# vcsservice.eu: Recorded Combell domain-reserved landing page | PhishDestroy

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/vcsservice.eu/
Machine-readable companion: https://phishdestroy.io/domain/vcsservice.eu/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: Unverified
- First observed by PhishDestroy: 2026-11-09 18:25:24 UTC
- Selected availability observation: 2026-11-09T18:25:24Z
- Stored record updated: 2026-11-09 20:02:03 UTC
- VirusTotal detections in the stored snapshot: 17/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: flagged

## Stored infrastructure

- Observed IP address: 217.21.190.139
- Registrar in stored WHOIS data: Combell NV

## Evidence links

- URLScan report: https://urlscan.io/result/01a1c18c-f420-718a-a7ca-9fb1de734b8e/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/vcsservice.eu
- Certificate Transparency search: https://crt.sh/?q=%25.vcsservice.eu
- Web Archive lookup: https://web.archive.org/web/*/https://vcsservice.eu/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Public report package

PhishDestroy records that vcsservice.eu displayed a Combell page stating the domain name is already reserved, with a domain search form and hosting service cards.

On 2026-11-09, vcsservice.eu displayed a page branded with the Combell logo and language options NL, FR and EN. The headline reads "Someone has already reserved this domain name. Smart!" followed by an invitation to check domain availability on combbell.com. A search box labeled "Enter a domain name" sits beside a Check button, with notes about included mailboxes and a money-back guarantee.

Below, a section titled "Get started with your domain name" presents three service cards: Web hosting with 24/7 support, Create a website with SiteBuilder, and Professional mailbox with Microsoft 365. Each card lists features such as one-click CMS installations, template choices, and synchronized agendas and storage.
Package revision: 8c8e4c0f554d0c8924da8e06352fac8356a355ec6ba99e1b8693352acfbc692c
Text generated (not scan time): 2026-11-09 20:00:37
Reviewed evidence snapshot: {"domain":"vcsservice.eu","screenshot_available":true,"capture_contract":"verified-capture-20261102","plain_text_contract":1,"capture_context":{"submitted_host":"vcsservice.eu","final_host":"vcsservice.eu","redirects":[{"to":"https://vcsservice.eu/","from":"http://vcsservice.eu/","status":307},{"to":"http://vcsservice.eu/","from":"https://vcsservice.eu/","status":307}],"captured_at":"2026-11-09T18:23:30.854000Z","uuid":"01a1c18c-f420-718a-a7ca-9fb1de734b8e","report_url":"https://urlscan.io/result/01a1c18c-f420-718a-a7ca-9fb1de734b8e/","sha256":"4a94be006e3f6902e1f052880f662ae59345fcb1fd99dd87de4ca2da8330ea3e","relationship":"own_domain_page"},"redirect_text_policy":"explicit-redirect-v1","virustotal_public_summary":"","page_paragraph_target_characters":678}
Source facts (timestamps as stored): {"record_id":1883824,"first_recorded_at":"2026-11-09 19:25:24","virustotal":{"source":"VirusTotal","scope":"unknown","result_state":"complete","numerator":17,"denominator":92,"malicious":14,"suspicious":3,"vendors":{"CRDF":"malicious","DNS8":"suspicious","ESET":"suspicious","VIPRE":"phishing","G-Data":"phishing","Lionic":"phishing","Sophos":"phishing","CyRadar":"phishing","Fortinet":"phishing","SOCRadar":"phishing","Kaspersky":"phishing","Seclookup":"malicious","Gridinsoft":"suspicious","BitDefender":"phishing","alphaMountain.ai":"phishing","Google Safe Browsing":"phishing","Forcepoint ThreatSeeker":"phishing"},"observed_at":"2026-10-25T06:35:06Z","checked_at":null,"fetched_at":"2026-11-09T19:04:52Z","time_basis":"UTC (provider ISO timestamps)","stored_summary":{"source":"VirusTotal","scope":"unknown","result_state":"observed","numerator":17,"denominator":92,"malicious":null,"suspicious":null,"vendors":["alphaMountain.ai","BitDefender","CRDF","CyRadar","DNS8","ESET","Forcepoint ThreatSeeker","Fortinet","G-Data","Google Safe Browsing","Gridinsoft","Kaspersky","Lionic","Seclookup","SOCRadar","Sophos","VIPRE"],"observed_at":"2026-10-25 06:35:06","checked_at":"2026-11-09 20:04:52","fetched_at":"2026-11-09 19:04:53","time_basis":"as stored; legacy timezone not established"},"record_source":"phishdestroy.technologies.vt","vendor_labels":{"CRDF":"malicious","DNS8":"suspicious","ESET":"suspicious","VIPRE":"phishing","G-Data":"phishing","Lionic":"phishing","Sophos":"phishing","CyRadar":"phishing","Fortinet":"phishing","SOCRadar":"phishing","Kaspersky":"phishing","Seclookup":"malicious","Gridinsoft":"suspicious","BitDefender":"phishing","alphaMountain.ai":"phishing","Google Safe Browsing":"phishing","Forcepoint ThreatSeeker":"phishing"},"vendor_names":["CRDF","DNS8","ESET","VIPRE","G-Data","Lionic","Sophos","CyRadar","Fortinet","SOCRadar","Kaspersky","Seclookup","Gridinsoft","BitDefender","alphaMountain.ai","Google Safe Browsing","Forcepoint ThreatSeeker"],"stats":{"timeout":0,"harmless":43,"malicious":14,"suspicious":3,"undetected":32}},"google_safe_browsing":{"source":"Google Safe Browsing","state":"flagged","verdict":1,"checked_at":"2026-11-09 19:59:13"},"spamhaus":{"source":"Spamhaus","verdict":null,"checked_at":null},"availability":{"state":"unknown","label_key":"availability.unverified","detail_key":"detail.no_response","params":[],"source":"current_http_probe","record_id":1883824,"scope":"checked_url","observed_at":"2026-11-09T18:25:24Z","http_status":null,"http_observed_at":"2026-11-09T18:25:24Z","stored_http_code":null,"stored_http_observed_at":"2026-11-09T18:25:24Z","legacy_site_status":"alive","supports_outcome_badge":false,"content_classification":"unknown","content_classification_at":null,"registration_state":"unknown","policy":"20261102-dated-availability-v2"}}

