aa054.png
  Captured: 2026-09-26 13:01:14 UTC
  Source report: https://urlscan.io/result/01a0ddce-1f0b-708a-bb8a-c6fef15aa054/
  SHA-256: 7d51a14237673ef9a1bbfa4b826c7beb646606b5858b28949b462fb0e46aec77
- URLScan · 2026-09-26: https://screenshots.phishdestroy.io/us/01a0df16-833c-74c2-a0b3-f195b345d131.png
  Captured: 2026-09-26 19:00:00 UTC
  Source report: https://urlscan.io/result/01a0df16-833c-74c2-a0b3-f195b345d131/
  SHA-256: 18287ba047e9876a9e938c348fa184c79ef5ef7a495b69131cba4a52090dd2c1
- URLScan · 2026-09-27: https://screenshots.phishdestroy.io/us/01a0e289-4b22-711f-aa4b-6b95b88e328c.png
  Captured: 2026-09-27 11:04:12 UTC
  Source report: https://urlscan.io/result/01a0e289-4b22-711f-aa4b-6b95b88e328c/
  SHA-256: 7d51a14237673ef9a1bbfa4b826c7beb646606b5858b28949b462fb0e46aec77
- URLScan · 2026-09-28: https://screenshots.phishdestroy.io/us/01a0e58a-d967-7058-9873-e5b0e8e07d68.png
  Captured: 2026-09-28 01:04:44 UTC
  Source report: https://urlscan.io/result/01a0e58a-d967-7058-9873-e5b0e8e07d68/
  SHA-256: 7d51a14237673ef9a1bbfa4b826c7beb646606b5858b28949b462fb0e46aec77
- URLScan · 2026-09-30: https://screenshots.phishdestroy.io/us/01a0f410-1e91-7508-8d47-26c1da8693d4.png
  Captured: 2026-09-30 20:44:57 UTC
  Source report: https://urlscan.io/result/01a0f410-1e91-7508-8d47-26c1da8693d4/
  SHA-256: 7d51a14237673ef9a1bbfa4b826c7beb646606b5858b28949b462fb0e46aec77
- URLScan · 2026-10-07: https://screenshots.phishdestroy.io/us/01a11664-6141-7348-bc88-4ba7b5c8f051.png
  Captured: 2026-10-07 12:44:06 UTC
  Source report: https://urlscan.io/result/01a11664-6141-7348-bc88-4ba7b5c8f051/
  SHA-256: 1af966e9428bbba3c8e1322700f035b2b4df4b38893ace1ea495a18ca71ea698

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-20T20:56:47Z",
        "uuid": "01a0e0c0-5705-72fb-85d7-680153a77c3f",
        "scanned_at": "2026-09-27T02:45:02Z",
        "final_url": "https://creyt.cl/centennialcws/onedrive-verify-obf.html",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://creyt.cl/centennialcws/onedrive-verify-obf.html",
                "from": "http://creyt.cl/centennialcws/onedrive-verify-obf.html",
                "status": 307
            }
        ],
        "ip": "50.31.166.23",
        "ptr": "priva70.privatednsorg.com",
        "domains": [
            "uhf.microsoft.com"
        ],
        "ips": [
            "23.207.135.64",
            "50.31.166.23"
        ],
        "asns": [
            "16625",
            "23352"
        ],
        "countries": [
            "US"
        ],
        "doc_hash": "9cbc0d83db4ff402de6699341cdd3226daec7fd91eb204f2ad75424b144abf24",
        "globals": [
            "requestResize",
            "y3n7m4k",
            "x9k4m3t",
            "z7k4m3t",
            "r4j8n2v",
            "s9t4k6h",
            "p7x2q9v",
            "c2m8v4k",
            "m2p7n3x",
            "h9k4v2n",
            "l4x7s9w",
            "v8n3t9k",
            "q6h8m3t",
            "t7w3m9k",
            "w5s8d3x",
            "n3p6r5o"
        ],
        "tls": {
            "san": [
                "*.creyt.cl",
                "creyt.cl"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "YR1",
            "subject": "*.creyt.cl",
            "protocol": "TLS 1.3",
            "valid_to": "2026-12-16T19:37:21Z",
            "valid_from": "2026-09-17T19:37:22Z"
        },
        "domain_age_days": 253,
        "apex_age_days": 253,
        "tls_age_days": 9,
        "tls_valid_days": 89,
        "requests": 3,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 97,
                "malicious": true
            },
            "overall": {
                "tags": [
                    "phishing"
                ],
                "score": 100,
                "brands": [
                    "microsoft"
                ],
                "malicious": true,
                "categories": [
                    "phishing"
                ]
            },
            "urlscan": {
                "tags": [
                    "phishing"
