# PhishDestroy domain threat record: validar-microsffgcuenta2026ppf.zya.me

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/validar-microsffgcuenta2026ppf.zya.me/
Machine-readable companion: https://phishdestroy.io/domain/validar-microsffgcuenta2026ppf.zya.me/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: unknown
- First observed by PhishDestroy: 2026-10-25 04:31:37 UTC
- Stored record updated: 2026-10-25 06:02:46 UTC
- VirusTotal detections in the stored snapshot: 5/92
- Independent public blocklist matches in the stored snapshot: 1
- Matching public blocklists: OpenPhish
- Google Safe Browsing stored result: no stored flag

## Stored infrastructure

- Observed IP address: 185.27.134.57
- Registrar in stored WHOIS data: Porkbun LLC
- Last stored HTTP status: 200
- Registration date (registry RDAP, zya.me): 2021-09-01 17:30:39 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a16e20-2bb5-75fd-98a0-6cfe43f92f72/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/validar-microsffgcuenta2026ppf.zya.me
- Certificate Transparency search: https://crt.sh/?q=%25.validar-microsffgcuenta2026ppf.zya.me
- Web Archive lookup: https://web.archive.org/web/*/https://validar-microsffgcuenta2026ppf.zya.me/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
PhishDestroy listed validar-microsffgcuenta2026ppf.zya.me as a suspicious domain after detecting several malicious indicators. The recorded page title reads “Domain Suspended”. The domain was first seen by PhishDestroy on 2026-10-25 and the intake reason cited three malicious VirusTotal vendors. A HTTP 200 response was observed on the same date.

How the scam works
No specific malicious payload was observed on the page, but the combined detections align with typical phishing patterns that present seemingly legitimate services to lure credential entry. Without concrete evidence of credential collection, the risk remains limited to potential credential harvesting if a visitor trusts the page.

Evidence
VirusTotal (2026-10-25) reported five detections, three malicious (Kaspersky, LevelBlue, PrecisionSec) and two suspicious (DNS8, SOCRadar). urlscan.io captured the site on 2026-10-24 (retrieved 2026-10-25) and returned a malicious verdict with a 100 score, labeling it as phishing and linking it to Microsoft. Google Safe Browsing on 2026-10-25 did not flag the domain, while OpenPhish and PhishDestroy’s internal blocklist both listed it. OTX recorded zero pulses as of 2026-10-25.

Infrastructure
The recorded IP was 185.27.134.57, which the intake noted as belonging to the UK‑IFASTNET network in Great Britain. The TLS certificate, observed on 2026-10-25, was issued by ZeroSSL for zya.me and its subdomains, valid from 2026-09-03 to 2026-12-02, and the subdomain age was recorded as 0 days while the apex domain was 1955 days old.

What to do
Visitors should avoid entering any credentials or personal information on this page; if they have already done so, they should change passwords for the affected accounts immediately. Defenders should block the exact hostname validar-microsffgcuenta2026ppf.zya.me, add it to internal blocklists, and review access logs for any traffic to its recorded IP address.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a16e20-2bb5-75fd-98a0-6cfe43f92f72/
Cloudflare Radar report: https://radar.cloudflare.com/scan/d2c88b80-8389-4eb6-ac7e-96708ddda233
Stored capture screenshot: https://urlscan.io/screenshots/01a16e20-2bb5-75fd-98a0-6cfe43f92f72.png
Cloudflare Radar screenshot (2026-10-25T04:38:07Z): https://screenshots.phishdestroy.io/cf/d2c88b80-8389-4eb6-ac7e-96708ddda233.png
URLScan screenshot (2026-10-23T19:09:08Z): https://screenshots.phishdestroy.io/us/01a16a2a-a694-703e-a3fa-6705b7c543e3.png
URLScan capture report: https://urlscan.io/result/01a16a2a-a694-703e-a3fa-6705b7c543e3/
URLScan screenshot (2026-10-25T01:01:55Z): https://screenshots.phishdestroy.io/us/01a17093-fe34-76ca-aed3-5b8947a2be30.png
URLScan capture report: https://urlscan.io/result/01a17093-fe34-76ca-aed3-5b8947a2be30/
URLScan screenshot (2026-10-25T04:31:28Z): https://screenshots.phishdestroy.io/us/01a17153-8e9d-76ee-a62a-1fa28a6f34ff.png
URLScan capture report: https://urlscan.io/result/01a17153-8e9d-76ee-a62a-1fa28a6f34ff/
VirusTotal report: https://www.virustotal.com/gui/domain/validar-microsffgcuenta2026ppf.zya.me
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=validar-microsffgcuenta2026ppf.zya.me
Archived copy: https://web.archive.org/web/20261025043309/https://validar-microsffgcuenta2026ppf.zya.me/
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-25 05:59:51 UTC

