# PhishDestroy domain threat record: vuby.it

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/vuby.it/
Machine-readable companion: https://phishdestroy.io/domain/vuby.it/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-09-12 16:40:08 UTC
- Last availability or vendor check: 2026-10-22 10:34:07 UTC
- Stored record updated: 2026-10-22 16:07:29 UTC
- VirusTotal detections in the stored snapshot: 5/91
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: google

## Stored infrastructure

- Observed IP address: 46.252.147.132
- Registrar in stored WHOIS data: Netsons S.r.l.
- Last stored HTTP status: 301
- Registration date in stored WHOIS data: 2016-09-29 16:25:04 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a0a5d3-93f8-727a-be7f-8bef63244052/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/vuby.it
- Certificate Transparency search: https://crt.sh/?q=%25.vuby.it
- Web Archive lookup: https://web.archive.org/web/*/https://vuby.it/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
vuby.it is classified by PhishDestroy as an impersonation phishing page. PhishDestroy first saw it on 2026-09-12. The page title presents it as the personal site of Valter Bernardini, while our classification places it among impersonation threats. As of 2026-10-19 the site was still online and its content now redirects elsewhere, so a visitor may land somewhere other than the page they expected.

How the scam works
Impersonation pages borrow the look or identity of a person, brand or service people already trust. That borrowed credibility lowers the visitor's guard before the page asks for something: login details, contact information, payment or a click through to another destination. Here the page presents itself as an Italian personal website. Because the content now redirects, the destination is what matters. A familiar-looking address can hand the visitor to a page built to collect credentials or other sensitive data.

Evidence
On 2026-09-25, 5 of 91 VirusTotal engines flagged the domain: alphaMountain.ai, CRDF, Forcepoint ThreatSeeker, PhishFort and SOCRadar. That is a minority verdict, but PhishFort focuses on phishing and brand abuse, so its flag carries weight for an impersonation case. The domain also appears in 4 AlienVault OTX threat pulses, which means other analysts have independently linked it to suspicious activity. PhishDestroy is the only blocklist currently listing it.

Infrastructure
The domain was registered on 2016-09-29, almost ten years before it was detected. An aged domain like this is either long-held or a once-legitimate name that has since been repurposed. Older names also tend to slip past filters that distrust newly created domains. It is registered through Netsons S.r.l. and hosted on the Netsons s.r.l. network in Italy, so the whole setup sits with a single Italian provider.

What to do
If you entered a username, password or email on this site or wherever it redirected you, change that password right away. Change it on every other service where you reused it, and turn on two-factor authentication. If you shared card or banking details, contact your bank and watch your statements for unfamiliar charges. Be wary of follow-up messages that cite your visit or use the Valter Bernardini name. Security teams should block the domain and its redirect chain at the proxy and DNS level, check logs for past visits, and report abuse to the hosting provider.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a0a5d3-93f8-727a-be7f-8bef63244052/
VirusTotal report: https://www.virustotal.com/gui/domain/vuby.it
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=vuby.it
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 09:43:50 UTC

## Stored page captures

- Primary capture: https://urlscan.io/screenshots/01a0a5d3-93f8-727a-be7f-8bef63244052.png
  Captured: 2026-09-12 16:40:08 UTC
- URLScan capture: https://screenshots.phishdestroy.io/01a0a5d3-93f8-727a-be7f-8bef63244052.png
  Captured: 2026-09-22 03:30:39 UTC
  Source report: https://urlscan.io/result/01a0a5d3-93f8-727a-be7f-8bef63244052/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/5277d4ad-8d04-4980-bd9c-603c7874fc7a.png
  Captured: 2026-09-20 00:31:12 UTC
  Source report: https://radar.cloudflare.com/scan/5277d4ad-8d04-4980-bd9c-603c7874fc7a
  SHA-256: 7b2fd5b3246ecf5a125efcfb48599be6ec820fc7894ae9351f7111ff49595ed7

