# PhishDestroy domain threat record: unionganadera.com.mx

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/unionganadera.com.mx/
Machine-readable companion: https://phishdestroy.io/domain/unionganadera.com.mx/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-09-23 09:05:22 UTC
- Last availability or vendor check: 2026-10-22 10:33:20 UTC
- Stored record updated: 2026-10-22 16:07:29 UTC
- VirusTotal detections in the stored snapshot: 8/91
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored infrastructure

- Observed IP address: 201.165.252.146
- Registrar in stored WHOIS data: GoDaddy.com
- Registrar country in stored WHOIS data: US
- Last stored HTTP status: 200
- Registration date in stored WHOIS data: 2016-08-16 22:00:00 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a05a1d-614a-734c-857e-75328c350114/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/unionganadera.com.mx
- Certificate Transparency search: https://crt.sh/?q=%25.unionganadera.com.mx
- Web Archive lookup: https://web.archive.org/web/*/https://unionganadera.com.mx/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
unionganadera.com.mx is classified by PhishDestroy as an impersonation phishing page. It sits on a Mexican domain whose name reads like a livestock or ranchers' association, which makes it credible to local users who expect that kind of organisation online. PhishDestroy first flagged it on 2026-09-23, and it was still online and serving content when last checked on 2026-10-19.

How the scam works
Impersonation pages borrow the look and name of an organisation people already trust, then ask visitors to log in, confirm account details or submit personal information. Whatever is typed into those forms goes to the operators, who can reuse the credentials, take over accounts or sell the data. The page currently returns the title "Not Found", while our classification is impersonation phishing.

Evidence
PhishDestroy is the only blocklist carrying the domain so far. Eight of 91 VirusTotal engines flagged it as of 2026-09-25: alphaMountain.ai, CRDF, Gridinsoft, Kaspersky, Lionic, Seclookup, SOCRadar and VIPRE. That is a minority of engines, but it comes from several unrelated vendors, so this is not a single-source call. The domain also appears in three AlienVault OTX threat pulses, which means other researchers have tied it to malicious activity.

Infrastructure
The domain was registered through GoDaddy.com on 2016-08-17, about ten years before PhishDestroy detected it. That makes it a long-lived domain rather than a throwaway registered for one campaign, and its age can help it slip past filters that distrust new domains. It resolves to an address on Mega Cable, S.A. de C.V. in Mexico, which matches its .com.mx identity. Its Starfield domain-validated certificate shows a padlock in the browser, but that only means the connection is encrypted, not that the site is genuine.

What to do
If you entered a username and password here, change that password right away, along with any other account where you reused it. Turn on two-factor authentication for those accounts. If you submitted ID numbers, bank or card details, contact your bank to watch for fraud and stay alert for follow-up calls or messages that use your data to seem convincing. Security teams should block the domain at DNS and web proxies and search mail and proxy logs for users who visited it.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a05a1d-614a-734c-857e-75328c350114/
VirusTotal report: https://www.virustotal.com/gui/domain/unionganadera.com.mx
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=unionganadera.com.mx
Archived copy: https://web.archive.org/web/20260215134956/https://www.unionganadera.com.mx/
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 09:35:48 UTC

