# PhishDestroy domain threat record: zs.ebivyt.net

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/zs.ebivyt.net/
Machine-readable companion: https://phishdestroy.io/domain/zs.ebivyt.net/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-23 01:45:07 UTC
- Last availability or vendor check: 2026-10-27 23:54:40 UTC
- Stored record updated: 2026-10-27 23:54:40 UTC
- VirusTotal detections in the stored snapshot: 21/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: flagged

## Stored classification

- Targeted brand: Wells Fargo

## Stored infrastructure

- Observed IP address: 64.247.177.104
- Registrar in stored WHOIS data: IONOS SE
- Registrar country in stored WHOIS data: DE
- Registration date (registry RDAP, ebivyt.net): 2026-06-20 19:24:09 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a1669c-2e6d-747c-8e68-da7238a94f6b/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/zs.ebivyt.net
- Certificate Transparency search: https://crt.sh/?q=%25.zs.ebivyt.net
- Web Archive lookup: https://web.archive.org/web/*/https://zs.ebivyt.net/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
The captured screenshot from 2026-10-23 shows a Wells Fargo branded sign-on page whose title read Sign On to View Your Personal Accounts, with Username and Password fields, a Show toggle, a Save username checkbox, a red Sign on button, a Use a passkey option and a forgot username or password link. The page also displayed investment and insurance risk disclaimers and a deposit-products footer. PhishDestroy classified it as an impersonation phishing page, first seen on 2026-10-23.

How the scam works
The form is built to harvest banking credentials: a visitor who fills the Username and Password fields and presses Sign on submits them to the impersonating domain instead of the genuine bank. The Save username and passkey prompts and the familiar branding add legitimacy cues that encourage completion. As a category risk, captured passwords enable account takeover and password-reuse attacks.

Evidence
The screenshot shows the cloned sign-on form and brand header as observed on 2026-10-23. urlscan scored the capture malicious at 100 with a phishing category and a Wells Fargo brand label on 2026-10-23. VirusTotal flagged the domain as malicious, with CRDF labelling it malicious and DNS8 suspicious. Google Safe Browsing flagged SOCIAL_ENGINEERING on 2026-10-26, while Spamhaus listed the domain as spam on 2026-10-23. The redirect funnel began with a 302 from the root into a login path, and another path looped 307 between HTTP and HTTPS. External blocklists recorded no listings and OTX held zero pulses, negatives that do not imply safety; PhishDestroy's internal blocklist held the domain on 2026-10-26, and one of twelve tested resolvers, Cloudflare Family, blocked it. One inspection loaded 69 requests including OneTrust and Tealium analytics and a third-party script reference to the impersonated brand's login endpoint without Subresource Integrity.

Infrastructure
Recorded hosting was Oracle Corporation in the United States; no registrar record or WAF was captured. Weaknesses first: Content-Security-Policy and HSTS absent, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, COOP, COEP and CORP all absent, DNSSEC unsigned. Then the rest: TLS 1.3 with AES-256-GCM, forward secrecy, ALPN http/1.1; SPF, DKIM and DMARC configured; CAA records present; certificate valid to 2026-12-13.

What to do
If you submitted credentials to zs.ebivyt.net, change your password on the genuine Wells Fargo service, enable two-factor authentication, and review recent sign-on and transaction activity for unfamiliar access. Stop reusing that password elsewhere and watch for follow-up messages. Defenders should block the exact domain zs.ebivyt.net, add its paths to URL filters, and hunt for the same credential-harvesting pattern across email and messaging gateways.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a1669c-2e6d-747c-8e68-da7238a94f6b/
Cloudflare Radar report: https://radar.cloudflare.com/scan/d3010483-cbcb-40fb-a51d-fb540fd6eb1e
URLQuery report: https://urlquery.net/report/b04de2a3-ba07-430a-9ec9-ae0449c861e1
Stored capture screenshot: https://urlscan.io/screenshots/01a1669c-2e6d-747c-8e68-da7238a94f6b.png
Cloudflare Radar screenshot (2026-10-23T01:54:21Z): https://screenshots.phishdestroy.io/cf/d3010483-cbcb-40fb-a51d-fb540fd6eb1e.png
URLQuery screenshot: https://screenshots.phishdestroy.io/uq/b04de2a3-ba07-430a-9ec9-ae0449c861e1.png
URLScan screenshot (2026-10-23T01:04:37Z): https://screenshots.phishdestroy.io/us/01a16649-b652-70ba-8f0b-8fd7f5085650.png
URLScan capture report: https://urlscan.io/result/01a16649-b652-70ba-8f0b-8fd7f5085650/
VirusTotal report: https://www.virustotal.com/gui/domain/zs.ebivyt.net
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=zs.ebivyt.net
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-26 22:34:04 UTC