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-20T22:25:37Z",
        "uuid": "01a0a5d3-93f8-727a-be7f-8bef63244052",
        "scanned_at": "2026-09-15T16:08:28Z",
        "final_url": "https://vuby.it/bidding/",
        "status": 200,
        "redirected": "off-domain",
        "redirects": [
            {
                "to": "http://vuby.it/bidding",
                "from": "https://plumbx.cc/",
                "status": 301
            },
            {
                "to": "https://vuby.it/bidding",
                "from": "http://vuby.it/bidding",
                "status": 307
            },
            {
                "to": "https://vuby.it/bidding/",
                "from": "https://vuby.it/bidding",
                "status": 301
            }
        ],
        "ip": "46.252.147.132",
        "ptr": "hostingweb48-132.netsons.net",
        "domains": [
            "plumbx.cc"
        ],
        "ips": [
            "46.252.147.132",
            "89.106.200.1"
        ],
        "asns": [
            "60087",
            "209626"
        ],
        "countries": [
            "IT",
            "NL"
        ],
        "doc_hash": "68777ec3e78d89eabc3e39d73f5cf006c3a0fc33eaaccb01b5c9fec146d517fd",
        "globals": [
            "handleEmailSubmit"
        ],
        "tls": {
            "san": [
                "autoconfig.vuby.it",
                "autodiscover.vuby.it",
                "cpanel.vuby.it",
                "cpcalendars.vuby.it",
                "cpcontacts.vuby.it",
                "mail.vuby.it",
                "vuby.it",
                "webdisk.vuby.it",
                "webmail.vuby.it",
                "www.vuby.it"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "YR1",
            "subject": "webmail.vuby.it",
            "protocol": "TLS 1.3",
            "valid_to": "2026-12-01T13:50:14Z",
            "valid_from": "2026-09-02T13:50:15Z"
        },
        "domain_age_days": 2879,
        "apex_age_days": 2879,
        "tls_age_days": 13,
        "tls_valid_days": 89,
        "requests": 1,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 88,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "Apache",
            "content-type": "text/html"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-20T22:32:50Z",
        "uuid": "5277d4ad-8d04-4980-bd9c-603c7874fc7a",
        "scanned_at": "2026-09-20T00:31:12Z",
        "final_url": "https://www.vuby.it/",
        "status": 200,
        "redirected": "subdomain",
        "history": [
            {
                "url": "http://vuby.it/",
                "status": 307
            },
            {
                "url": "https://vuby.it/",
                "status": 301
            },
            {
                "url": "https://www.vuby.it/",
                "status": 307
            },
            {
                "url": "http://vuby.it/",
                "status": 301
            },
            {
                "url": "http://www.vuby.it/",
                "status": 307
            },
            {
                "url": "https://www.vuby.it/",
                "status": 200
            }
        ],
        "dom_hash": "8aad663a55ae5bfecf871d732284d3de6d1062e54402b539ad01db669606bc37",
        "doc_hash": "b1e12d25fe5a92d39e8c61dd23665e12f43d7b1650286abee63e7d0da676e96f",
        "domain_risks": [
            "Hobbies & Interests",
            "Society & Lifestyle"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "vuby.it",
                "type": "A",
                "value": "46.252.147.132"
            },
            {
                "name": "www.vuby.it",
                "type": "CNAME",
                "value": "vuby.it"
            },
            {
                "name": "vuby.it",
                "type": "A",
                "value": "46.252.147.132"
            },
            {
                "name": "www.vuby.it",
                "type": "CNAME",
                "value": "vuby.it"
            }
        ],
        "dnssec_valid": false,
        "ip": "46.252.147.132",
        "whois": {
            "registrar": "NETSONS-REG",
            "created": "2016-09-29T18:25:04Z",
            "updated": "2026-08-19T12:14:35Z",
            "expires": "2026-10-20T00:00:00Z",
            "nameservers": [
                "dns1.netsons.net",
                "dns2.netsons.net",
                "dns3.netsons.net",
                "dns4.netsons.net"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-22T03:25:19Z",
        "analysis_at": "2026-10-13T14:04:46Z",
        "stats": {
            "timeout": 0,
            "harmless": 53,
            "malicious": 5,
            "suspicious": 1,
            "undetected": 33
        },
        "detections": {
            "CRDF": "malicious",
            "SOCRadar": "phishing",
            "PhishFort": "malicious",
            "Gridinsoft": "suspicious",
            "alphaMountain.ai": "phishing",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "dns": [
            {
                "ttl": 3600,
                "type": "NS",
                "value": "dns3.netsons.net"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "46.252.147.132"
            },
            {
                "ttl": 3600,
                "type": "NS",
                "value": "dns1.netsons.net"
            },
            {
                "ttl": 3600,
                "type": "NS",
                "value": "dns2.netsons.net"
            },
            {
                "ttl": 120,
                "type": "TXT",
                "value": "v=spf1 +mx +a +ip4:46.252.147.132 ~all"
            },
            {
                "ttl": 3600,
                "type": "SOA",
                "rname": "admin.netsons.com",
                "value": "dns1.netsons.net"
            },
            {
                "ttl": 3600,
                "type": "NS",
                "value": "dns4.netsons.net"
            },
            {
                "ttl": 300,
                "type": "MX",
                "value": "mail.vuby.it",
                "priority": 0
            }
        ],
        "dns_at": "2026-10-13T14:05:04Z",
        "jarm": "07d3fd16d21d21d00042d43d0000007cad75e0049912dcaa3fad94e678d707",
        "cert": {
            "san": [
                "autoconfig.vuby.it",
                "autodiscover.vuby.it",
                "cpanel.vuby.it",
                "cpcalendars.vuby.it",
                "cpcontacts.vuby.it",
                "mail.vuby.it",
                "vuby.it",
                "webdisk.vuby.it",
                "webmail.vuby.it",
                "www.vuby.it"
            ],
            "issuer": "Let's Encrypt / YR1",
            "serial": "640e8e1fc11b8ca6330d748726444a01cd3",
            "sha256": "c7441b83656a4fa6c4a80dc2ea9d15fcbba4b6e2a3ea23368643f4b188f4c5b0",
            "subject": "webmail.vuby.it",
            "valid_to": "2026-12-01T13:50:14Z",
            "valid_from": "2026-09-02T13:50:15Z"
        },
        "whois": {
            "dnssec": "yes"
        }
    }
}
```