# PhishDestroy threat dossier — pamconj.com
================================================================

Fetched:   2026-07-12 15:36:48 UTC
Canonical: https://phishdestroy.io/domain/pamconj.com/

## VERDICT
----------------------------------------------------------------
HIGH THREAT — malicious activity confirmed
Composite threat score: 68/100 (PhishDestroy scoring — see methodology below)

## DETECTION EVIDENCE
----------------------------------------------------------------
VirusTotal:      8/95 security vendors flagged this domain
  Flagging vendors: alphaMountain.ai, CRDF, CyRadar, Forcepoint ThreatSeeker, Fortinet, Gridinsoft, Seclookup, SOCRadar
AlienVault OTX:  4 pulses (threat-intel feed mentions)
Public blocklists: listed on 1 independent blocklist

## INFRASTRUCTURE
----------------------------------------------------------------
IP address:      159.65.36.134 (US, Clifton)
ASN:             AS14061 DigitalOcean, LLC
Hosting org:     Digital Ocean
Registrar:       Hetzner Online GmbH
Nameservers:     aliza.ns.cloudflare.com, micah.ns.cloudflare.com
Registered:      2026-04-06
Expires:         2027-04-06

## TLS CERTIFICATE
----------------------------------------------------------------
Issuer:     none
Status:     INVALID chain

## ABUSE-REPORT HISTORY (evidence of registrar non-response)
----------------------------------------------------------------
Status: pending notification queue. No abuse reports filed yet — this domain is
waiting for the next cycle of our automated abuse-reporter.

## TIMELINE
----------------------------------------------------------------
Domain registered: 2026-04-06 (per WHOIS / CT — may reflect a renewal or transfer date, not first-ever registration)
First detected:    2026-07-12 14:35:20 UTC (by PhishDestroy tracker)
Last verified:     2026-07-12 17:18:18 UTC
Current status:    ACTIVE / observable

## EXTERNAL CORROBORATION (third-party evidence)
----------------------------------------------------------------
URLScan.io:       https://urlscan.io/result/019f5652-9b4d-7089-a6dc-7c98f4d40354/
Wayback Machine:  https://web.archive.org/web/*/pamconj.com
crt.sh CT logs:   https://crt.sh/?q=%25.pamconj.com
Google transparency: https://transparencyreport.google.com/safe-browsing/search?url=pamconj.com
AlienVault OTX:   https://otx.alienvault.com/indicator/domain/pamconj.com
URLhaus:          https://urlhaus.abuse.ch/host/pamconj.com/

## ANALYST NARRATIVE
----------------------------------------------------------------
[Generated: 2026-07-12 17:18:18 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.]

This domain, pamconj.com, is actively flagged as a high-risk phishing site impersonating Zoho services. Analysis indicates the domain was registered on April 6, 2026, through Hetzner Online GmbH and currently resolves to the IP address 159.65.36.134, hosted on infrastructure belonging to Digital Ocean in the United States. The domain lacks an SSL certificate, a common red flag in phishing operations where encryption is either overlooked or intentionally omitted to avoid detection during initial setup.  Infrastructure analysis reveals the use of Cloudflare nameservers (aliza.ns.cloudflare.com and micah.ns.cloudflare.com), a tactic frequently employed to obscure hosting details and complicate takedown efforts. The domain appears in four distinct threat intelligence pulses on AlienVault OTX, suggesting repeated targeting or reuse in multiple campaigns. Additionally, eight out of ninety-five security vendors on VirusTotal have flagged this domain as malicious, with one security blocklist already listing it as a confirmed threat.  The detection of Zoho-related technologies on the site suggests an intent to mimic legitimate Zoho login portals, likely to harvest credentials or distribute malware under the guise of a trusted service. While the exact phishing kit or payload remains unconfirmed, the combination of missing SSL, Cloudflare obfuscation, and active blocklist presence aligns with known credential theft operations. Defenders should treat this domain as hostile and implement blocking at the DNS or network perimeter level. Monitoring for connections to 159.65.36.134 or the domain itself is recommended to identify compromised systems within their environment.

## SCORING METHODOLOGY
----------------------------------------------------------------
Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates:
  - VirusTotal positive ratio
  - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus,
    CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB)
  - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor)
  - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.)
  - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing
  - URLScan / URLQuery verdicts
  - Brand-impersonation heuristics (DOM analysis of forms, logos, wording)
  - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures)
  - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...)
  - Free-TLS vs paid-cert ratio (throwaway infrastructure signal)
  - Registrar/hosting abuse history (this registrar's track record)
  - Human researcher sign-off (operator takedown team)

A domain present in our database is ALREADY flagged. A low VT count by itself does
NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their
first 7–30 days while actively draining wallets. Always cross-reference the composite
score and the individual indicators above, not just VT.

## CORRECTIONS / APPEALS
----------------------------------------------------------------
Full HTML report:  https://phishdestroy.io/domain/pamconj.com/
JSON API:          https://api.destroy.tools/v1/check?domain=pamconj.com
Appeal a flag:     https://phishdestroy.io/appeals/  (responded to within 48 hours, FP rate <0.01%)
Submit a report:   https://t.me/PhishDestroy_bot

About PhishDestroy: independent open-source threat-intelligence platform.
Tracked: 177,717 domains (49,468 alive under monitoring, 128,119 confirmed takedowns/dead). Site: https://phishdestroy.io