## Stored page captures

- Primary capture: https://urlscan.io/screenshots/01a1669c-2e6d-747c-8e68-da7238a94f6b.png
  Captured: 2026-10-23 02:36:34 UTC
- URLScan capture: https://screenshots.phishdestroy.io/01a16649-b652-70ba-8f0b-8fd7f5085650.png
  Captured: 2026-10-23 01:45:07 UTC
  Source report: https://urlscan.io/result/01a1669c-2e6d-747c-8e68-da7238a94f6b/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/d3010483-cbcb-40fb-a51d-fb540fd6eb1e.png
  Captured: 2026-10-23 01:54:21 UTC
  Source report: https://radar.cloudflare.com/scan/d3010483-cbcb-40fb-a51d-fb540fd6eb1e
  SHA-256: 302f4ab81ef4f311c4b60c3cdd8f5d2e38d5220807070bf4929a92857a4c95f1
- URLQuery: https://screenshots.phishdestroy.io/uq/b04de2a3-ba07-430a-9ec9-ae0449c861e1.png
  Source report: https://urlquery.net/report/b04de2a3-ba07-430a-9ec9-ae0449c861e1
  SHA-256: 686a5210ecfc4c5eab472f59a452404adb15dc4abc519847fa55707065355a44
- URLScan · 2026-10-23: https://screenshots.phishdestroy.io/us/01a16649-b652-70ba-8f0b-8fd7f5085650.png
  Captured: 2026-10-23 01:04:37 UTC
  Source report: https://urlscan.io/result/01a16649-b652-70ba-8f0b-8fd7f5085650/
  SHA-256: f5a5ebdfeec956db802a040b5d462fa1d545b0e1559e84fcb04c2d834ef3d64f

