# PhishDestroy domain threat record: hotmail-session-nmjk0bri-ww5ct9w0m-----yo26j491vd.zoecondominios.com.br

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/hotmail-session-nmjk0bri-ww5ct9w0m-----yo26j491vd.zoecondominios.com.br/
Machine-readable companion: https://phishdestroy.io/domain/hotmail-session-nmjk0bri-ww5ct9w0m-----yo26j491vd.zoecondominios.com.br/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-09-11 03:41:50 UTC
- Last availability or vendor check: 2026-10-22 10:06:21 UTC
- Stored record updated: 2026-10-22 15:45:01 UTC
- VirusTotal detections in the stored snapshot: 19/89
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: office 365

## Stored infrastructure

- Observed IP address: 216.126.227.232
- Registrar in stored WHOIS data: REGISTRAR_NOT_FOUND
- Registrar country in stored WHOIS data: BR
- Registration date (registry RDAP, zoecondominios.com.br): 2019-05-21 19:09:22 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a08e8d-6da2-704e-8831-a500865dcccf/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/hotmail-session-nmjk0bri-ww5ct9w0m-----yo26j491vd.zoecondominios.com.br
- Certificate Transparency search: https://crt.sh/?q=%25.hotmail-session-nmjk0bri-ww5ct9w0m-----yo26j491vd.zoecondominios.com.br
- Web Archive lookup: https://web.archive.org/web/*/https://hotmail-session-nmjk0bri-ww5ct9w0m-----yo26j491vd.zoecondominios.com.br/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
This is a credential-phishing page that poses as an Office 365 sign-in. It sits on a long, randomized subdomain that opens with "hotmail-session" to look like part of a Microsoft login flow. It targets anyone with a Microsoft work, school or personal Hotmail account. PhishDestroy first flagged it on 2026-09-11, and it was still online serving its phishing content as of 2026-10-19.

How the scam works
Victims usually arrive from an email or message warning about an expired session, a shared document or a mailbox problem. The link opens a page titled "Office 365" that copies Microsoft's sign-in screen and asks for an email address and password. Whatever is typed goes to the operators. A stolen Microsoft account can expose email, OneDrive and SharePoint files, and every service that uses that mailbox for password resets. It also gives attackers a trusted inbox to send the next wave of phishing from.

Evidence
On 2026-09-20, 19 of 89 VirusTotal engines flagged the site. They included BitDefender, ESET, Fortinet, Forcepoint ThreatSeeker, G-Data, Emsisoft, Ermes and alphaMountain.ai, so the call does not depend on any single vendor. urlscan.io rated the page malicious and detected Microsoft branding on it, which matches the Office 365 title. The domain is on the PhishDestroy blocklist.

Infrastructure
The parent domain was registered on 2019-05-21, more than seven years before this page appeared. The phishing content sits on a throwaway subdomain of an established Brazilian domain rather than on a freshly bought one. The page is hosted at 216.126.227.232 on the RouterHosting LLC network in the US. It uses a free Let's Encrypt certificate, so the browser padlock only means the connection is encrypted. It says nothing about who runs the site.

What to do
If you entered credentials here, change your Microsoft account password right away from the official Microsoft site. Then sign out of all sessions and turn on multi-factor authentication or review your existing methods. Check your mailbox for forwarding rules, unfamiliar app consents and recovery details you did not set. Change the password on any other account that shared it. Work and school users should report the incident to IT immediately. Defenders should block the full hostname and the parent domain at mail and web gateways, and search mail logs for links to it. They should also review sign-in logs for accounts that clicked it after 2026-09-11.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a08e8d-6da2-704e-8831-a500865dcccf/
VirusTotal report: https://www.virustotal.com/gui/domain/hotmail-session-nmjk0bri-ww5ct9w0m-----yo26j491vd.zoecondominios.com.br
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=hotmail-session-nmjk0bri-ww5ct9w0m-----yo26j491vd.zoecondominios.com.br
Archived copy: https://web.archive.org/web/20260922185007/https://hotmail-session-nmjk0bri-ww5ct9w0m-----yo26j491vd.zoecondominios.com.br/
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 09:44:32 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/T6y3k3n/802eb4c0d818.png
  Captured: 2026-09-11 03:41:50 UTC
- URLScan capture: https://screenshots.phishdestroy.io/01a08e8d-6da2-704e-8831-a500865dcccf.png
  Captured: 2026-09-11 03:41:50 UTC
  Source report: https://urlscan.io/result/01a08e8d-6da2-704e-8831-a500865dcccf/
- URLQuery: https://screenshots.phishdestroy.io/uq/3346daa0-b092-4779-8abd-193d7fe47c27.png
  Captured: 2026-09-11 03:48:55 UTC
  Source report: https://urlquery.net/report/3346daa0-b092-4779-8abd-193d7fe47c27
  SHA-256: 6ac94b6d504c7d2e33f2018582d60289d2f3af3f4bc7ed820f4d042bee2d81af
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/ed676707-8cc8-4560-992b-17ecea4ddd69.png
  Captured: 2026-09-11 04:13:28 UTC
  Source report: https://radar.cloudflare.com/scan/ed676707-8cc8-4560-992b-17ecea4ddd69
  SHA-256: 564bbc07b9c88abb30f6a9af5fd4f4bcdf4d66289d7abd7a14baf9c1904e7d54