## Stored page captures

- Primary capture: https://urlscan.io/screenshots/01a05a1d-614a-734c-857e-75328c350114.png
  Captured: 2026-09-23 09:05:22 UTC
- URLScan capture: https://screenshots.phishdestroy.io/01a05a1d-614a-734c-857e-75328c350114.png
  Captured: 2026-09-25 03:30:19 UTC
  Source report: https://urlscan.io/result/01a05a1d-614a-734c-857e-75328c350114/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/7d76d24e-d984-4edd-a798-a95f40a62a3b.png
  Captured: 2026-09-23 09:15:35 UTC
  Source report: https://radar.cloudflare.com/scan/7d76d24e-d984-4edd-a798-a95f40a62a3b
  SHA-256: e2426c70bb50c85bca2093866ad16cb549da625c472ad9eee57ab5099d4e6a9a
- URLScan · 2026-08-05: https://screenshots.phishdestroy.io/us/019fd04f-fcca-77da-a8fd-63b1644c41d7.png
  Captured: 2026-08-05 05:06:02 UTC
  Source report: https://urlscan.io/result/019fd04f-fcca-77da-a8fd-63b1644c41d7/
  SHA-256: 2f01f83121671454f3aa0bedca20c92e0c0cc5a2065f9f64df63efda8aaf2543
- URLScan · 2026-08-18: https://screenshots.phishdestroy.io/us/01a0153e-1913-745c-b636-cc9b1a3db79a.png
  Captured: 2026-08-18 14:19:55 UTC
  Source report: https://urlscan.io/result/01a0153e-1913-745c-b636-cc9b1a3db79a/
  SHA-256: 9303c8bd4c9fbbd00caa9952336153e0bf1dc9e189649e4ee53ee5c3966e5dd0
- URLScan · 2026-08-18: https://screenshots.phishdestroy.io/us/01a016a5-7f7c-76fc-b694-dde8ec65fbb9.png
  Captured: 2026-08-18 20:52:27 UTC
  Source report: https://urlscan.io/result/01a016a5-7f7c-76fc-b694-dde8ec65fbb9/
  SHA-256: fa01bbb674b5ddd39495bddc5ad0ed31da1f15747dd9ea57abbd2621b1f53a74
- URLScan · 2026-08-19: https://screenshots.phishdestroy.io/us/01a01a07-b1ea-73f9-a30b-1720eea1a22b.png
  Captured: 2026-08-19 12:38:34 UTC
  Source report: https://urlscan.io/result/01a01a07-b1ea-73f9-a30b-1720eea1a22b/
  SHA-256: c5c50d50807fe7a3d2c5d06857e97642d137e19a2a5e8d0dac75a6284cc9c4da
- URLScan · 2026-09-23: https://screenshots.phishdestroy.io/us/01a0cd8e-fb27-76de-9d0d-fb0fafed0b8c.png
  Captured: 2026-09-23 09:18:22 UTC
  Source report: https://urlscan.io/result/01a0cd8e-fb27-76de-9d0d-fb0fafed0b8c/
  SHA-256: fa01bbb674b5ddd39495bddc5ad0ed31da1f15747dd9ea57abbd2621b1f53a74
- URLScan · 2026-09-23: https://screenshots.phishdestroy.io/us/01a0cda9-efeb-7698-97ca-fb4cf4a0943d.png
  Captured: 2026-09-23 09:47:48 UTC
  Source report: https://urlscan.io/result/01a0cda9-efeb-7698-97ca-fb4cf4a0943d/
  SHA-256: fa01bbb674b5ddd39495bddc5ad0ed31da1f15747dd9ea57abbd2621b1f53a74

