# PhishDestroy threat dossier — zpzbys.com ================================================================ Fetched: 2026-07-14 00:07:10 UTC Canonical: https://phishdestroy.io/domain/zpzbys.com/ ## VERDICT ---------------------------------------------------------------- CRITICAL THREAT — DO NOT VISIT Composite threat score: 99/100 (PhishDestroy scoring — see methodology below) ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 3/91 security vendors flagged this domain Flagging vendors: alphaMountain.ai, Cluster25, SOCRadar AlienVault OTX: 2 pulses (threat-intel feed mentions) Public blocklists: listed on 1 independent blocklist ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 170.130.255.48 (US, Los Angeles) ASN: AS62904 Eonix Corporation Hosting org: Eonix Corporation Registrar: Gname.com Pte. Ltd. Nameservers: hattie.ns.cloudflare.com, junade.ns.cloudflare.com Registered: 2024-12-27 Expires: 2026-12-27 Page title: 泛亚电竞·(中国区)电子竞技平台 ## TLS CERTIFICATE ---------------------------------------------------------------- Issuer: none Status: INVALID chain ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: pending notification queue. No abuse reports filed yet — this domain is waiting for the next cycle of our automated abuse-reporter. ## TIMELINE ---------------------------------------------------------------- Domain registered: 2024-12-27 (per WHOIS / CT — may reflect a renewal or transfer date, not first-ever registration) First detected: 2026-07-12 14:38:57 UTC (by PhishDestroy tracker) First reported: 2026-07-12 22:44:26 UTC (abuse notice filed) Last verified: 2026-07-14 00:20:46 UTC Current status: ACTIVE / observable ## EXTERNAL CORROBORATION (third-party evidence) ---------------------------------------------------------------- URLScan.io: https://urlscan.io/result/019f5656-1d74-747b-aa48-f85f3d4d79e1/ Wayback Machine: https://web.archive.org/web/*/zpzbys.com crt.sh CT logs: https://crt.sh/?q=%25.zpzbys.com Google transparency: https://transparencyreport.google.com/safe-browsing/search?url=zpzbys.com AlienVault OTX: https://otx.alienvault.com/indicator/domain/zpzbys.com URLhaus: https://urlhaus.abuse.ch/host/zpzbys.com/ ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-07-12 17:18:24 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] The domain zpzbys.com has been identified as a high-risk phishing threat and is currently active. The domain was created on December 27, 2024, and is registered through Gname.com Pte. Ltd. It resolves to the IP address 170.130.255.48, which is currently associated with the domain's malicious activity. This domain is listed on two security blocklists and has been flagged in two threat intelligence pulses on AlienVault OTX, indicating that it has been linked to phishing attempts or similar fraudulent activities. Currently, the domain has a low detection rate on VirusTotal, with only 1 out of 95 security vendors flagging it as malicious. However, it is important to note that despite this low detection count, the domain has been blocked by known phishing detection services, OpenPhish and PhishDestroy, which enhances its credibility as a phishing threat. The discrepancy in detection rates may indicate that the domain is either newly activated or that it is currently in a phase of adaptation to evade detection by security vendors. The evidence indicates that this domain poses a significant risk to potential victims. Organizations and individuals should be cautious and treat any communications or links associated with zpzbys.com as potentially harmful. It is advisable for security teams to implement measures to block this domain at the network level and for users to remain vigilant against phishing attempts that may utilize this domain. In summary, the available intelligence suggests that zpzbys.com is actively involved in phishing campaigns, and its presence on multiple blocklists corroborates its malicious intent. Continuous monitoring and proactive responses to emerging threats related to this domain are essential for maintaining cybersecurity. ## EVIDENCE HASHES ---------------------------------------------------------------- PhishDestroy Case ID: PD-20260712-9B3DF0 Favicon MD5: 0080e5c3930c7346bd1c2fbb50d2df5d ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (operator takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/zpzbys.com/ JSON API: https://api.destroy.tools/v1/check?domain=zpzbys.com Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: independent open-source threat-intelligence platform. Tracked: 178,334 domains (50,014 alive under monitoring, 128,320 confirmed takedowns/dead). Site: https://phishdestroy.io