# PhishDestroy threat dossier — escueladeprofesionalesvidaestetica.com.uy ================================================================ Fetched: 2026-04-26 16:38:20 UTC Canonical: https://phishdestroy.io/domain/escueladeprofesionalesvidaestetica.com.uy/ ## VERDICT ---------------------------------------------------------------- ACTIVE THREAT — multiple warning signs Composite threat score: 55/100 (PhishDestroy scoring — see methodology below) ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 0/94 security vendors flagged this domain ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 50.62.141.185 Registrar: REGISTRAR_NOT_FOUND Nameservers: ns47.domaincontrol.com, ns48.domaincontrol.com Registered: 2026-04-25 Page title: Vida Estética Centro de Capacitación Profesional S.R.L. HTTP response: 508 ## TLS CERTIFICATE ---------------------------------------------------------------- Issuer: Let's Encrypt / R12 Expires: 2026-05-26 Status: INVALID chain Fingerprint: 0cd9c867b214eeb32d0bd35313880bb8c3623ab3439b5a5f0da438a768ad2744 Subject Alternative Names (related infrastructure — often same operator): - cpanel.escueladeprofesionalesvidaestetica.com.uy - mail.escueladeprofesionalesvidaestetica.com.uy - webdisk.escueladeprofesionalesvidaestetica.com.uy - www.escueladeprofesionalesvidaestetica.com.uy ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: pending notification queue. No abuse reports filed yet — this domain is waiting for the next cycle of our automated abuse-reporter. ## TIMELINE ---------------------------------------------------------------- Domain registered: 2026-04-25 (per WHOIS / CT — may reflect a renewal or transfer date, not first-ever registration) First detected: 2026-04-25 18:15:14 UTC (by PhishDestroy tracker) Last verified: 2026-04-26 05:00:10 UTC Current status: ACTIVE / observable ## EXTERNAL CORROBORATION (third-party evidence) ---------------------------------------------------------------- URLScan.io: https://urlscan.io/result/019dc534-ac16-73cb-b7b5-3e053a3fd299/ Wayback Machine: https://web.archive.org/web/*/escueladeprofesionalesvidaestetica.com.uy crt.sh CT logs: https://crt.sh/?q=%25.escueladeprofesionalesvidaestetica.com.uy Google transparency: https://transparencyreport.google.com/safe-browsing/search?url=escueladeprofesionalesvidaestetica.com.uy AlienVault OTX: https://otx.alienvault.com/indicator/domain/escueladeprofesionalesvidaestetica.com.uy URLhaus: https://urlhaus.abuse.ch/host/escueladeprofesionalesvidaestetica.com.uy/ ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-04-25 18:16:15 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] PhishDestroy identifies an active credential harvesting scam hosted at escueladeprofesionalesvidaestetica.com.uy, targeting users with fake life coaching and beauty professional credential pages. The domain mimics a legitimate Uruguayan vocational training site, using social engineering to trick victims into submitting login credentials under the guise of course enrollment or certification verification. No known brand impersonation or drainer kit integration has been detected at this stage, but the page structure suggests a generic phishing template designed to harvest credentials for resale or further exploitation. The scam likely leverages urgency—such as limited enrollment or certification expiration—to pressure victims into acting quickly. This domain was flagged with a VirusTotal detection score of 0 out of 95 engines as of the latest scan, indicating it remains under the radar of most antivirus and security platforms. The domain is registered through Let's Encrypt for SSL encryption, resolving to IP address 50.62.141.185. The domain was created recently and has not yet been categorized by Google Safe Browsing (GSB status: unknown), nor does it appear on major threat intelligence blocklists at this time. These factors contribute to its elevated risk profile, as early-stage domains with clean reputations are often weaponized for phishing before detection systems catch up. As of the most recent assessment, escueladeprofesionalesvidaestetica.com.uy remains active and is actively serving phishing content. PhishDestroy has escalated this threat to our response team and is monitoring for changes in infrastructure or payload delivery. While the immediate risk is categorized as under investigation, users are strongly advised to avoid interacting with this domain and report any suspicious activity. The lack of detections underscores the need for proactive monitoring and user awareness, as this scam may evolve or expand to target additional victims. Remaining risk is high due to the domain's active status and clean reputation at launch. ## EVIDENCE HASHES ---------------------------------------------------------------- Favicon MD5: 0fea16167ecdad14ad1abec2d29ba204 TLS cert SHA-256: 0cd9c867b214eeb32d0bd35313880bb8c3623ab3439b5a5f0da438a768ad2744 ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (volunteer takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/escueladeprofesionalesvidaestetica.com.uy/ JSON API: https://api.destroy.tools/v1/check?domain=escueladeprofesionalesvidaestetica.com.uy Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: volunteer-driven open-source threat-intelligence platform. Tracked: 131,000+ phishing domains. Confirmed takedowns: 91,000+. Site: https://phishdestroy.io