# PhishDestroy domain threat record: vorakmeld.net

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/vorakmeld.net/
Machine-readable companion: https://phishdestroy.io/domain/vorakmeld.net/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-26 20:07:57 UTC
- Last availability or vendor check: 2026-10-26 20:07:57 UTC
- Stored record updated: 2026-10-26 21:00:11 UTC
- VirusTotal detections in the stored snapshot: 4/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored infrastructure

- Observed IP address: 158.94.210.119
- Registrar in stored WHOIS data: Dynadot Inc
- Last stored HTTP status: 200
- Registration date in stored WHOIS data: 2026-10-22 12:57:26 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a179d1-cec1-74f9-b86b-c1394462b0e5/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/vorakmeld.net
- Certificate Transparency search: https://crt.sh/?q=%25.vorakmeld.net
- Web Archive lookup: https://web.archive.org/web/*/https://vorakmeld.net/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
As observed on 2026-10-26, the captured screenshot shows a Spanish-language landing page headlined Inteligencia Predictiva para la Toma de Decisiones Estratégicas, promoting an artificial-intelligence decision platform named Vorakmeld with navigation links, a diagnostic comparison panel and two access buttons. PhishDestroy listed vorakmeld.net first seen 2026-10-26 after a trusted report arrived on a domain registered 2026-10-22, four days earlier.

How the scam works
The page pairs a business-analytics pitch with Solicitar Acceso and Solicitar Acceso Prioritario buttons, a lead-capture lure that invites visitors to hand over contact details, company information or email addresses under the promise of priority platform access. In this category, harvested details are later used for follow-up social engineering, tailored offers or credential prompts, and the site supplies no verifiable product, customer or ownership proof in the captured frame.

Evidence
The screenshot shows Spanish-language claims about predictive intelligence, a manual-analysis versus Vorakmeld optimization panel, and access-request buttons, with no credential form visible in the frame. Checks were performed on 2026-10-26: VirusTotal did not flag the domain, Google Safe Browsing reported no warning, and OTX recorded zero pulses. A page fetch on 2026-10-26 returned HTTP 200 for vorakmeld.net with no cross-site redirect, and no separate blocklist or Spamhaus verdict was collected; an earlier intake assessment made without viewing the page content rated the site clean.

Infrastructure
vorakmeld.net was registered on 2026-10-22 through registrar Dynadot Inc, with DNS hosted on the registrar's nameserver service and a hosting address recorded during intake; no CDN or firewall product was identified. Notable gaps: no security-header, TLS, email-authentication, CAA or DNSSEC results were collected, so an unexamined posture must not be read as a safe one.

What to do
If you submitted information through vorakmeld.net, do not respond to follow-up messages, and if you entered a password for any genuine service, change it on that service and enable two-factor authentication. Security teams should block vorakmeld.net at proxies, mail gateways and endpoint web filters, and hunt for the same access-request lure in referral logs.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a179d1-cec1-74f9-b86b-c1394462b0e5/
Stored capture screenshot: https://urlscan.io/screenshots/01a179d1-cec1-74f9-b86b-c1394462b0e5.png
VirusTotal report: https://www.virustotal.com/gui/domain/vorakmeld.net
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=vorakmeld.net
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-26 20:10:52 UTC

## Stored page captures

- Primary capture: https://urlscan.io/screenshots/01a179d1-cec1-74f9-b86b-c1394462b0e5.png
  Captured: 2026-10-26 20:07:57 UTC
- URLScan capture 1: https://screenshots.phishdestroy.io/01a179d1-cec1-74f9-b86b-c1394462b0e5.png
  Captured: 2026-10-26 20:07:57 UTC
  Source report: https://urlscan.io/result/01a179d1-cec1-74f9-b86b-c1394462b0e5/
- URLScan · 2026-10-26: https://screenshots.phishdestroy.io/us/01a179d5-4fa2-72cc-bb9b-72d420b1e972.png
  Captured: 2026-10-26 20:09:55 UTC
  Source report: https://urlscan.io/result/01a179d5-4fa2-72cc-bb9b-72d420b1e972/
  SHA-256: a3b955451a20f43c758cb71b8e94ccd20b9ca5ffbfd93d049c03d279782da08a

