# PhishDestroy domain threat record: paeonia.gr

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/paeonia.gr/
Machine-readable companion: https://phishdestroy.io/domain/paeonia.gr/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-09-29 04:43:27 UTC
- Last availability or vendor check: 2026-10-22 10:30:31 UTC
- Stored record updated: 2026-10-22 16:07:29 UTC
- VirusTotal detections in the stored snapshot: 9/91
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: microsoft

## Stored infrastructure

- Observed IP address: 157.90.95.18
- Registrar in stored WHOIS data: REGISTRAR_NOT_FOUND
- Registrar country in stored WHOIS data: Unknown
- Last stored HTTP status: 200

## Evidence links

- URLScan report: https://urlscan.io/result/01a0eb88-2fb0-768b-93ed-3df354834f44/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/paeonia.gr
- Certificate Transparency search: https://crt.sh/?q=%25.paeonia.gr
- Web Archive lookup: https://web.archive.org/web/*/https://paeonia.gr/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
paeonia.gr is a Greek-registered domain that PhishDestroy classifies as an impersonation phishing page posing as Microsoft. It targets people who use Microsoft accounts. PhishDestroy first flagged it on 2026-09-29, and on 2026-10-19 the site was still online with its content live. The page title shows a guesthouse in Arachova ("Παιώνια: Ένας ζεστός Ξενώνας για Διαμονή στην Αράχωβα"), while our classification and urlscan.io's brand detection point to Microsoft impersonation.

How the scam works
Microsoft impersonation pages usually copy the look of a Microsoft sign-in screen or an Office 365 document prompt. Victims typically arrive through an email or message claiming a shared file, a mailbox problem or an expiring password. Whatever is typed into the fake login form goes to the operators. A stolen Microsoft account can expose email, OneDrive files and Teams chats, and it is often used to send further phishing from a trusted address. Accounts that reuse the same password elsewhere are put at risk as well.

Evidence
On 2026-10-03, 9 of 91 VirusTotal engines flagged the domain, including alphaMountain.ai, BitDefender, CRDF, ESET, Forcepoint ThreatSeeker, G-Data, Gridinsoft and SOCRadar. That is a modest share of engines, but it comes from several unrelated vendors. urlscan.io returned a malicious verdict and specifically detected Microsoft branding. The domain also appears in four AlienVault OTX threat pulses and on the PhishDestroy blocklist.

Infrastructure
The site resolves to 157.90.95.18 on Hetzner Online GmbH's network in Germany. A Greek .gr domain served from a German host is a common combination. When this page impersonates a global brand, that pairing makes the domain look like a local business rather than a Microsoft property, which is a mismatch readers should treat with caution.