## Stored page captures

- Primary capture: https://urlscan.io/screenshots/01a16e20-2bb5-75fd-98a0-6cfe43f92f72.png
  Captured: 2026-10-25 04:31:37 UTC
- URLScan capture: https://screenshots.phishdestroy.io/01a16e20-2bb5-75fd-98a0-6cfe43f92f72.png
  Source report: https://urlscan.io/result/01a16e20-2bb5-75fd-98a0-6cfe43f92f72/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/d2c88b80-8389-4eb6-ac7e-96708ddda233.png
  Captured: 2026-10-25 04:38:07 UTC
  Source report: https://radar.cloudflare.com/scan/d2c88b80-8389-4eb6-ac7e-96708ddda233
  SHA-256: fcfd11b814635c05c5467f81902cda2f884c8c29686dc1d75c7486da0b45b06e
- URLScan · 2026-10-23: https://screenshots.phishdestroy.io/us/01a16a2a-a694-703e-a3fa-6705b7c543e3.png
  Captured: 2026-10-23 19:09:08 UTC
  Source report: https://urlscan.io/result/01a16a2a-a694-703e-a3fa-6705b7c543e3/
  SHA-256: 6be4a16819868d99bf0b4393ecf6be398939ff19301cf4c642870bebf68045e6
- URLScan · 2026-10-25: https://screenshots.phishdestroy.io/us/01a17093-fe34-76ca-aed3-5b8947a2be30.png
  Captured: 2026-10-25 01:01:55 UTC
  Source report: https://urlscan.io/result/01a17093-fe34-76ca-aed3-5b8947a2be30/
  SHA-256: c78f83fa41a3b7fd9209cd288316b5ecd6065957896a4526ef405eae76eda771
- URLScan · 2026-10-25: https://screenshots.phishdestroy.io/us/01a17153-8e9d-76ee-a62a-1fa28a6f34ff.png
  Captured: 2026-10-25 04:31:28 UTC
  Source report: https://urlscan.io/result/01a17153-8e9d-76ee-a62a-1fa28a6f34ff/
  SHA-256: 9c803c8fe7c20c22bea335269f392763220dee30b232194d5ebadf1fd9a63fc7

