# PhishDestroy domain threat record: tz.com.pk

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/tz.com.pk/
Machine-readable companion: https://phishdestroy.io/domain/tz.com.pk/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-09-17 13:29:56 UTC
- Last availability or vendor check: 2026-10-22 10:30:58 UTC
- Stored record updated: 2026-10-22 16:07:29 UTC
- VirusTotal detections in the stored snapshot: 11/91
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored infrastructure

- Observed IP address: 135.181.212.206
- Registrar in stored WHOIS data: REGISTRAR_NOT_FOUND
- Registrar country in stored WHOIS data: Unknown
- Last stored HTTP status: 200
- Registration date in stored WHOIS data: 2024-07-25 22:00:00 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a0af95-77bf-762f-96ba-b5be571a7ec1/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/tz.com.pk
- Certificate Transparency search: https://crt.sh/?q=%25.tz.com.pk
- Web Archive lookup: https://web.archive.org/web/*/https://tz.com.pk/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
tz.com.pk hosts an impersonation phishing page titled "Email Update" that poses as a routine notice from an email provider. It does not copy one specific brand. It uses a generic mailbox look so it can target almost anyone with an email account, including employees on corporate mail. PhishDestroy first flagged it on 2026-09-17, and on 2026-10-19 the site was still online and serving its phishing content.

How the scam works
Victims usually arrive through an email or message claiming their account needs updating, verifying or re-activating, or it will be suspended. The link leads to the "Email Update" page, which asks for the email address and password, and sometimes more. Whatever is typed goes straight to the operators. A stolen mailbox is valuable because it can reset passwords on other services, including exchanges and wallets tied to that address. It also lets the attackers send convincing phishing to the victim's contacts.

Evidence
On 2026-09-29, 11 of 91 VirusTotal engines flagged the domain. Named vendors include alphaMountain.ai, Chong Lua Dao, Forcepoint ThreatSeeker, Fortinet, Gridinsoft, Lionic, SOCRadar and Sophos. That is a minority of engines, but it is a mix of independent reputation and threat-intel feeds reaching the same conclusion. urlscan.io returned a malicious verdict and recognized the page as a generic email login lure. The domain also appears in five AlienVault OTX threat pulses, and it is listed on the PhishDestroy blocklist.

Infrastructure
The domain was registered on 2024-07-26, more than two years before PhishDestroy detected the phishing page. This is a long gap for a phishing domain and may point to an aged or repurposed name rather than one registered just for this campaign. The site runs on Hetzner Online GmbH infrastructure in Finland, a long way from the Pakistani country-code domain it uses.