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-21T00:19:55Z",
        "uuid": "01a08e8d-6da2-704e-8831-a500865dcccf",
        "scanned_at": "2026-09-11T03:40:34Z",
        "final_url": "https://hotmail-session-nmjk0bri-ww5ct9w0m-----yo26j491vd.zoecondominios.com.br/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://hotmail-session-nmjk0bri-ww5ct9w0m-----yo26j491vd.zoecondominios.com.br/",
                "from": "http://hotmail-session-nmjk0bri-ww5ct9w0m-----yo26j491vd.zoecondominios.com.br/",
                "status": 307
            }
        ],
        "ip": "216.126.227.232",
        "ptr": "232.227.126.216.static.cloudzy.com",
        "domains": [
            "img.icons8.com",
            "www.vectorlogo.zone"
        ],
        "ips": [
            "2a02:6ea0:c700::101",
            "172.67.176.194",
            "216.126.227.232"
        ],
        "asns": [
            "60068",
            "13335",
            "14956"
        ],
        "countries": [
            "DE",
            "US"
        ],
        "doc_hash": "6d8a749ab7210d4f2ac157c42dc6439b1d3f0957de83d23dded1096c01a52f0b",
        "cookies": [
            "PHPSESSID"
        ],
        "tls": {
            "san": [
                "*.zoecondominios.com.br",
                "contentson.help",
                "zoecondominios.com.br"
            ],
            "cipher": "AES_256_GCM",
            "issuer": "YR1",
            "subject": "*.zoecondominios.com.br",
            "protocol": "TLS 1.3",
            "valid_to": "2026-11-17T13:31:53Z",
            "valid_from": "2026-08-19T13:31:54Z"
        },
        "domain_age_days": 0,
        "apex_age_days": 2646,
        "tls_age_days": 22,
        "tls_valid_days": 89,
        "requests": 4,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 93,
                "malicious": true
            },
            "overall": {
                "tags": [
                    "phishing"
                ],
                "score": 100,
                "brands": [
                    "microsoft"
                ],
                "malicious": true,
                "categories": [
                    "phishing"
                ]
            },
            "urlscan": {
                "tags": [
                    "phishing"
                ],
                "score": 100,
                "brands": [
                    "Microsoft"
                ],
                "malicious": true,
                "categories": [
                    "phishing"
                ]
            }
        },
        "headers": {
            "server": "nginx/1.30.4",
            "content-type": "text/html; charset=UTF-8"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-21T02:32:24Z",
        "uuid": "ed676707-8cc8-4560-992b-17ecea4ddd69",
        "scanned_at": "2026-09-11T04:13:28Z",
        "final_url": "https://hotmail-session-nmjk0bri-ww5ct9w0m-----yo26j491vd.zoecondominios.com.br/",
        "status": 200,
        "history": [
            {
                "url": "https://hotmail-session-nmjk0bri-ww5ct9w0m-----yo26j491vd.zoecondominios.com.br/",
                "status": 200
            }
        ],
        "dom_hash": "da27716600e62f60e64bec0ccc046a7b242f575c09d7ca0dee011e4848b5ccd5",
        "doc_hash": "9873a9f71df8021dfdad2224f51ac071a167fc4441a6bac2f48fc29337fc7c5d",
        "phishing_v2": [
            "phishing"
        ],
        "domain_risks": [
            "Phishing",
            "Security threats",
            "CIPA Filter",
            "CIPA"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "hotmail-session-nmjk0bri-ww5ct9w0m-----yo26j491vd.zoecondominios.com.br",
                "type": "A",
                "value": "216.126.227.232"
            }
        ],
        "dnssec_valid": false,
        "ip": "216.126.227.232",
        "verdict": {
            "tags": [
                "phishing"
            ],
            "malicious": true,
            "categories": [
                "phishing"
            ]
        },
        "whois": {
            "created": "2019-05-21T00:00:00Z",
            "updated": "2025-05-28T00:00:00Z",
            "expires": "2027-05-21T00:00:00Z",
            "nameservers": [
                "ns1.paulosa.com.br",
                "ns2.paulosa.com.br"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-22T16:22:42Z",
        "analysis_at": "2026-10-22T04:14:39Z",
        "stats": {
            "timeout": 0,
            "harmless": 43,
            "malicious": 19,
            "suspicious": 0,
            "undetected": 30
        },
        "detections": {
            "Ermes": "phishing",
            "VIPRE": "phishing",
            "G-Data": "phishing",
            "Lionic": "phishing",
            "Sophos": "phishing",
            "CyRadar": "phishing",
            "Webroot": "malicious",
            "Emsisoft": "phishing",
            "Fortinet": "phishing",
            "Netcraft": "malicious",
            "SOCRadar": "malicious",
            "Kaspersky": "phishing",
            "LevelBlue": "phishing",
            "Gridinsoft": "phishing",
            "MalwareURL": "phishing",
            "BitDefender": "phishing",
            "desenmascara.me": "malicious",
            "alphaMountain.ai": "malicious",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "tags": [
            "dga"
        ],
        "expires": "2027-05-21T00:00:00Z",
        "first_seen": "2026-09-10T03:15:19Z",
        "dns": [
            {
                "ttl": 10159,
                "type": "TXT",
                "value": "v=spf1 +a +mx +ip4:177.53.143.230 ~all"
            },
            {
                "ttl": 14169,
                "type": "A",
                "value": "87.120.36.175"
            }
        ],
        "dns_at": "2026-10-22T04:19:56Z",
        "jarm": "1dd40d40d00040d00042d43d000000831b6af40378e2dd35eeac4e9311926e",
        "cert": {
            "san": [
                "p.ps11-net.de"
            ],
            "issuer": "Let's Encrypt / YE1",
            "serial": "679e8df82a176f947c3177275ae2b722e4f",
            "sha256": "1b4a4c336d8522e80094d360a817ba5339f8e249952d283fb25374bb84163044",
            "subject": "p.ps11-net.de",
            "valid_to": "2026-12-19T14:29:13Z",
            "valid_from": "2026-09-20T14:29:14Z"
        }
    }
}
```