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-26T20:19:23Z",
        "uuid": "01a179d1-cec1-74f9-b86b-c1394462b0e5",
        "scanned_at": "2026-10-26T20:06:08Z",
        "final_url": "https://vorakmeld.net/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://vorakmeld.net/",
                "from": "http://vorakmeld.net/",
                "status": 307
            },
            {
                "to": "http://vorakmeld.net/",
                "from": "https://vorakmeld.net/",
                "status": 307
            },
            {
                "to": "https://vorakmeld.net/",
                "from": "http://vorakmeld.net/",
                "status": 301
            }
        ],
        "ip": "158.94.210.119",
        "ips": [
            "158.94.210.119"
        ],
        "asns": [
            "202412"
        ],
        "countries": [
            "NL"
        ],
        "doc_hash": "a97001f5ee0461de306ccb44909a22487dc5b7a5ed692d1e1d9db77b6f432fd9",
        "script_hashes": [
            "8aa5f8f647356dcd4fc5dbbe0efd5bc0e8da74026bc61e24636e2e1f5749b0ce"
        ],
        "globals": [
            "__dclq",
            "__dclOrig",
            "__dclFlush",
            "__smsCheckBeforeSubmit",
            "__isSmsEnabled",
            "__isSmsVerified",
            "intlTelInput"
        ],
        "cookies": [
            "connect.sid"
        ],
        "tls": {
            "san": [
                "*.vorakmeld.net",
                "vorakmeld.net"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "YE1",
            "subject": "vorakmeld.net",
            "protocol": "TLS 1.3",
            "valid_to": "2027-01-22T10:00:03Z",
            "valid_from": "2026-10-24T10:00:04Z"
        },
        "domain_age_days": 3,
        "apex_age_days": 3,
        "tls_age_days": 2,
        "tls_valid_days": 89,
        "requests": 7,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 97,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "content-type": "text/html; charset=utf-8",
            "x-content-type-options": "nosniff",
            "referrer-policy": "same-origin"
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-26T20:38:29Z",
        "analysis_at": "2026-10-26T15:37:47Z",
        "stats": {
            "timeout": 0,
            "harmless": 51,
            "malicious": 2,
            "suspicious": 2,
            "undetected": 37
        },
        "detections": {
            "G-Data": "phishing",
            "Fortinet": "spam",
            "Netcraft": "malicious",
            "Gridinsoft": "suspicious"
        },
        "reputation": 0,
        "registrar": "Dynadot Inc",
        "created": "2026-10-22T14:57:26Z",
        "expires": "2027-10-22T14:57:26Z",
        "updated": "2026-10-22T14:57:40Z",
        "first_seen": "2026-10-22T16:22:12Z",
        "dns": [
            {
                "ttl": 300,
                "type": "SOA",
                "rname": "hostmaster.vorakmeld.net",
                "value": "ns1.dyna-ns.net"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "158.94.210.119"
            },
            {
                "ttl": 300,
                "type": "NS",
                "value": "ns1.dyna-ns.net"
            },
            {
                "ttl": 300,
                "type": "NS",
                "value": "ns2.dyna-ns.net"
            }
        ],
        "dns_at": "2026-10-26T16:15:47Z",
        "jarm": "40d40d40d00000000043d43d00043d6aff5ab0f4fc31897186312c9e639319",
        "cert": {
            "san": [
                "*.vorakmeld.net",
                "vorakmeld.net"
            ],
            "issuer": "Let's Encrypt / YE1",
            "serial": "6dc48fe9677f695a01f7ec04c0068f253a8",
            "sha256": "85d4524f8f311d470cdf87ce1ae94de80fc190cd8d2f340e3b2d9827d736ff72",
            "subject": "vorakmeld.net",
            "valid_to": "2027-01-22T10:00:03Z",
            "valid_from": "2026-10-24T10:00:04Z"
        },
        "whois": {
            "registrar": "Dynadot Inc",
            "registrar_iana_id": "472",
            "registrar_url": "http://www.dynadot.com",
            "created": "2026-10-22T14:57:26Z",
            "updated": "2026-10-22T14:57:40Z",
            "expires": "2027-10-22T14:57:26Z",
            "status": [
                "clientTransferProhibited"
            ],
            "nameservers": [
                "hal.ns.cloudflare.com",
                "veronica.ns.cloudflare.com"
            ],
            "dnssec": "unsigned"
        },
        "rdap": {
            "status": [
                "transfer prohibited"
            ],
            "events": {
                "expiration": "2027-10-22T14:57:26Z",
                "last changed": "2026-10-22T14:57:40Z",
                "registration": "2026-10-22T14:57:26Z",
                "registrar expiration": "2027-10-22T14:57:26Z",
                "last update of RDAP database": "2026-10-22T15:01:39Z"
            }
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-26T20:36:39Z",
        "mail_config": {
            "spf_lookups": 0
        },
        "caa_records": {