What to do
If you entered your email password on this page, change it right away from the provider's real website or app. Then change it on every other account that shared that password. Turn on two-factor authentication. Sign out of all active sessions, and check for forwarding rules, recovery addresses or filters you did not create. Next, review exchange, wallet and banking accounts linked to that mailbox for password-reset emails or logins you don't recognize. Defenders should block tz.com.pk at mail gateways, proxies and DNS. They should also search mail logs for messages linking to it and warn users about "email update" or account-verification lures.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a0af95-77bf-762f-96ba-b5be571a7ec1/
VirusTotal report: https://www.virustotal.com/gui/domain/tz.com.pk
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=tz.com.pk
Archived copy: https://web.archive.org/web/20260922054412/https://tz.com.pk/
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 09:40:46 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/vxyJrSRP/0dbbe4014367.png
  Captured: 2026-09-17 13:37:33 UTC
- URLScan capture 1: https://screenshots.phishdestroy.io/01a0af95-77bf-762f-96ba-b5be571a7ec1.png
  Captured: 2026-09-17 13:37:33 UTC
  Source report: https://urlscan.io/result/01a0af95-77bf-762f-96ba-b5be571a7ec1/
- URLScan capture 2: https://urlscan.io/screenshots/01a0af74-5854-74cb-921a-8c8cd8678e9d.png
  Captured: 2026-09-17 13:29:56 UTC
  Source report: https://urlscan.io/result/01a0af95-77bf-762f-96ba-b5be571a7ec1/
- URLQuery: https://screenshots.phishdestroy.io/uq/eb687820-66ca-4909-8c43-05d15de7c514.png
  Captured: 2026-09-17 13:41:23 UTC
  Source report: https://urlquery.net/report/eb687820-66ca-4909-8c43-05d15de7c514
  SHA-256: 0aaeca89d75aa1b05790e0f7a8940db39febd1754c2ac82c24aed5a566e99f52
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/158ae001-ca28-46c6-9be9-a33567465c56.png
  Captured: 2026-09-17 13:34:57 UTC
  Source report: https://radar.cloudflare.com/scan/158ae001-ca28-46c6-9be9-a33567465c56
  SHA-256: b3c8cada5643777847e2706d66c1ff878c8d7b8eb7332d2f31655a84988f336e
- URLScan · 2026-08-15: https://screenshots.phishdestroy.io/us/01a004ac-8fd4-72dc-9180-fbb1b8d39f85.png
  Captured: 2026-08-15 09:06:59 UTC
  Source report: https://urlscan.io/result/01a004ac-8fd4-72dc-9180-fbb1b8d39f85/
  SHA-256: 80adf9d56117baac504d71ff0178758fbd6b847231fce8873b0b73c8f7b1c59b
- URLScan · 2026-08-27: https://screenshots.phishdestroy.io/us/01a04551-c6e4-772b-8c9a-64cc8646eb42.png
  Captured: 2026-08-27 22:23:09 UTC
  Source report: https://urlscan.io/result/01a04551-c6e4-772b-8c9a-64cc8646eb42/
  SHA-256: 80adf9d56117baac504d71ff0178758fbd6b847231fce8873b0b73c8f7b1c59b
- URLScan · 2026-09-17: https://screenshots.phishdestroy.io/us/01a0af90-b054-71e8-9af2-25c6c59e3112.png
  Captured: 2026-09-17 13:31:36 UTC
  Source report: https://urlscan.io/result/01a0af90-b054-71e8-9af2-25c6c59e3112/
  SHA-256: e2383c2a62c0229b1b99044dd29c2a9c57a78070d2463190024128d3cf286666
- URLScan · 2026-09-17: https://screenshots.phishdestroy.io/us/01a0af98-ffb9-7118-bb50-7b635d04dfb5.png
  Captured: 2026-09-17 13:40:43 UTC
  Source report: https://urlscan.io/result/01a0af98-ffb9-7118-bb50-7b635d04dfb5/
  SHA-256: 80adf9d56117baac504d71ff0178758fbd6b847231fce8873b0b73c8f7b1c59b
- URLScan · 2026-09-23: https://screenshots.phishdestroy.io/us/01a0cee5-f846-709c-aff9-03718bfaf352.png
  Captured: 2026-09-23 15:33:04 UTC
  Source report: https://urlscan.io/result/01a0cee5-f846-709c-aff9-03718bfaf352/
  SHA-256: 8dba1727b04bf7f4707142763d8c05c5cd36ba980c83c49ff1b202315183101b
- URLScan · 2026-10-18: https://screenshots.phishdestroy.io/us/01a14c86-bba5-73db-97f5-5f5cfbb2ff29.png
  Captured: 2026-10-18 01:01:07 UTC
  Source report: https://urlscan.io/result/01a14c86-bba5-73db-97f5-5f5cfbb2ff29/
  SHA-256: 8dba1727b04bf7f4707142763d8c05c5cd36ba980c83c49ff1b202315183101b