What to do
If you entered a Microsoft email and password on this site, change that password at once from the official Microsoft account page. Then sign out of all sessions and turn on two-factor authentication or review your existing 2FA settings. Check your mailbox for new forwarding rules or unfamiliar sign-ins, and change the password on any other service where you used the same one. Organizations should block the domain and its IP at the mail gateway and web proxy. They should also search logs for users who visited it and force credential resets with session revocation for anyone who did.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a0eb88-2fb0-768b-93ed-3df354834f44/
VirusTotal report: https://www.virustotal.com/gui/domain/paeonia.gr
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=paeonia.gr
Archived copy: https://web.archive.org/web/20260929044735/https://paeonia.gr/
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 09:32:57 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/GfZMDGJn/e9fede6aabe7.png
  Captured: 2026-09-29 05:00:49 UTC
- URLScan capture 1: https://screenshots.phishdestroy.io/01a0eb88-2fb0-768b-93ed-3df354834f44.png
  Captured: 2026-09-29 05:00:49 UTC
  Source report: https://urlscan.io/result/01a0eb88-2fb0-768b-93ed-3df354834f44/
- URLScan capture 2: https://urlscan.io/screenshots/01a0eab1-2b0c-704f-a222-c0b6ba75cd00.png
  Captured: 2026-09-29 04:43:27 UTC
  Source report: https://urlscan.io/result/01a0eb88-2fb0-768b-93ed-3df354834f44/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/12d63a1c-6263-45fe-8883-6add32fc1afb.png
  Captured: 2026-09-29 04:46:45 UTC
  Source report: https://radar.cloudflare.com/scan/12d63a1c-6263-45fe-8883-6add32fc1afb
  SHA-256: 8781bd6355d57fb7f384fc9a4c939284063cffef17c38480635248b75bb0e068
- URLScan · 2026-09-23: https://screenshots.phishdestroy.io/us/01a0cf27-b38f-730d-807f-7ef4d361973a.png
  Captured: 2026-09-23 16:44:49 UTC
  Source report: https://urlscan.io/result/01a0cf27-b38f-730d-807f-7ef4d361973a/
  SHA-256: 4d69bf0fffaf4e9e08ff1cab685a379796be01687a7f114ffc598eb1c8b30bee
- URLScan · 2026-09-29: https://screenshots.phishdestroy.io/us/01a0eab1-2b0c-704f-a222-c0b6ba75cd00.png
  Captured: 2026-09-29 01:04:41 UTC
  Source report: https://urlscan.io/result/01a0eab1-2b0c-704f-a222-c0b6ba75cd00/
  SHA-256: b46cafb36e9dbee58371b987b6514fed3778e456db2337bcf9191c7830734faa
- URLScan · 2026-09-29: https://screenshots.phishdestroy.io/us/01a0eb93-a53d-7135-9241-1c92b23661c3.png
  Captured: 2026-09-29 05:12:06 UTC
  Source report: https://urlscan.io/result/01a0eb93-a53d-7135-9241-1c92b23661c3/
  SHA-256: 34c344cfccd806b671537fec8cc07a11db09a67c30d9290096843f94026d899b
- URLScan · 2026-09-30: https://screenshots.phishdestroy.io/us/01a0f457-3bf1-71bf-acbf-06514c6d5607.png
  Captured: 2026-09-30 22:03:13 UTC
  Source report: https://urlscan.io/result/01a0f457-3bf1-71bf-acbf-06514c6d5607/
  SHA-256: cb74eac7db757e2ae4da3048b585ebecb689ce8931c6db26a583f3ee8103ba52
- URLScan · 2026-10-18: https://screenshots.phishdestroy.io/us/01a15077-aa12-756f-b9b8-ab0e515ad94b.png
  Captured: 2026-10-18 19:23:14 UTC
  Source report: https://urlscan.io/result/01a15077-aa12-756f-b9b8-ab0e515ad94b/
  SHA-256: f9d9f0e1515f851a7226d8d4735eecb63606c1812c6298c19d896ac8a970f155