## Stored page captures

- URLScan · 2026-11-09: https://screenshots.phishdestroy.io/us/01a1c18c-f420-718a-a7ca-9fb1de734b8e.png
  Captured: 2026-11-09 18:23:30 UTC
  Source report: https://urlscan.io/result/01a1c18c-f420-718a-a7ca-9fb1de734b8e/
  SHA-256: 4a94be006e3f6902e1f052880f662ae59345fcb1fd99dd87de4ca2da8330ea3e
- URLQuery: https://screenshots.phishdestroy.io/uq/8ff9c2a2-1714-426d-a6e3-d918e538699b.png
  Source report: https://urlquery.net/report/8ff9c2a2-1714-426d-a6e3-d918e538699b
  SHA-256: 22f543472a427cbfdc9f5edea715c56922021d57bd8d777507a3becb0e8ba503

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-11-09T18:29:21Z",
        "uuid": "01a1c18c-f420-718a-a7ca-9fb1de734b8e",
        "scanned_at": "2026-11-09T18:23:30Z",
        "final_url": "http://vcsservice.eu/",
        "status": 200,
        "redirects": [
            {
                "to": "https://vcsservice.eu/",
                "from": "http://vcsservice.eu/",
                "status": 307
            },
            {
                "to": "http://vcsservice.eu/",
                "from": "https://vcsservice.eu/",
                "status": 307
            }
        ],
        "ip": "217.21.190.139",
        "ptr": "217.21.190.139.static.hosted.by.combell.com",
        "domains": [
            "www.combell.com",
            "fonts.gstatic.com",
            "dev.visualwebsiteoptimizer.com",
            "www.googletagmanager.com",
            "fonts.googleapis.com"
        ],
        "ips": [
            "142.250.207.8",
            "172.217.25.163",
            "34.107.218.251",
            "142.250.195.170",
            "217.21.190.142",
            "217.21.190.139"
        ],
        "asns": [
            "15169",
            "396982",
            "34762"
        ],
        "countries": [
            "US",
            "BE"
        ],
        "doc_hash": "27ec68dbaa0a45eba25e5ae560912cc5b76ff4befb7a7e5ba9c3fb458a2c40e8",
        "cookies": [
            "PHPSESSID",
            "_locale"
        ],
        "domain_age_days": 51,
        "apex_age_days": 51,
        "requests": 22,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-2aab354"
                ],
                "score": 76,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "nginx/1.26.3",
            "content-type": "text/html"
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-11-09T19:04:52Z",
        "analysis_at": "2026-10-25T06:35:06Z",
        "stats": {
            "timeout": 0,
            "harmless": 43,
            "malicious": 14,
            "suspicious": 3,
            "undetected": 32
        },
        "detections": {
            "CRDF": "malicious",
            "DNS8": "suspicious",
            "ESET": "suspicious",
            "VIPRE": "phishing",
            "G-Data": "phishing",
            "Lionic": "phishing",
            "Sophos": "phishing",
            "CyRadar": "phishing",
            "Fortinet": "phishing",
            "SOCRadar": "phishing",
            "Kaspersky": "phishing",
            "Seclookup": "malicious",
            "Gridinsoft": "suspicious",
            "BitDefender": "phishing",
            "alphaMountain.ai": "phishing",
            "Google Safe Browsing": "phishing",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "first_seen": "2026-09-19T11:35:41Z",
        "dns": [
            {
                "ttl": 3600,
                "type": "SOA",
                "rname": "hostmaster.vcsservice.eu",
                "value": "ns3.combell.net"
            },
            {
                "ttl": 3600,
                "type": "NS",
                "value": "ns3.combell.net"
            },
            {
                "ttl": 3600,
                "type": "NS",
                "value": "ns4.combell.net"
            },
            {
                "ttl": 3600,
                "type": "NS",
                "value": "ns1.combell.eu"
            },
            {
                "ttl": 3600,
                "type": "MX",
                "value": "mx.mailprotect.be",
                "priority": 10
            },
            {
                "ttl": 3600,
                "type": "MX",
                "value": "mx.backup.mailprotect.be",
                "priority": 50
            },
            {
                "ttl": 3600,
                "type": "A",
                "value": "217.21.190.139"
            }
        ],
        "dns_at": "2026-10-25T06:41:36Z"
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-11-09T18:51:54Z",
