# PhishDestroy domain threat record: pffb.org.pk Content language: English Canonical HTML report: https://phishdestroy.io/domain/pffb.org.pk/ Machine-readable companion: https://phishdestroy.io/domain/pffb.org.pk/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-09-16 19:01:03 UTC - Last availability or vendor check: 2026-10-23 10:40:06 UTC - Stored record updated: 2026-10-23 18:22:18 UTC - VirusTotal detections in the stored snapshot: 15/91 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: no stored flag ## Stored infrastructure - Observed IP address: 207.174.214.183 - Registrar in stored WHOIS data: REGISTRAR_NOT_FOUND - Last stored HTTP status: 200 - Registration date in stored WHOIS data: 1999-07-27 22:00:00 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a0abaa-c9e0-7243-ba8a-07da7db16bb9/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/pffb.org.pk - Certificate Transparency search: https://crt.sh/?q=%25.pffb.org.pk - Web Archive lookup: https://web.archive.org/web/*/https://pffb.org.pk/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview pffb.org.pk is a live credential phishing page that PhishDestroy first recorded on 2026-09-16. No specific impersonated brand has been identified, so anyone landing on it should treat any login or verification prompt as a trap. When last checked on 2026-10-19 the site was still online and serving content. The page title reads "Not Acceptable!", which looks like a server error message, while our classification is credential phishing. How the scam works Credential phishing pages show a convincing login or verification form and send whatever the victim types to the operators instead of a real service. The stolen usernames, passwords and sometimes one-time codes are then used to take over email, exchange or wallet-related accounts. One compromised mailbox can also be used to reset passwords elsewhere. The loss is account control, and with it any funds or data behind that login. Evidence On 2026-09-29, 15 of 91 VirusTotal engines flagged the domain. They include AILabs (MONITORAPP), alphaMountain.ai, BitDefender, Chong Lua Dao, CRDF, CyRadar, Forcepoint ThreatSeeker and Gridinsoft. That is a minority of engines, but it spans independent commercial and community feeds that reached the same verdict. The domain also appears in 50 AlienVault OTX threat pulses, so it is already tracked in shared intelligence. PhishDestroy lists it on its own blocklist. Infrastructure The domain was registered on 1999-07-28, decades before PhishDestroy detected phishing on it. That history fits an established site now hosting phishing content better than a freshly registered throwaway domain. It resolves to 207.174.214.183 on the Unified Layer network in the US. The Let's Encrypt certificate gives the page a padlock, which proves nothing about who runs it. What to do If you entered a password on this site, change it at once on the real service and on every other account that uses the same password. Enable or reset two-factor authentication, and sign out of all active sessions. Check your email forwarding rules and recovery addresses for changes you did not make, and watch for password-reset messages you did not request. Defenders should block pffb.org.pk and its IP at the proxy and DNS layers. Search mail and web logs for users who visited it, and force credential resets for anyone who submitted a form. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a0abaa-c9e0-7243-ba8a-07da7db16bb9/ VirusTotal report: https://www.virustotal.com/gui/domain/pffb.org.pk Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=pffb.org.pk Archived copy: https://web.archive.org/web/20260922053440/https://pffb.org.pk/ Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-19 09:41:26 UTC ## Stored page captures - Primary capture: https://i.ibb.co/SqGgcFJ/1e3ca9510200.png Captured: 2026-09-16 19:21:51 UTC - URLScan capture 1: https://screenshots.phishdestroy.io/01a0abaa-c9e0-7243-ba8a-07da7db16bb9.png Captured: 2026-09-16 19:21:51 UTC Source report: https://urlscan.io/result/01a0abaa-c9e0-7243-ba8a-07da7db16bb9/ - URLScan capture 2: https://urlscan.io/screenshots/019db902-6699-741d-bed1-510a587d0032.png Captured: 2026-09-16 19:01:03 UTC Source report: https://urlscan.io/result/01a0abaa-c9e0-7243-ba8a-07da7db16bb9/ - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/b2c98e6c-2199-4930-93b4-e736826d4d0f.png Captured: 2026-09-16 19:06:27 UTC Source report: https://radar.cloudflare.com/scan/b2c98e6c-2199-4930-93b4-e736826d4d0f SHA-256: c1e8d7daa4ca4d99913e373121b1f9e6e3d2c098edc79265f8fb78614b9234c3 - URLScan · 2026-09-16: https://screenshots.phishdestroy.io/us/01a0aba0-75de-73a1-8b23-5b4a443ab3d5.png Captured: 2026-09-16 19:10:30 UTC Source report: https://urlscan.io/result/01a0aba0-75de-73a1-8b23-5b4a443ab3d5/ SHA-256: e59155cc0ef0767db3b30037bf5b19334de08ef75fbaab8dae40bc40e87da56f - URLScan · 2026-09-16: https://screenshots.phishdestroy.io/us/01a0aba0-a5bc-728c-8b38-98e145d46cb5.png Captured: 2026-09-16 19:10:40 UTC Source report: https://urlscan.io/result/01a0aba0-a5bc-728c-8b38-98e145d46cb5/ SHA-256: 22616397ba9a59f0cb30d490e6990566f189888a4f986ee06169d78643f79ab0 - URLScan · 2026-10-07: https://screenshots.phishdestroy.io/us/01a113fd-4354-75df-95f7-268fc26d93b7.png Captured: 2026-10-07 01:32:14 UTC Source report: https://urlscan.io/result/01a113fd-4354-75df-95f7-268fc26d93b7/ SHA-256: f5670e58893a12aa040d19a5c5bfdde33f0f450b95ae02803e9a7cf78dea9358 ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-20T23:46:52Z", "uuid": "01a0abaa-c9e0-7243-ba8a-07da7db16bb9", "scanned_at": "2026-09-16T19:21:44Z", "final_url": "https://pffb.org.pk/", "status": 200, "redirected": "https-only", "redirects": [ { "to": "https://pffb.org.pk/", "from": "http://pffb.org.pk/", "status": 307 } ], "ip": "207.174.214.183", "ptr": "207-174-214-183.unifiedlayer.com", "domains": [ "www.youtube.com", "fonts.gstatic.com", "jnn-pa.googleapis.com", "googleads.g.doubleclick.net", "fonts.googleapis.com", "i.ytimg.com", "www.google.com", "static.doubleclick.net" ], "ips": [ "142.251.179.119", "172.217.114.4", "142.251.156.119", "142.251.211.198", "142.250.191.2", "142.251.41.163", "142.251.211.195", "142.251.153.4", "142.251.111.95", "207.174.214.183" ], "asns": [ "15169", "46606" ], "countries": [ "US" ], "link_domains": [ "119.159.148.21", "drive.google.com", "www.facebook.com", "twitter.com", "www.youtube.com" ], "social": [ "https://www.facebook.com/Pakistan-Foundation-Fighting-Blindness-141560055948554", "https://twitter.com/PFFB_Pakistan", "https://www.youtube.com/@PFFBPakistan" ], "doc_hash": "824be1ef505607abad807ff1c09d4135aa6ed826ef83ffd66d99480517b36bac", "script_hashes": [ "d2da9c717c6544d3681599d64e4d2d7a015b92abd6159f086b6c36df8d82d56d", "1173d03638907a65149085a48bfc683cc7d330a2d3ab118b26d134c49ed1d053", "7f6b8f36384e4736d41d2049b1fb1a99f7f326365c03ccaf76dfa47d5ec65bb9", "11f4b1c5b48fa0100ba180a2e7ffc3296a59ecd4b210351bb452130979c8582c", "cb6f2d32c49d1c2b25e9ffc9aaafa3f83075346c01bcd4ae6eb187392a4292cf", "6f35273b8502706ee06854d797337ab40bc1b3a7421960a2ceb5392ac85a0f54", "01ec2e58020a9aeaa826379966b6d7652efaace7ab433553e8992d8f4cd1d927", "28209c3ee7daade032898ba4241760f9a192ceeb5af5befac6f6fca15651b173", "a931e5af561b1f0efaf6cdb96aeac4c035c30756dd6edd1091da1a68747d35bc", "70c3d690bdc5ce3b9a1527c46044989a3176e610882fa99f4523e75bc395bcce" ], "globals": [ "_N2", "jQuery", "___FONT_AWESOME___", "fontawesome-free-shims", "fluentformElementor", "_gsScope", "_gsQueue", "GreenSockGlobals", "com", "_gsDefine", "Ease", "Power4", "Strong", "Quint", "Power3", "Quart", "Power2", "Cubic", "Power1", "Quad", "Power0", "Linear", "TweenLite", "TweenPlugin", "TweenMax", "TimelineLite", "TimelineMax", "BezierPlugin", "CSSPlugin", "BackOut", "BackIn", "BackInOut", "Back", "SlowMo", "SteppedEase", "RoughEase", "BounceOut", "BounceIn", "BounceInOut", "Bounce" ], "cookies": [ "__Secure-YNID", "YSC", "VISITOR_INFO1_LIVE", "VISITOR_PRIVACY_METADATA", "__Secure-ROLLOUT_TOKEN" ], "storage_keys": [ "wpEmojiSettingsSupports" ], "tls": { "san": [ "*.pffb.org.pk", "pffb.org.pk" ], "cipher": "AES_256_GCM", "issuer": "YR2", "subject": "pffb.org.pk", "protocol": "TLS 1.3", "valid_to": "2026-12-08T05:55:05Z", "valid_from": "2026-09-09T05:55:06Z" }, "domain_age_days": 2776, "apex_age_days": 2776, "tls_age_days": 7, "tls_valid_days": 89, "requests": 152, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": -20, "malicious": false }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "Apache", "content-type": "text/html; charset=UTF-8", "permissions-policy": "private-state-token-redemption=(self \"https://www.google.com\" \"https://www.gstatic.com\" \"https://recaptcha.net\" \"https://challenges.cloudflare.com\" \"https://hcaptcha.com\"), private-state-token-issuanc" } }, "cf": { "v": 1, "fetched_at": "2026-10-21T00:22:13Z", "uuid": "b2c98e6c-2199-4930-93b4-e736826d4d0f", "scanned_at": "2026-09-16T19:06:27Z", "final_url": "https://pffb.org.pk/", "status": 200, "history": [ { "url": "https://pffb.org.pk/", "status": 200 } ], "dom_hash": "a1c35efa54c9bc15a77eea7228bc5e518233c60924279e04d91519f351c67aec", "doc_hash": "824be1ef505607abad807ff1c09d4135aa6ed826ef83ffd66d99480517b36bac", "domain_risks": [ "Charity and Non-profit", "Government & Politics" ], "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "pffb.org.pk", "type": "A", "value": "207.174.214.183" } ], "dnssec_valid": false, "ip": "207.174.214.183", "whois": { "created": "1999-07-28T00:00:00Z", "expires": "2027-07-28T00:00:00Z", "nameservers": [ "ns7.prachost.com", "ns8.prachost.com" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-22T07:39:44Z", "analysis_at": "2026-10-14T08:49:13Z", "stats": { "timeout": 0, "harmless": 44, "malicious": 13, "suspicious": 2, "undetected": 33 }, "detections": { "CRDF": "malicious", "VIPRE": "phishing", "G-Data": "phishing", "Sophos": "phishing", "Webroot": "malicious", "SOCRadar": "phishing", "LevelBlue": "phishing", "Seclookup": "malicious", "Gridinsoft": "suspicious", "BitDefender": "phishing", "Chong Lua Dao": "malicious", "desenmascara.me": "malicious", "alphaMountain.ai": "phishing", "AILabs (MONITORAPP)": "suspicious", "Forcepoint ThreatSeeker": "phishing" }, "reputation": 0, "popularity": { "Alexa": 390661, "Statvoo": 390661, "Majestic": 737149, "Cisco Umbrella": 974978 }, "created": "1999-07-28T00:00:00Z", "first_seen": "2023-10-30T01:55:04Z", "dns": [ { "ttl": 14400, "type": "TXT", "value": "v=spf1 a mx include:websitewelcome.com ~all" }, { "ttl": 14400, "type": "MX", "value": "mail.pffb.org.pk", "priority": 0 }, { "ttl": 21600, "type": "SOA", "rname": "admln.prachost.com", "value": "ns7.prachost.com" }, { "ttl": 14400, "type": "A", "value": "207.174.214.183" }, { "ttl": 21600, "type": "NS", "value": "ns8.prachost.com" }, { "ttl": 21600, "type": "NS", "value": "ns7.prachost.com" } ], "dns_at": "2026-10-14T08:49:33Z", "jarm": "29d29d15d29d29d00042d42d000000cd600c085f371f8533aaf66051f8e5b1", "cert": { "san": [ "*.pffb.org.pk", "pffb.org.pk" ], "issuer": "Let's Encrypt / YR2", "serial": "64b45474dd15c1ddfcc866922546f24aeb7", "sha256": "b4a6c53e2e2a7c18518832ff97711caa5d6369058282c2ac463e191ed1634022", "subject": "pffb.org.pk", "valid_to": "2026-12-08T05:55:05Z", "valid_from": "2026-09-09T05:55:06Z" }, "whois": { "created": "1999-07-28T00:00:00Z", "nameservers": [ "ns7.prachost.com", "ns8.prachost.com" ] } } } ```