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-20T20:54:44Z",
        "uuid": "01a0eb88-2fb0-768b-93ed-3df354834f44",
        "scanned_at": "2026-09-29T04:59:33Z",
        "final_url": "https://paeonia.gr/alphamednow/",
        "status": 200,
        "redirected": "same-domain",
        "redirects": [
            {
                "to": "https://paeonia.gr/alphamednow",
                "from": "http://paeonia.gr/alphamednow",
                "status": 307
            },
            {
                "to": "https://paeonia.gr/alphamednow/",
                "from": "https://paeonia.gr/alphamednow",
                "status": 301
            }
        ],
        "ip": "157.90.95.18",
        "ptr": "zeus.thinkitweb.gr",
        "domains": [
            "aadcdn.msauth.net",
            "uhf.microsoft.com"
        ],
        "ips": [
            "13.107.246.40",
            "23.207.135.64",
            "157.90.95.18"
        ],
        "asns": [
            "8075",
            "16625",
            "24940"
        ],
        "countries": [
            "US",
            "DE"
        ],
        "doc_hash": "340239bcb6c449da9bcbd05cfd9ced75eb8c1b11d390f61c6f92c247833dd89d",
        "globals": [
            "requestResize",
            "b8v3m7k",
            "h5x9w2n",
            "z7k4m3t",
            "r4j8n2v",
            "s9t4k6h",
            "p7x2q9v",
            "c2m8v4k",
            "v8n3t9k",
            "m6w9h3r",
            "t5j8r3w",
            "h4k7m2x",
            "r3w7n4v",
            "n9k2w5x",
            "q6h8m3t",
            "f8n4k6r",
            "t7w3m9k",
            "s2v6k9m",
            "w6d3n8r",
            "x5m9k2t"
        ],
        "tls": {
            "san": [
                "*.paeonia.gr",
                "paeonia.gr"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "YR2",
            "subject": "*.paeonia.gr",
            "protocol": "TLS 1.3",
            "valid_to": "2026-10-29T09:44:15Z",
            "valid_from": "2026-07-31T09:44:16Z"
        },
        "domain_age_days": 2490,
        "apex_age_days": 2490,
        "tls_age_days": 59,
        "tls_valid_days": 89,
        "requests": 4,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 94,
                "malicious": true
            },
            "overall": {
                "tags": [
                    "phishing"
                ],
                "score": 100,
                "brands": [
                    "microsoft"
                ],
                "malicious": true,
                "categories": [
                    "phishing"
                ]
            },
            "urlscan": {
                "tags": [
                    "phishing"
                ],
                "score": 100,
                "brands": [
                    "Microsoft"
                ],
                "malicious": true,
                "categories": [
                    "phishing"
                ]
            }
        },
        "headers": {
            "content-type": "text/html"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-20T21:03:34Z",
        "uuid": "12d63a1c-6263-45fe-8883-6add32fc1afb",
        "scanned_at": "2026-09-29T04:46:45Z",
        "final_url": "https://paeonia.gr/",
        "status": 200,
        "history": [
            {
                "url": "https://paeonia.gr/",
                "status": 200
            }
        ],
        "dom_hash": "de87fc2fd44432f2f921dd34b30cf98283cd327a44c339e663461de1633f9aab",
        "doc_hash": "0944ef29cbf988d3fbc7a4d9c331ba2da5da7fc548110bd259b0b156f6b5d4d6",
        "domain_risks": [
            "Food & Drink",
            "Society & Lifestyle"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "paeonia.gr",
                "type": "A",
                "value": "157.90.95.18"
            }
        ],
        "dnssec_valid": false,
        "ip": "157.90.95.18"
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-21T16:43:29Z",
        "analysis_at": "2026-10-21T09:29:10Z",
        "stats": {
            "timeout": 0,
            "harmless": 48,
            "malicious": 12,
            "suspicious": 0,
            "undetected": 32
        },
        "detections": {
            "CRDF": "malicious",
            "ESET": "phishing",
            "VIPRE": "phishing",
            "G-Data": "phishing",
            "Lionic": "phishing",
            "CyRadar": "phishing",
            "Fortinet": "phishing",
            "SOCRadar": "phishing",
            "Gridinsoft": "phishing",
            "BitDefender": "phishing",
            "alphaMountain.ai": "phishing",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "first_seen": "2024-03-05T13:49:10Z",
        "dns": [
            {
                "ttl": 14400,
                "type": "TXT",
                "value": "v=spf1 +a +mx +ip4:157.90.95.18 ~all"
            },
            {
                "ttl": 14400,
                "type": "A",
                "value": "157.90.95.18"
            },
            {
                "ttl": 14400,
                "type": "MX",
                "value": "paeonia.gr",
                "priority": 0
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "ns2.dnsbrt.com"
            },
            {
                "ttl": 21600,
                "type": "SOA",
                "rname": "webmaster.thinkitweb.gr",
                "value": "ns1.dnsbrt.com"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "ns1.dnsbrt.com"
            }
        ],
        "dns_at": "2026-10-21T09:34:17Z",
        "jarm": "29d29d00029d29d00042d43d00041d598ac0c1012db967bb1ad0ff2491b3ae",
        "cert": {
            "san": [
                "*.paeonia.gr",
                "paeonia.gr"
            ],
            "issuer": "Let's Encrypt / YR1",
            "serial": "6543c386cafc842bf9aab0fb6f8501bb46",
            "sha256": "fc5041ebfc0df7d54352e7b99c0b3f5afb85545018b8c982eb952d0acdb4739f",
            "subject": "*.paeonia.gr",
            "valid_to": "2026-12-29T09:45:18Z",
            "valid_from": "2026-09-30T09:45:19Z"
        }
    }
}
```