# PhishDestroy domain threat record: dicaconsultores.com Content language: English Canonical HTML report: https://phishdestroy.io/domain/dicaconsultores.com/ Machine-readable companion: https://phishdestroy.io/domain/dicaconsultores.com/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: not observed active - First observed by PhishDestroy: 2026-10-10 22:13:05 UTC - Last availability or vendor check: 2026-10-21 01:18:10 UTC - Stored record updated: 2026-10-22 14:21:55 UTC - VirusTotal detections in the stored snapshot: 13/92 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: no stored flag ## Stored classification - Targeted brand: wordpress ## Stored infrastructure - Observed IP address: 217.160.0.171 - Registrar in stored WHOIS data: Arsys Internet, S.L. dba NICLINE.COM - Registrar country in stored WHOIS data: ES - Registration date (registry RDAP, dicaconsultores.com): 2026-03-06 18:23:28 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a127df-b58b-77b3-b163-f95ff7e67a27/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/dicaconsultores.com - Certificate Transparency search: https://crt.sh/?q=%25.dicaconsultores.com - Web Archive lookup: https://web.archive.org/web/*/https://dicaconsultores.com/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview dicaconsultores.com is an impersonation phishing page built to pass as a legitimate consultancy-style business and draw visitors into handing over sensitive information. PhishDestroy first flagged it on 2026-10-11. The site went offline on 2026-10-15, and as of 2026-10-19 its DNS no longer resolves. Any link to this domain arriving in email or chat should still be treated as hostile. How the scam works Impersonation pages borrow the look and name of a trusted organization so that a victim believes they are dealing with the real company. Typical lures include a login prompt, an invoice or document to view, or a payment request. Whatever the victim types, such as passwords, contact details or payment information, goes straight to the operators. The page title shows nothing more than the domain name repeated twice, which gives no hint of the brand being imitated. Our classification rests on the detections below, not on the title. Evidence On 2026-10-12, VirusTotal showed 13 of 92 security engines flagging the domain. Those vendors include BitDefender, Dr.Web, G-Data, Forcepoint ThreatSeeker, alphaMountain.ai, Bfore.Ai PreCrime, ADMINUSLabs and the Vietnamese anti-scam group Chong Lua Dao. That level of agreement among unrelated vendors is a meaningful signal for a domain this new. The domain also appears in 34 AlienVault OTX threat pulses, showing that multiple researchers tracked it independently. Among blocklists, it is listed by PhishDestroy. Infrastructure The domain was registered on 2026-03-06 through Arsys Internet, S.L. (NICLINE.COM), about seven months before PhishDestroy detected it. A gap that long suggests the domain was either kept dormant or used quietly before the phishing content was spotted. It was hosted on IONOS SE infrastructure in Germany. Its lifespan after detection was short: it went dark four days after we first saw it. What to do If you entered a password on this site, change it right away. Change it everywhere else you reused it, and turn on app-based two-factor authentication. If you submitted card or banking details, contact your bank to block the card and dispute any charges. Expect follow-up phishing that uses the personal details you shared, and don't trust messages that cite them. Defenders should block the domain at DNS and proxy level and search mail logs for messages linking to it. They should also check authentication logs for logins from users who may have visited it. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a127df-b58b-77b3-b163-f95ff7e67a27/ VirusTotal report: https://www.virustotal.com/gui/domain/dicaconsultores.com Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=dicaconsultores.com Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-19 10:13:40 UTC ## Stored page captures - Primary capture: https://i.ibb.co/S46bkrkt/32dc438604e5.png Captured: 2026-10-10 22:13:05 UTC - URLScan capture: https://screenshots.phishdestroy.io/01a127df-b58b-77b3-b163-f95ff7e67a27.png Captured: 2026-10-10 22:13:05 UTC Source report: https://urlscan.io/result/01a127df-b58b-77b3-b163-f95ff7e67a27/ - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/96f2ed2f-b565-476e-a8f8-35f9bf40a96e.png Captured: 2026-10-12 11:35:03 UTC Source report: https://radar.cloudflare.com/scan/96f2ed2f-b565-476e-a8f8-35f9bf40a96e SHA-256: 36d07495bcca5f3e48f8eca8aedf572633b1c8597772c12bfb5fcf7563770e66 - URLQuery: https://screenshots.phishdestroy.io/uq/beb35842-2d91-434e-a935-727574cfd695.png Source report: https://urlquery.net/report/beb35842-2d91-434e-a935-727574cfd695 SHA-256: 764a2413401fd435939d3b59e07f3b5003c36e0082fb1e12b03f21931f81f0b1 - URLScan · 2026-10-10: https://screenshots.phishdestroy.io/us/01a127c8-2885-71d0-a3af-0cda18400533.png Captured: 2026-10-10 21:46:38 UTC Source report: https://urlscan.io/result/01a127c8-2885-71d0-a3af-0cda18400533/ SHA-256: 0c9f65d723022fbbf70e568beb19757224281a58b51117b3a97d07dac515e353 - URLScan · 2026-10-10: https://screenshots.phishdestroy.io/us/01a127da-ed0d-70cc-ae82-2e1f73348ad7.png Captured: 2026-10-10 22:07:07 UTC Source report: https://urlscan.io/result/01a127da-ed0d-70cc-ae82-2e1f73348ad7/ SHA-256: 6a80a4319f04225d7413ef9d804606ed2c5b5c00e2308bc28e2d10dab94e67a5 ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-20T18:33:35Z", "uuid": "01a127df-b58b-77b3-b163-f95ff7e67a27", "scanned_at": "2026-10-10T22:12:20Z", "final_url": "http://dicaconsultores.com/", "status": 200, "redirects": [ { "to": "https://dicaconsultores.com/", "from": "http://dicaconsultores.com/", "status": 307 }, { "to": "http://dicaconsultores.com/", "from": "https://dicaconsultores.com/", "status": 307 } ], "ip": "2001:8d8:100f:f000::200", "domains": [ "www.arsys.es" ], "ips": [ "2001:8d8:100f:f000::200" ], "asns": [ "8560" ], "countries": [ "DE" ], "link_domains": [ "www.arsys.es", "www.ionos-group.com" ], "doc_hash": "fff802577573f375b142dfda06230af417f81b87dc4636bdb74ff1ad7f5d899b", "globals": [ "domainSearchField" ], "domain_age_days": 2805, "apex_age_days": 2805, "requests": 8, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 22, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "Apache", "content-type": "text/html" } }, "cf": { "v": 1, "fetched_at": "2026-10-20T18:45:05Z", "uuid": "96f2ed2f-b565-476e-a8f8-35f9bf40a96e", "scanned_at": "2026-10-12T11:35:03Z", "final_url": "https://dicaconsultores.com/", "history": [ { "url": "https://dicaconsultores.com/", "status": 0 } ], "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "dicaconsultores.com", "type": "A", "value": "217.160.0.171" }, { "name": "dicaconsultores.com", "type": "AAAA", "value": "2001:8d8:100f:f000::200" } ], "dnssec_valid": false, "whois": { "registrar": "Arsys Internet, S.L. dba NICLINE.COM", "created": "2026-03-06T18:23:28Z", "updated": "2026-05-05T17:24:11Z", "expires": "2027-03-06T18:23:28Z", "nameservers": [ "dns97.servidoresdns.net", "dns98.servidoresdns.net" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-21T02:38:46Z", "analysis_at": "2026-10-21T00:01:48Z", "stats": { "timeout": 0, "harmless": 48, "malicious": 13, "suspicious": 1, "undetected": 30 }, "detections": { "VIPRE": "malware", "Dr.Web": "malicious", "G-Data": "phishing", "Lionic": "malicious", "Sophos": "malicious", "SOCRadar": "phishing", "URLQuery": "suspicious", "Seclookup": "malicious", "ADMINUSLabs": "malicious", "BitDefender": "phishing", "Chong Lua Dao": "malicious", "alphaMountain.ai": "malicious", "Bfore.Ai PreCrime": "malicious", "Forcepoint ThreatSeeker": "malicious" }, "reputation": 0, "categories": { "Dr.Web": "known infection source", "Sophos": "command and control", "BitDefender": "porn", "alphaMountain.ai": "Malicious (alphaMountain.ai)", "Forcepoint ThreatSeeker": "malicious web sites" }, "created": "2026-03-06T00:00:00Z", "updated": "2026-03-06T00:00:00Z", "first_seen": "2023-10-07T13:46:15Z", "dns": [ { "ttl": 21600, "type": "NS", "value": "dns97.servidoresdns.net" }, { "ttl": 21600, "type": "NS", "value": "dns98.servidoresdns.net" }, { "ttl": 21600, "type": "SOA", "rname": "hostmaster.servidoresdns.net", "value": "dns97.servidoresdns.net" }, { "ttl": 3600, "type": "A", "value": "217.160.0.171" }, { "ttl": 3600, "type": "AAAA", "value": "2001:8d8:100f:f000::200" } ], "dns_at": "2026-10-13T02:23:31Z", "jarm": "27d27d27d00027d1dc42d42d0000005557fe5c0eece598995bd43427a3386b", "cert": { "san": [ "*.dicaconsultores.com", "dicaconsultores.com" ], "issuer": "Let's Encrypt / E1", "serial": "0354f3a013e804d6ad22b0ff0bf07616a7d3", "sha256": "ffe5e5984f435fd7b7dcc6dac40e54a4d4c78e93546d6b70976f59d89cdc68c9", "subject": "dicaconsultores.com", "valid_to": "2023-03-08T04:39:42Z", "valid_from": "2022-12-08T04:39:43Z" }, "whois": [], "rdap": { "status": [ "client hold" ], "events": { "last changed": "2026-10-14T17:08:01Z", "registration": "2026-03-06T18:23:28Z", "registrar expiration": "2027-03-06T18:23:28Z", "last update of RDAP database": "2026-10-21T00:01:54Z" }, "registrar": "Arsys Internet, S.L. dba NICLINE.COM", "registrar_iana_id": "379" } } } ```