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-25T04:41:42Z",
        "uuid": "01a16e20-2bb5-75fd-98a0-6cfe43f92f72",
        "scanned_at": "2026-10-24T13:36:10Z",
        "final_url": "https://validar-microsffgcuenta2026ppf.zya.me/index.html",
        "status": 200,
        "redirected": "same-domain",
        "redirects": [
            {
                "to": "https://validar-microsffgcuenta2026ppf.zya.me/carga.html",
                "from": "http://validar-microsffgcuenta2026ppf.zya.me/carga.html",
                "status": 307
            },
            {
                "to": "https://validar-microsffgcuenta2026ppf.zya.me/carga.html",
                "from": "https://validar-microsffgcuenta2026ppf.zya.me/carga.html"
            },
            {
                "to": "https://validar-microsffgcuenta2026ppf.zya.me/index.html",
                "from": "https://validar-microsffgcuenta2026ppf.zya.me/carga.html"
            }
        ],
        "ip": "185.27.134.57",
        "domains": [
            "aadcdn.msftauth.net",
            "www.gstatic.com",
            "cdn.dribbble.com"
        ],
        "ips": [
            "23.207.210.136",
            "142.251.153.120",
            "185.27.134.57"
        ],
        "asns": [
            "20940",
            "15169",
            "34119"
        ],
        "countries": [
            "DE",
            "US",
            "GB"
        ],
        "doc_hash": "bd32b45c75266dc2600fbd306e93888beeb59485f125b4c42f53af96c2327df5",
        "script_hashes": [
            "5069425b121346b36f730910d05402d50920fc2178b01e0c878b71af4ef1eb96",
            "b399514b7f7b271d321bc854a36e2c382f257c1a57f2fe3299fdb6d163a4ede1"
        ],
        "globals": [
            "firebase"
        ],
        "cookies": [
            "__test"
        ],
        "storage_keys": [
            "firebase:sentinel"
        ],
        "tls": {
            "san": [
                "zya.me",
                "*.zya.me"
            ],
            "cipher": "AES_256_GCM",
            "issuer": "ZeroSSL ECC DV SSL CA 2",
            "subject": "zya.me",
            "protocol": "TLS 1.3",
            "valid_to": "2026-12-02T23:59:59Z",
            "valid_from": "2026-09-03T00:00:00Z"
        },
        "domain_age_days": 0,
        "apex_age_days": 1955,
        "tls_age_days": 51,
        "tls_valid_days": 90,
        "requests": 21,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 99,
                "malicious": true
            },
            "overall": {
                "tags": [
                    "phishing"
                ],
                "score": 100,
                "brands": [
                    "microsoft"
                ],
                "malicious": true,
                "categories": [
                    "phishing"
                ]
            },
            "urlscan": {
                "tags": [
                    "phishing"
                ],
                "score": 100,
                "brands": [
                    "Microsoft"
                ],
                "malicious": true,
                "categories": [
                    "phishing"
                ]
            }
        },
        "headers": {
            "server": "openresty",
            "content-type": "text/html"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-25T04:41:45Z",
        "uuid": "d2c88b80-8389-4eb6-ac7e-96708ddda233",
        "scanned_at": "2026-10-25T04:38:07Z",
        "final_url": "https://suspended-domain.net/",
        "status": 200,
        "history": [
            {
                "url": "https://validar-microsffgcuenta2026ppf.zya.me/",
                "status": 200
            },
            {
                "url": "https://validar-microsffgcuenta2026ppf.zya.me/",
                "status": 302
            },
            {
                "url": "https://suspended-domain.net/",
                "status": 200
            }
        ],
        "dom_hash": "eae865679efe4fa175540ef67670fb43814608ede94779902ccee4b3b9b9a4da",
        "doc_hash": "1e15e8db4475472836e2be3a7c49fb759c5982440e4f01dc526acbb60c2d75f4",
        "phishing_v2": [
            "phishing"
        ],
        "domain_risks": [
            "Information Technology",
            "Technology"
        ],
        "radar_rank": {
            "bucket": "200000"
        },
        "dns": [
            {
                "name": "suspended-domain.net",
                "type": "A",
                "value": "77.72.1.44"
            }
        ],
        "dnssec_valid": false,
        "ip": "77.72.1.44",
        "whois": {
            "registrar": "PDR Ltd. d/b/a PublicDomainRegistry.com",
            "created": "2025-06-04T13:44:49Z",
            "updated": "2026-06-09T09:25:13Z",
