VirusTotal
4 / 91
ReportInterpretation & limits
Engine detections from this stored analysis. Vendors and collection times may differ from other sources.
“Lotto Vzla â Resultados & Proyecciones”
Assessment based on the stored source evidence below. Review sources →
These are dated observations, not a live safety check. No flag, a stored capture, or a completed analysis does not establish that a site is safe.
4 / 91
ReportEngine detections from this stored analysis. Vendors and collection times may differ from other sources.
1/100
A result applies to the recorded source and observation time. Absence of a flag is not proof of safety.
DBL_SPAM
A result applies to the recorded source and observation time. Absence of a flag is not proof of safety.
17 community references
ReportCommunity publication references, not a vendor verdict or evidence of a common operator.
stored report
A preserved page image documents what the collector received; a capture is not a safety verdict.
Analysis completed
ReportThis is the recorded automated analysis. Completion alone is not a safety verdict.
Checked; no threat flag recorded
ReportA result applies to the recorded source and observation time. Absence of a flag is not proof of safety.
Stored narrative · generated . Provider checks below retain their own observation dates.
lottovzla.online is an active domain created on May 19, 2026 and registered through Ultahost, Inc. The domain resolves to the IPv4 address 159.100.6.19, which is geolocated to Germany and associated with the same provider. Authoritative nameservers ns1‑ns4.ultahost.com are configured, and the MX record points to lottovzla.online with priority 0, indicating the domain also handles email traffic.
Web analysis shows the site returns an HTTP 301 redirect and serves a page titled “Lotto Vzla — Resultados & Proyecciones”. The TLS certificate is issued by Let’s Encrypt (R12) and matches the domain name, confirming the site is reachable over HTTPS. Gridinsoft assigns a trust score of 1 out of 100, reflecting a high likelihood of malicious use. No additional content beyond the title was observed during the brief fetch, consistent with a generic phishing landing page that may redirect victims to credential‑harvesting forms.
The domain appears on one security blocklist and is flagged by PhishDestroy. VirusTotal reports that 3 of 95 scanned security vendors have identified the domain as malicious, and AlienVault OTX includes it in a single threat pulse. These independent detections corroborate the classification of the site as a generic phishing infrastructure targeting users interested in lottery results.
Open questions remain regarding the specific phishing kit, the targeted brand, and the extent of victim data collection, as no payload or form details were captured. Defenders should block DNS resolution and HTTP/S traffic to 159.100.6.19, enforce email filtering for messages originating from the domain, and monitor for similar Let’s Encrypt‑issued domains registered through Ultahost in the same timeframe. Continuous threat‑intel feeds should be consulted for any updates to the blocklist status or additional indicators of compromise.
Stored crawler-versus-browser observations for this host, plus a live fingerprint check for Keitaro-style traffic distribution systems.
LiteSpeedScanner note: redirect: raw=redirect_301; http=301; via=https_proxy; location=https://marketzgroup.es/; server=LiteSpeed
For this gTLD, the registrar above operates under an ICANN accreditation agreement. The links below provide the official fee schedule and current DNS abuse compliance guidance.
RAA §3.18 establishes abuse-contact and handling requirements. This report can document stored outbound notices and later technical observations; it does not by itself establish receipt, investigation, remediation, or contractual non-compliance.
Edge-IP reputation is not attributed to this domain.
ns4.ultahost.comlottovzla.onlinepriority 0Location describes the IP network.
532e63b025e354ed1df2caee7d93e3ebe7137d99f2dd5ed0c0f43672b7cc7758cpanel.lottovzla.onlinecpcalendars.lottovzla.onlinecpcontacts.lottovzla.onlinemail.lottovzla.onlinewebdisk.lottovzla.onlinewebmail.lottovzla.onlinewww.lottovzla.onlineSaved certificate metadata. Certificate dates without a timezone are shown as stored. Transport encryption does not establish that the site is trustworthy.
10 recorded events. These records describe collected evidence, outgoing notifications and publication; they do not confirm a complete investigation or a takedown.
We scan suspicious URLs, inspect public results and send evidence through the appropriate abuse-reporting channels. The dated events above show what is recorded for this domain. The directory below explains the wider workflow.
Capture the rendered page, requests and visible infrastructure.
Compare the available engine results and retain the analysis timestamp.
Check whether Google currently lists the URL as unsafe.
Inspect a public scan and its recorded network and classification data.
Look for indicator references and related community intelligence.
Compare archived captures and preserve historical context.
Look for matching indicators and associated threat records.
Inspect certificate records and related hostnames.
Compare security resolver responses and record observed blocking.
Inspect the public DNS, TLS, HTTP and technology surface.
Security services used for scanning, reputation checks and reporting are listed below. A service being listed is not evidence that it received, accepted or acted on this particular domain. Recorded submissions appear in the notification history above.
Reported by 1 community member, first seen May 19, 2026
If credentials, payment data, or files were exposed, report the incident immediately. Change affected passwords, revoke active sessions, and scan the device.
Select your country to get official cybercrime contacts, or create a complaint draft →.
Template-based draft · optional AI wording assistance requires separate consent
Threat analysis using stored blocklist, WHOIS, DNS, and public scan evidence
Scan NowSubmit suspicious domains to our threat database — protect the community
ReportRecent phishing reports and observed availability changes
MonitorMonitor live threats or contest this listing if you believe it's a false positive