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-20T21:01:42Z",
        "uuid": "01a05a1d-614a-734c-857e-75328c350114",
        "scanned_at": "2026-08-31T23:17:56Z",
        "final_url": "https://www.unionganadera.com.mx/xpo26/phpbarcode/ert/season/app/ts/PKO/app/user.php",
        "status": 404,
        "ip": "201.165.252.146",
        "ptr": "customer-HMO-MCA-252-146.megared.net.mx",
        "ips": [
            "201.165.252.146"
        ],
        "asns": [
            "262916"
        ],
        "countries": [
            "MX"
        ],
        "doc_hash": "a448fc74cb98437b7f6860fa8e1d7c890c9d3dc3d276bbed00f63e22660cdf77",
        "tls": {
            "san": [
                "unionganadera.com.mx",
                "www.unionganadera.com.mx"
            ],
            "cipher": "AES_256_GCM",
            "issuer": "Starfield TLS Intermediate CA DV - R1v1",
            "subject": "unionganadera.com.mx",
            "protocol": "TLS 1.2",
            "valid_to": "2026-09-13T16:40:53Z",
            "valid_from": "2026-07-16T12:30:21Z"
        },
        "domain_age_days": 2821,
        "apex_age_days": 2821,
        "tls_age_days": 46,
        "tls_valid_days": 59,
        "requests": 2,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": -98,
                "malicious": false
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "Microsoft-IIS/8.5",
            "content-type": "text/html"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-20T21:08:08Z",
        "uuid": "7d76d24e-d984-4edd-a798-a95f40a62a3b",
        "scanned_at": "2026-09-23T09:15:35Z",
        "final_url": "https://unionganadera.com.mx/",
        "status": 404,
        "history": [
            {
                "url": "https://unionganadera.com.mx/",
                "status": 404
            }
        ],
        "dom_hash": "5adff9bf9f25446c47b56d5e8a3c2b674584775956fd0884b0d7c658e4d1436e",
        "doc_hash": "ce7127c38e30e92a021ed2bd09287713c6a923db9ffdb43f126e8965d777fbf0",
        "domain_risks": [
            "Malware",
            "Security threats",
            "CIPA Filter",
            "CIPA"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "unionganadera.com.mx",
                "type": "A",
                "value": "201.165.252.146"
            }
        ],
        "dnssec_valid": false,
        "ip": "201.165.252.146",
        "verdict": {
            "tags": [
                "malware"
            ],
            "malicious": true,
            "categories": [
                "malware"
            ]
        },
        "whois": {
            "registrar": "GoDaddy.com",
            "created": "2016-08-17T00:00:00Z",
            "updated": "2026-08-18T00:00:00Z",
            "expires": "2027-08-17T00:00:00Z",
            "nameservers": [
                "ns45.domaincontrol.com",
                "ns46.domaincontrol.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-21T21:36:51Z",
        "analysis_at": "2026-10-21T18:36:22Z",
        "stats": {
            "timeout": 0,
            "harmless": 48,
            "malicious": 11,
            "suspicious": 2,
            "undetected": 31
        },
        "detections": {
            "CRDF": "malicious",
            "DNS8": "suspicious",
            "VIPRE": "phishing",
            "Lionic": "phishing",
            "Sophos": "phishing",
            "SOCRadar": "phishing",
            "URLQuery": "malicious",
            "Kaspersky": "phishing",
            "LevelBlue": "phishing",
            "Seclookup": "malicious",
            "Gridinsoft": "suspicious",
            "alphaMountain.ai": "phishing",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "popularity": {
            "Alexa": 77829
        },
        "registrar": "GoDaddy.com",
        "first_seen": "2023-10-25T08:42:36Z",
        "dns": [
            {
                "ttl": 700,
                "type": "A",
                "value": "201.165.252.146"
            },
            {
                "ttl": 3600,
                "type": "MX",
                "value": "smtp.secureserver.net",
                "priority": 0
            },
            {
                "ttl": 3600,
                "type": "NS",
                "value": "ns45.domaincontrol.com"
            },
            {
                "ttl": 3600,
                "type": "NS",
                "value": "ns46.domaincontrol.com"
            },
            {
                "ttl": 600,
                "type": "SOA",
                "rname": "dns.jomax.net",
                "value": "ns45.domaincontrol.com"
            },
            {
                "ttl": 3600,
                "type": "MX",
                "value": "mailstore1.secureserver.net",
                "priority": 10
            },
            {
                "ttl": 3600,
                "type": "TXT",
                "value": "v=spf1 include:secureserver.net -all"
            }
        ],
        "dns_at": "2026-10-21T18:36:42Z",
        "jarm": "26d26d16d26d26d22c26d26d26d26dd7fc4c7c6ef19b77a4ca0787979cdc13",
        "cert": {
            "san": [
                "unionganadera.com.mx",
                "www.unionganadera.com.mx"
            ],
            "issuer": "Starfield Technologies / Starfield TLS Intermediate CA DV - R1v1",
            "serial": "b70c59442b8c300d",
            "sha256": "ad45ca9a284e7782dceef9066c81897223386d250f50c8a4a79fb155c1a6a645",
            "subject": "unionganadera.com.mx",
            "valid_to": "2027-03-31T17:45:00Z",
            "valid_from": "2026-09-14T17:45:00Z"
        },
        "whois": {
            "registrar": "GoDaddy.com"
        }
    }
}
```