            "expires": "2028-06-04T13:44:49Z",
            "nameservers": [
                "johnathan.ns.cloudflare.com",
                "mckenzie.ns.cloudflare.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-25T05:54:09Z",
        "analysis_at": "2026-10-25T04:16:40Z",
        "stats": {
            "timeout": 0,
            "harmless": 52,
            "malicious": 3,
            "suspicious": 2,
            "undetected": 35
        },
        "detections": {
            "DNS8": "suspicious",
            "SOCRadar": "suspicious",
            "Kaspersky": "phishing",
            "LevelBlue": "phishing",
            "PrecisionSec": "malicious"
        },
        "reputation": 0,
        "tags": [
            "dga"
        ],
        "registrar": "Porkbun LLC",
        "created": "2021-09-01T17:30:39Z",
        "expires": "2027-09-01T17:30:39Z",
        "updated": "2026-09-03T11:02:27Z",
        "first_seen": "2026-10-23T20:07:28Z",
        "dns": [
            {
                "ttl": 3600,
                "type": "CAA",
                "value": "amazontrust.com"
            },
            {
                "ttl": 3600,
                "type": "CAA",
                "value": "godaddy.com"
            },
            {
                "ttl": 3600,
                "type": "CAA",
                "value": "trust-provider.com"
            },
            {
                "ttl": 3600,
                "type": "CAA",
                "value": "buypass.com"
            },
            {
                "ttl": 3600,
                "type": "CAA",
                "value": "digicert.com"
            },
            {
                "ttl": 3600,
                "type": "CAA",
                "value": "letsencrypt.org"
            },
            {
                "ttl": 3600,
                "type": "CAA",
                "value": "microsoft.com"
            },
            {
                "ttl": 3600,
                "type": "CAA",
                "value": "identrust.com"
            },
            {
                "ttl": 3600,
                "type": "CAA",
                "value": "sectigo.com"
            },
            {
                "ttl": 3600,
                "type": "CAA",
                "value": "amazon.com"
            },
            {
                "ttl": 3600,
                "type": "CAA",
                "value": "certum.pl"
            },
            {
                "ttl": 3600,
                "type": "CAA",
                "value": "comodoca.com"
            },
            {
                "ttl": 3600,
                "type": "CAA",
                "value": "pki.goog"
            },
            {
                "ttl": 3600,
                "type": "CAA",
                "value": "entrust.net"
            },
            {
                "ttl": 3600,
                "type": "CAA",
                "value": "ssl.com"
            },
            {
                "ttl": 3600,
                "type": "CAA",
                "value": "starfieldtech.com"
            },
            {
                "ttl": 3600,
                "type": "CAA",
                "value": "usertrust.com"
            },
            {
                "ttl": 21600,
                "type": "A",
                "value": "185.27.134.57"
            },
            {
                "ttl": 3600,
                "type": "CAA",
                "value": "swisssign.com"
            },
            {
                "ttl": 3600,
                "type": "CAA",
                "value": "harica.gr"
            },
            {
                "ttl": 3600,
                "type": "CAA",
                "value": "globalsign.com"
            }
        ],
        "dns_at": "2026-10-25T04:22:06Z",
        "jarm": "27d27d27d00027d00042d42d000000831b6af40378e2dd35eeac4e9311926e",
        "cert": {
            "san": [
                "zya.me",
                "*.zya.me"
            ],
            "issuer": "ZeroSSL GmbH / ZeroSSL ECC DV SSL CA 2",
            "serial": "7cbb246f5a093e39be1f61617a753e0c",
            "sha256": "5fae0ab31e9fe6a73d08c765ab85c1cace96a697398680c9c06517f73b6a0d9c",
            "subject": "zya.me",
            "valid_to": "2026-12-02T23:59:59Z",
            "valid_from": "2026-09-03T00:00:00Z"
        },
        "whois": {
            "registrar": "Porkbun LLC",
            "registrar_iana_id": "1861",
            "registrar_url": "http://porkbun.com",
            "created": "2021-09-01T17:30:39Z",
            "updated": "2026-09-03T11:02:27Z",
            "expires": "2027-09-01T17:30:39Z",
            "status": [
                "clientDeleteProhibited",
                "clientTransferProhibited"
            ],
            "nameservers": [
                "ns1.byet.org",