            "domain": "vorakmeld.net"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_count": 0
        },
        "archives": {
            "last": "2026-10-26T20:08:10Z",
            "first": "2026-10-26T20:08:10Z",
            "changes": 0,
            "days_archived": 1,
            "avg_page_bytes": 20862
        },
        "robots_txt": {
            "agents": [
                "*"
            ],
            "present": true,
            "sitemaps": [
                "https://vorakmeld.net/sitemap.xml"
            ]
        },
        "sitemap": {
            "present": true,
            "url_count": 5
        },
        "social_tags": {
            "title": "Vorakmeld — Plataforma de IA para decisiones estratégicas",
            "robots": "index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1",
            "description": "Vorakmeld transforma datos masivos en recomendaciones ejecutables mediante inteligencia artificial predictiva. Solicite acceso y anticipe riesgos antes de que impacten su negocio.",
            "canonicalUrl": "https://vorakmeld.net/"
        },
        "trackers": {
            "requests": 48,
            "trackers": [
                {
                    "name": "Cloudflare",
                    "company": "Cloudflare",
                    "country": "US",
                    "category": "Hosting",
                    "requests": 1
                },
                {
                    "name": "jsDelivr",
                    "company": "jsDelivr",
                    "category": "Hosting",
                    "requests": 3
                }
            ]
        },
        "mixed_content": {
            "third_party_scripts": 0
        },
        "status": {
            "up": true,
            "code": 200,
            "timings": {
                "dns": 1068,
                "tls": 96,
                "wait": 2006,
                "connect": 114,
                "download": 182
            },
            "response_ms": 3466
        },
        "tls_connection": {
            "alpn": "h2",
            "cipher": "TLS_AES_128_GCM_SHA256",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                22,
                80,
                443
            ]
        },
        "carbon": {
            "bytes": 72331,
            "co2_grams": 0.0026,
            "cleaner_than": 29
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "162.159.26.92",
                    "host": "ns1.dyna-ns.net"
                },
                {
                    "ip": "162.159.24.5",
                    "host": "ns2.dyna-ns.net"
                }
            ],
            "zone": "vorakmeld.net"
        },
        "cookies": {
            "cookies": [
                {
                    "name": "connect.sid",
                    "secure": true,
                    "http_only": true,
                    "same_site": "Lax"
                }
            ]
        },
        "location": {
            "ip": "158.94.210.119",
            "asn": "202412",
            "org": "Omegatech LTD",
            "city": "Amsterdam",
            "country": "NL"
        },
        "ssl": {
            "issuer": "Let's Encrypt / YE1",
            "subject": "vorakmeld.net"
        },
        "dns": {
            "A": [
                "158.94.210.119"
            ],
            "NS": [
                "ns2.dyna-ns.net",
                "ns1.dyna-ns.net"
            ],
            "SOA": "{\"nsname\": \"ns1.dyna-ns.net\", \"hostmaster\": \"hostmaster.vorakmeld.net\", \"serial\": 2026102405, \"refresh\": 16384, \"retry\": 2048, \"expire\": 1209600, \"minttl\": 300}"
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "hsts": {
            "message": "Site does not serve any HSTS headers."
        },
        "http_security": {
            "xFrameOptions": false,
            "referrerPolicy": "same-origin",
            "xXSSProtection": false,
            "permissionsPolicy": false,
            "xContentTypeOptions": "nosniff",
            "contentSecurityPolicy": false,
            "strictTransportPolicy": false,
            "crossOriginOpenerPolicy": false,
            "crossOriginEmbedderPolicy": false,
            "crossOriginResourcePolicy": false
        },
        "get_ip": {
            "ip": "158.94.210.119",
            "family": 4
        },
        "redirects": {
            "chain": [
                "https://vorakmeld.net"
            ]
        },
        "linked_pages": {
            "internal_count": 9
        },
        "whois": {
            "registrar": "Dynadot Inc",
            "created": "2026-10-22T14:57:26Z",
            "updated": "2026-10-24T10:43:04Z",
            "expires": "2027-10-22T14:57:26Z",
            "status": [
                "clientTransferProhibited https://icann.org/epp"
            ],
            "nameservers": [
                "ns1.dyna-ns.net",
                "ns2.dyna-ns.net"
            ]
        },
        "headers": {
            "headers": {
                "content-type": "text/html; charset=utf-8",
                "x-content-type-options": "nosniff",
                "referrer-policy": "same-origin"
            }
        }
    }
}
```