                ],
                "score": 100,
                "brands": [
                    "Microsoft"
                ],
                "malicious": true,
                "categories": [
                    "phishing"
                ]
            }
        },
        "headers": {
            "content-type": "text/html"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-20T21:04:53Z",
        "uuid": "886aec75-6502-49f0-a7a8-ddc8d46b5b86",
        "scanned_at": "2026-09-27T02:39:53Z",
        "final_url": "https://creyt.cl/",
        "status": 200,
        "history": [
            {
                "url": "https://creyt.cl/",
                "status": 200
            }
        ],
        "dom_hash": "952c95e74cc241cb98939da5e9743e65203c47905d58a35d9c7251d2a6214907",
        "doc_hash": "9ba9bad09d5bd84801d1749d46d4f1ab908955ce868e1ac818f854b31d076694",
        "domain_risks": [
            "Technology"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "creyt.cl",
                "type": "A",
                "value": "50.31.166.23"
            }
        ],
        "dnssec_valid": false,
        "ip": "50.31.166.23",
        "whois": {
            "registrar": "NIC Chile",
            "created": "2026-01-16T18:04:13Z",
            "expires": "2027-01-16T18:04:13Z",
            "nameservers": [
                "ns1.bghoster.com",
                "ns2.bghoster.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-21T16:46:42Z",
        "analysis_at": "2026-10-08T00:51:39Z",
        "stats": {
            "timeout": 0,
            "harmless": 45,
            "malicious": 16,
            "suspicious": 1,
            "undetected": 30
        },
        "detections": {
            "CRDF": "malicious",
            "DNS8": "phishing",
            "VIPRE": "phishing",
            "G-Data": "phishing",
            "Lionic": "phishing",
            "Sophos": "phishing",
            "Webroot": "malicious",
            "Fortinet": "phishing",
            "SOCRadar": "phishing",
            "URLQuery": "malicious",
            "LevelBlue": "phishing",
            "Gridinsoft": "phishing",
            "BitDefender": "phishing",
            "alphaMountain.ai": "phishing",
            "Bfore.Ai PreCrime": "suspicious",
            "Google Safe Browsing": "phishing",
            "Forcepoint ThreatSeeker": "malicious"
        },
        "reputation": 0,
        "categories": {
            "alphaMountain.ai": "Malicious (alphaMountain.ai)"
        },
        "created": "2026-01-16T00:00:00Z",
        "updated": "2026-01-16T00:00:00Z",
        "first_seen": "2026-01-16T20:25:25Z",
        "dns": [
            {
                "ttl": 14400,
                "type": "A",
                "value": "50.31.166.23"
            },
            {
                "ttl": 14400,
                "type": "TXT",
                "value": "v=spf1 +a +mx +ip4:50.31.166.18 include:relay.mailchannels.net ~all"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "ns2.viphost.cl"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "ns1.viphost.cl"
            },
            {
                "ttl": 14400,
                "type": "MX",
                "value": "creyt.cl",
                "priority": 0
            },
            {
                "ttl": 21600,
                "type": "SOA",
                "rname": "remis.cog.cl",
                "value": "ns1.viphost.cl"
            }
        ],
        "dns_at": "2026-10-08T00:56:52Z",
        "jarm": "29d29d00029d29d00042d43d00041d598ac0c1012db967bb1ad0ff2491b3ae",
        "cert": {
            "san": [
                "*.creyt.cl",
                "creyt.cl"
            ],
            "issuer": "Let's Encrypt / YR1",
            "serial": "54772f4738598eb2ed49e536f2e7d77d72f",
            "sha256": "ee556c61b19303be1785f71dcab365b07ce23829e77ae8d6a33552fbcd6917b3",
            "subject": "*.creyt.cl",
            "valid_to": "2026-12-16T19:37:21Z",
            "valid_from": "2026-09-17T19:37:22Z"
        },
        "whois": []
    }
}
```