                "ns2.byet.org",
                "ns3.byet.org",
                "ns4.byet.org",
                "ns5.byet.org"
            ],
            "dnssec": "unsigned"
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-25T04:41:58Z",
        "caa_records": {
            "count": 20,
            "domain": "validar-microsffgcuenta2026ppf.zya.me",
            "issuers": [
                "trust-provider.com",
                "globalsign.com",
                "identrust.com",
                "entrust.net",
                "amazon.com",
                "sectigo.com",
                "starfieldtech.com",
                "digicert.com",
                "usertrust.com",
                "ssl.com"
            ]
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_count": 0
        },
        "archives": {
            "last": "2026-10-25T04:33:09Z",
            "first": "2026-10-25T04:33:09Z",
            "changes": 0,
            "days_archived": 1,
            "avg_page_bytes": 1237
        },
        "mixed_content": {
            "third_party_scripts": 0
        },
        "status": {
            "up": true,
            "code": 200,
            "timings": {
                "dns": 15,
                "tls": 37,
                "wait": 34,
                "connect": 35,
                "download": 0
            },
            "response_ms": 121
        },
        "tls_connection": {
            "alpn": "http/1.1",
            "cipher": "TLS_AES_256_GCM_SHA384",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                80,
                443
            ]
        },
        "carbon": {
            "bytes": 864,
            "co2_grams": 0,
            "cleaner_than": 95
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "198.251.86.154",
                    "host": "ns3.byet.org"
                },
                {
                    "ip": "198.251.86.153",
                    "host": "ns2.zya.me"
                },
                {
                    "ip": "198.251.86.153",
                    "host": "ns2.byet.org"
                },
                {
                    "ip": "198.251.86.152",
                    "host": "ns5.byet.org"
                },
                {
                    "ip": "198.251.86.153",
                    "host": "ns4.byet.org"
                },
                {
                    "ip": "198.251.90.216",
                    "host": "ns1.byet.org"
                },
                {
                    "ip": "198.251.90.216",
                    "host": "ns1.zya.me"
                }
            ],
            "zone": "zya.me"
        },
        "cookies": {
            "cookies": [
                {
                    "name": "__test"
                }
            ]
        },
        "location": {
            "ip": "185.27.134.57",
            "asn": "34119",
            "org": "UK-IFASTNET",
            "city": "Gosforth",
            "country": "GB"
        },
        "ssl": {
            "issuer": "ZeroSSL GmbH / ZeroSSL ECC DV SSL CA 2",
            "subject": "zya.me"
        },
        "dns": {
            "A": [
                "185.27.134.57"
            ]
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "hsts": {
            "message": "Site does not serve any HSTS headers."
        },
        "http_security": {
            "xFrameOptions": false,
            "referrerPolicy": false,
            "xXSSProtection": false,
            "permissionsPolicy": false,
            "xContentTypeOptions": false,
            "contentSecurityPolicy": false,
            "strictTransportPolicy": false,
            "crossOriginOpenerPolicy": false,
            "crossOriginEmbedderPolicy": false,
            "crossOriginResourcePolicy": false
        },
        "get_ip": {
            "ip": "185.27.134.57",
            "family": 4
        },
        "redirects": {
            "chain": [
                "https://validar-microsffgcuenta2026ppf.zya.me"
            ]
        },
        "whois": {
            "registrar": "Porkbun LLC",
            "created": "2021-09-01T17:30:39Z",
            "updated": "2026-09-03T11:02:27Z",
            "expires": "2027-09-01T17:30:39Z",
            "status": [
                "clientDeleteProhibited https://icann.org/epp",
                "clientTransferProhibited https://icann.org/epp"
            ],
            "nameservers": [
                "ns1.byet.org",
                "ns2.byet.org",
                "ns3.byet.org",
                "ns4.byet.org",
                "ns5.byet.org"
            ]
        },
        "headers": {
            "headers": {
                "server": "openresty",
                "content-type": "text/html"
            }
        }
    }
}
```