        "mail_config": {
            "mx": [
                "mx.mailprotect.be",
                "mx.backup.mailprotect.be"
            ],
            "spf_lookups": 0
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_by": [
                "CloudFlare Family"
            ],
            "blocked_count": 1
        },
        "archives": {
            "last": "2026-10-13T16:55:51Z",
            "first": "2021-12-19T20:48:03Z",
            "changes": 0,
            "days_archived": 2,
            "scans_per_day": 0,
            "avg_page_bytes": 1007
        },
        "ports": {
            "open": [
                80
            ]
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "83.217.73.172",
                    "host": "ns3.combell.net"
                },
                {
                    "ip": "89.44.166.48",
                    "host": "ns1.combell.eu"
                },
                {
                    "ip": "86.39.202.67",
                    "host": "ns4.combell.net"
                }
            ],
            "zone": "vcsservice.eu"
        },
        "location": {
            "ip": "217.21.190.139",
            "asn": "34762",
            "org": "Combell Network",
            "city": "Ghent",
            "country": "BE"
        },
        "dns": {
            "A": [
                "217.21.190.139"
            ],
            "MX": [
                "{\"exchange\": \"mx.backup.mailprotect.be\", \"priority\": 50}",
                "{\"exchange\": \"mx.mailprotect.be\", \"priority\": 10}"
            ],
            "NS": [
                "ns1.combell.eu",
                "ns3.combell.net",
                "ns4.combell.net"
            ],
            "SOA": "{\"nsname\": \"ns3.combell.net\", \"hostmaster\": \"hostmaster.vcsservice.eu\", \"serial\": 1789812225, \"refresh\": 10800, \"retry\": 3600, \"expire\": 604800, \"minttl\": 40000}"
        },
        "dnssec": {
            "ds": true,
            "rrsig": true,
            "dnskey": true
        },
        "get_ip": {
            "ip": "217.21.190.139",
            "family": 4
        },
        "whois": {
            "registrar": "Combell NV",
            "nameservers": [
                "ns4.combell.net",
                "ns3.combell.net"
            ]
        }
    }
}
```
Capture recorded with this analysis (source URL, capture time and stored hash): {"url":"https://screenshots.phishdestroy.io/us/01a1c18c-f420-718a-a7ca-9fb1de734b8e.png","source":"URLScan","report_url":"https://urlscan.io/result/01a1c18c-f420-718a-a7ca-9fb1de734b8e/","captured_at":"2026-11-09T18:23:30Z","sha256":"4a94be006e3f6902e1f052880f662ae59345fcb1fd99dd87de4ca2da8330ea3e","model_image_sha256":"29f2269a7cecab117be64572bb11bf0a1057b8cb179ece3f6a1d2e686679f866","available":true,"content_status":null}

## Complete dated records
Availability observations: https://phishdestroy.io/domain/vcsservice.eu/records.json?source=availability&format=json
Source observation history: https://phishdestroy.io/domain/vcsservice.eu/records.json?source=detections&format=json
PhishStats records: https://phishdestroy.io/domain/vcsservice.eu/records.json?source=phishstats&format=json
Sent report records: https://phishdestroy.io/domain/vcsservice.eu/records.json?source=sent_reports&format=json
Report history: https://phishdestroy.io/domain/vcsservice.eu/records.json?source=report_history&format=json
Repeat report records: https://phishdestroy.io/domain/vcsservice.eu/records.json?source=rereports&format=json
Follow-up records: https://phishdestroy.io/domain/vcsservice.eu/records.json?source=followups&format=json
Content observations: https://phishdestroy.io/domain/vcsservice.eu/records.json?source=content&format=json

## Dated availability observation
No conclusive current response is stored
```json
{
    "state": "unknown",
    "label_key": "availability.unverified",
    "detail_key": "detail.no_response",
    "params": [],
    "source": "current_http_probe",
    "record_id": 1883824,
    "scope": "checked_url",
    "observed_at": "2026-11-09T18:25:24Z",
    "http_status": null,
    "http_observed_at": "2026-11-09T18:25:24Z",
    "stored_http_code": null,
    "stored_http_observed_at": "2026-11-09T18:25:24Z",
    "legacy_site_status": "alive",
    "supports_outcome_badge": false,
    "content_classification": "unknown",
    "content_classification_at": null,
    "registration_state": "unknown",
    "policy": "20261102-dated-availability-v2"
}
```