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-20T23:45:31Z",
        "uuid": "01a0af95-77bf-762f-96ba-b5be571a7ec1",
        "scanned_at": "2026-09-17T13:36:48Z",
        "final_url": "https://tz.com.pk/Tran/korea.html",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://tz.com.pk/Tran/korea.html",
                "from": "http://tz.com.pk/Tran/korea.html",
                "status": 307
            }
        ],
        "ip": "135.181.212.206",
        "ptr": "lin140.itlinks.com",
        "ips": [
            "135.181.212.206"
        ],
        "asns": [
            "24940"
        ],
        "countries": [
            "FI"
        ],
        "doc_hash": "854afcf7bf62b1eaed7df12b59e3b287b3a6b568e17303b128f7d7d313057e9e",
        "globals": [
            "sendToTelegram",
            "token",
            "chatId",
            "attemptCount",
            "fragment",
            "email",
            "errorMessage"
        ],
        "tls": {
            "san": [
                "*.tz.com.pk",
                "tz.com.pk"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "YR2",
            "subject": "*.tz.com.pk",
            "protocol": "TLS 1.3",
            "valid_to": "2026-10-26T19:16:11Z",
            "valid_from": "2026-07-28T19:16:12Z"
        },
        "domain_age_days": 2224,
        "apex_age_days": 2224,
        "tls_age_days": 50,
        "tls_valid_days": 89,
        "requests": 2,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 96,
                "malicious": true
            },
            "overall": {
                "tags": [
                    "phishing"
                ],
                "score": 100,
                "brands": [
                    "genericemail"
                ],
                "malicious": true,
                "categories": [
                    "phishing"
                ]
            },
            "urlscan": {
                "tags": [
                    "phishing"
                ],
                "score": 100,
                "brands": [
                    "Generic Email"
                ],
                "malicious": true,
                "categories": [
                    "phishing"
                ]
            }
        },
        "headers": {
            "server": "Apache",
            "content-type": "text/html"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-21T00:21:34Z",
        "uuid": "158ae001-ca28-46c6-9be9-a33567465c56",
        "scanned_at": "2026-09-17T13:34:57Z",
        "final_url": "https://tz.com.pk/",
        "status": 200,
        "history": [
            {
                "url": "https://tz.com.pk/",
                "status": 200
            }
        ],
        "dom_hash": "144681abda7bffc4d11587e88edb5547b911fe62bb8996ce15d9bb1019d63b15",
        "doc_hash": "375860dc665ec4e3001e3343dc8d1e9e162e2528f2f073337058ef6ff098442a",
        "domain_risks": [
            "Information Security",
            "Internet Communication",
            "Shareware/Freeware",
            "Technology"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "tz.com.pk",
                "type": "A",
                "value": "135.181.212.206"
            }
        ],
        "dnssec_valid": false,
        "ip": "135.181.212.206",
        "whois": {
            "created": "2024-07-26T00:00:00Z",
            "expires": "2028-07-26T00:00:00Z",
            "nameservers": [
                "ns88.itlinks.com",
                "ns89.itlinks.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-22T06:19:33Z",
        "analysis_at": "2026-10-21T05:34:32Z",
        "stats": {
            "timeout": 0,
            "harmless": 50,
            "malicious": 7,
            "suspicious": 1,
            "undetected": 34
        },
        "detections": {
            "Lionic": "phishing",
            "Sophos": "phishing",
            "Webroot": "malicious",
            "Fortinet": "phishing",
            "SOCRadar": "phishing",
            "Gridinsoft": "phishing",
            "alphaMountain.ai": "phishing",
            "Forcepoint ThreatSeeker": "suspicious"
        },
        "reputation": 0,
        "categories": {
            "Sophos": "phishing and fraud",
            "Webroot": "Phishing and Other Frauds",
            "alphaMountain.ai": "Phishing (alphaMountain.ai)",
            "Forcepoint ThreatSeeker": "compromised websites. business and economy"
        },
        "popularity": {
            "Alexa": 486192,
            "Statvoo": 486192
        },
        "created": "2024-07-26T00:00:00Z",
        "first_seen": "2024-01-13T22:37:10Z",
        "dns": [
            {
                "ttl": 21600,
                "type": "NS",
                "value": "ns88.itlinks.com"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "ns89.itlinks.com"
            },
            {
                "ttl": 14400,
                "type": "TXT",
                "value": "v=spf1 +a +mx +ip4:135.181.212.219 +ip4:135.181.212.206 ~all"
            },
            {
                "ttl": 100,
                "type": "MX",
                "value": "tz.com.pk",
                "priority": 0
            },
            {
                "ttl": 21600,
                "type": "SOA",
                "rname": "yousaf.itlinks.com",
                "value": "ns88.itlinks.com"
            },
            {
                "ttl": 100,
                "type": "A",
                "value": "135.181.212.206"
            }
        ],
        "dns_at": "2026-10-21T05:34:49Z",
        "jarm": "15d3fd16d29d29d00042d43d0000001ae0802418786940cae38f1d9eed5b9b",
        "cert": {
            "san": [
                "*.tz.com.pk",
                "tz.com.pk"
            ],
            "issuer": "Let's Encrypt / YR1",
            "serial": "51089b489e9ed4c18eb9faaaeedeacc5049",
            "sha256": "18071c849a6a156c9a6a05a0e1f5ea8e8382d69eda4d6fffa12a6a3536e54c27",
            "subject": "tz.com.pk",
            "valid_to": "2026-12-26T22:16:11Z",
            "valid_from": "2026-09-27T22:16:12Z"
        },
        "whois": {
            "created": "2024-07-26T00:00:00Z",
            "nameservers": [
                "ns88.itlinks.com",
                "ns89.itlinks.com"
            ]
        }
    }
}
```