# PhishDestroy threat dossier — zcr.bfm.mybluehost.me ================================================================ Fetched: 2026-07-28 17:50:51 UTC Canonical: https://phishdestroy.io/domain/zcr.bfm.mybluehost.me/ ## VERDICT ---------------------------------------------------------------- TAKEN DOWN (neutralised) Composite threat score: 57/100 (PhishDestroy scoring — see methodology below) ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 11/95 security vendors flagged this domain Flagging vendors: alphaMountain.ai, BitDefender, Certego, CyRadar, ESET, Fortinet, G-Data, Lionic, Sophos, URLQuery, Webroot Public blocklists: listed on 1 independent blocklist Victim re-reports (public form): 1 ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 66.235.200.147 (US, Jacksonville) ASN: ASAS13335 CLOUDFLARENET, US Hosting org: AS13335 Cloudflare, Inc. Registrar: Domain.com - Network Solutions, LLC Nameservers: ns1.bluehost.com, ns1.mybluehost.me, ns2.bluehost.com, ns2.mybluehost.me Registered: 2016-10-05 Expires: 2026-10-05 Page title: Home - la liste des prenoms francais feminin HTTP response: 503 ## TLS CERTIFICATE ---------------------------------------------------------------- Issuer: Let's Encrypt / R13 Expires: 2026-05-09 Status: INVALID chain Fingerprint: ff058b2802e7b827df56750f2f741edb5c45d7daeb875ead9cf4460578539a65 Subject Alternative Names (related infrastructure — often same operator): - autodiscover.zcr.bfm.mybluehost.me - cpanel.zcr.bfm.mybluehost.me - cpcalendars.zcr.bfm.mybluehost.me - cpcontacts.zcr.bfm.mybluehost.me - mail.zcr.bfm.mybluehost.me - webdisk.zcr.bfm.mybluehost.me - webmail.zcr.bfm.mybluehost.me - www.zcr.bfm.mybluehost.me ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: CLOSED — no report required. This domain was neutralised before the abuse-report cycle could be dispatched — either the hosting provider / registrar suspended it on their own, the DNS went dead, or the operator abandoned the infrastructure. PhishDestroy keeps the evidence bundle on file for audit but no formal notice was sent. ## TIMELINE ---------------------------------------------------------------- Domain registered: 2016-10-05 (per WHOIS / CT — may reflect a renewal or transfer date, not first-ever registration) First detected: 2026-02-25 02:39:27 UTC (by PhishDestroy tracker) First reported: 2025-10-13 16:44:19 UTC (abuse notice filed) Last verified: 2026-07-28 16:21:50 UTC Neutralised: 2026-06-06 15:28:26 UTC Current status: taken down (registrar suspended or DNS dead) ## EXTERNAL CORROBORATION (third-party evidence) ---------------------------------------------------------------- URLScan.io: https://urlscan.io/result/0199de74-ac6f-7755-a4af-116f2e5f2480/ Wayback Machine: https://web.archive.org/web/*/zcr.bfm.mybluehost.me crt.sh CT logs: https://crt.sh/?q=%25.zcr.bfm.mybluehost.me Google transparency: https://transparencyreport.google.com/safe-browsing/search?url=zcr.bfm.mybluehost.me AlienVault OTX: https://otx.alienvault.com/indicator/domain/zcr.bfm.mybluehost.me URLhaus: https://urlhaus.abuse.ch/host/zcr.bfm.mybluehost.me/ ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-07-24 14:50:42 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] zcr.bfm.mybluehost.me: Confirmed Phishing Site On 24 July 2026 the domain zcr.bfm.mybluehost.me was observed as an offline phishing infrastructure. The site was previously blocked by the PhishDestroy community and removed from public access, and it currently appears on a single security blocklist. Registration information shows the domain was created on 5 October 2016 through Domain.com – Network Solutions, LLC, and is served by Bluehost’s DNS infrastructure (ns1.bluehost.com, ns1.mybluehost.me, ns2.bluehost.com, ns2.mybluehost.me). The resolver points to IP address 66.235.200.147, which belongs to Cloudflare, Inc. (AS13335) and is located in the United States. TLS termination is provided by a Let’s Encrypt R13 certificate, indicating the site offered HTTPS connections. An HTTP request returned a 503 Service Unavailable status, and the underlying web server was identified as Apache HTTP Server. The page title retrieved prior to takedown reads “Home - la liste des prenoms francais feminin”, suggesting the site may have been masquerading as a French‑language resource, but no further content was captured. VirusTotal scans recorded 11 detections out of 95 scanning engines, confirming that multiple security products flagged the domain as malicious. Because the site is no longer reachable, content‑level analysis cannot be performed, and the exact phishing lure or credential‑stealing mechanisms remain unknown. Defensive teams should continue to enforce blocking of the IP address and associated hostnames, update any local blocklists with the current domain entry, and monitor for re‑use of the underlying Cloudflare IP range or similar Bluehost name‑server patterns. Ongoing vigilance is advised, as threat actors frequently redeploy infrastructure after takedown. ## EVIDENCE HASHES ---------------------------------------------------------------- TLS cert SHA-256: ff058b2802e7b827df56750f2f741edb5c45d7daeb875ead9cf4460578539a65 ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (operator takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/zcr.bfm.mybluehost.me/ JSON API: https://api.destroy.tools/v1/check?domain=zcr.bfm.mybluehost.me Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: independent open-source threat-intelligence platform. Tracked: 212,446 domains (86,886 alive under monitoring, 124,530 confirmed takedowns/dead). Site: https://phishdestroy.io