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-23T03:26:14Z",
        "uuid": "01a1669c-2e6d-747c-8e68-da7238a94f6b",
        "scanned_at": "2026-10-23T02:34:51Z",
        "final_url": "http://zs.ebivyt.net/connect/sec/cod.php",
        "status": 200,
        "redirects": [
            {
                "to": "https://zs.ebivyt.net/connect/sec/cod.php",
                "from": "http://zs.ebivyt.net/connect/sec/cod.php",
                "status": 307
            },
            {
                "to": "http://zs.ebivyt.net/connect/sec/cod.php",
                "from": "https://zs.ebivyt.net/connect/sec/cod.php",
                "status": 307
            }
        ],
        "ip": "64.247.177.104",
        "ptr": "hialet.com",
        "domains": [
            "www17.wellsfargomedia.com"
        ],
        "ips": [
            "23.207.8.182",
            "64.247.177.104"
        ],
        "asns": [
            "16625",
            "31898"
        ],
        "countries": [
            "US"
        ],
        "doc_hash": "c062b7f48946755d9aceb422e01a3b714af80652cee9fb94b6107bf500ae7ea1",
        "domain_age_days": 38,
        "apex_age_days": 122,
        "requests": 4,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 100,
                "malicious": true
            },
            "overall": {
                "tags": [
                    "phishing"
                ],
                "score": 100,
                "brands": [
                    "wellsfargo"
                ],
                "malicious": true,
                "categories": [
                    "phishing"
                ]
            },
            "urlscan": {
                "tags": [
                    "phishing"
                ],
                "score": 100,
                "brands": [
                    "Wells Fargo"
                ],
                "malicious": true,
                "categories": [
                    "phishing"
                ]
            }
        },
        "headers": {
            "server": "Apache",
            "content-type": "text/html; charset=UTF-8"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-23T01:55:43Z",
        "uuid": "d3010483-cbcb-40fb-a51d-fb540fd6eb1e",
        "scanned_at": "2026-10-23T01:54:21Z",
        "final_url": "https://zs.ebivyt.net/connect/sec/login.php",
        "status": 200,
        "redirected": "same-domain",
        "history": [
            {
                "url": "https://zs.ebivyt.net/",
                "status": 302
            },
            {
                "url": "https://zs.ebivyt.net/connect/sec/login.php",
                "status": 200
            }
        ],
        "dom_hash": "40d9ad92b98770330eca311d62125af231ce53ec7a11037aafadc435dda079c8",
        "doc_hash": "f27dd872225fc044cd70ec04fa059da46332733071bdc32a32b9220b021b1e25",
        "phishing": [
            "Credential Harvester"
        ],
        "phishing_v2": [
            "phishing"
        ],
        "domain_risks": [
            "Phishing",
            "Security threats",
            "CIPA Filter",
            "CIPA"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "zs.ebivyt.net",
                "type": "A",
                "value": "64.247.177.104"
            }
        ],
        "dnssec_valid": false,
        "ip": "64.247.177.104",
        "verdict": {
            "tags": [
                "phishing",
                "Credential Harvester"
            ],
            "malicious": true,
            "categories": [
                "phishing"
            ]
        },
        "whois": {
            "registrar": "IONOS SE",
            "created": "2026-06-20T19:24:09Z",
            "updated": "2026-07-06T02:05:51Z",
            "expires": "2027-06-20T19:24:09Z",
            "nameservers": [
                "ns1.pxymrg.shop",
                "ns2.pxymrg.shop"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-23T01:53:35Z",
        "analysis_at": "2026-10-22T19:08:00Z",
        "stats": {
            "timeout": 0,
            "harmless": 54,
            "malicious": 1,
            "suspicious": 1,
            "undetected": 36
        },
        "detections": {
            "CRDF": "malicious",
            "DNS8": "suspicious"
        },
        "reputation": 0,
        "tags": [
            "dga"
        ],
        "registrar": "IONOS SE",
        "created": "2026-06-20T19:24:09Z",
        "expires": "2027-06-20T19:24:09Z",
        "updated": "2026-07-06T02:05:51Z",
        "first_seen": "2026-09-14T16:21:41Z",
        "dns": [
            {
                "ttl": 14400,
                "type": "A",
                "value": "64.247.177.104"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "ns2.pxymrg.shop"
            },
            {
                "ttl": 14400,
                "type": "MX",
                "value": "zs.ebivyt.net",
                "priority": 0
            },
            {
                "ttl": 14400,
                "type": "TXT",
                "value": "v=spf1 +a +mx +ip4:64.247.177.104 ~all"
            },
            {
                "ttl": 21600,
                "type": "SOA",
                "rname": "root.chainimage.com",
                "value": "ns1.pxymrg.shop"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "ns1.pxymrg.shop"
            }
        ],
        "dns_at": "2026-10-22T19:13:55Z",
        "jarm": "15d3fd16d29d29d00042d43d0000001ae0802418786940cae38f1d9eed5b9b",
        "cert": {
            "san": [
                "*.zs.ebivyt.net",
                "zs.ebivyt.net"
            ],
            "issuer": "Let's Encrypt / YR2",
            "serial": "501d1afd9abd104a5910633358a3babd223",
            "sha256": "4ffea4ec4c9ad5b562fafd21e3d2a355b4777617e9923e25beab008a7ffba2a5",
            "subject": "*.zs.ebivyt.net",
            "valid_to": "2026-12-13T15:00:31Z",
            "valid_from": "2026-09-14T15:00:32Z"
        },
        "whois": {
            "registrar": "IONOS SE",
            "registrar_iana_id": "83",
            "registrar_url": "http://www.ionos.com",
            "created": "2026-06-20T19:24:09Z",
            "updated": "2026-07-06T02:05:51Z",
            "expires": "2027-06-20T19:24:09Z",
            "status": [
                "clientTransferProhibited"
            ],
            "nameservers": [
                "ns1.pxymrg.shop",
                "ns2.pxymrg.shop"
            ],
            "dnssec": "Unsigned"
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-23T01:56:02Z",
        "mail_config": {
            "mx": [
                "zs.ebivyt.net"
            ],
            "spf": "v=spf1 +a +mx +ip4:64.247.177.104 ~all",
            "dkim": [
                "default"
            ],
            "dmarc": true,
            "dkim_bits": 2048,
            "spf_lookups": 2
        },
        "caa_records": {
            "domain": "zs.ebivyt.net"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_by": [
                "CloudFlare Family"
            ],
            "blocked_count": 1
        },
        "social_tags": {
            "title": "Sign On to View Your Personal Accounts | Wells Fargo",
            "robots": "noindex"
        },
        "trackers": {
            "requests": 69,
            "trackers": [
                {
                    "name": "OneTrust",
                    "company": "OneTrust",
                    "country": "US",
                    "category": "Consent Management",
                    "requests": 1
                },
                {
                    "name": "Tealium",
                    "company": "Tealium",
                    "country": "US",
                    "category": "Site Analytics",
                    "requests": 1
                }
            ]
        },
        "mixed_content": {
            "no_sri": [
                "https://connect.secure.wellsfargo.com/auth/login/present"
            ],
            "third_party_scripts": 1
        },
        "status": {
            "up": true,
            "code": 302,
            "timings": {
                "dns": 2,
                "tls": 168,
                "wait": 223,
                "connect": 165,
                "download": 0
            },
            "response_ms": 558
        },
        "tls_connection": {
            "alpn": "http/1.1",
            "cipher": "TLS_AES_256_GCM_SHA384",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                22,
                25,
                53,
                80,
                110,
                143,
                443,
                587,
                993,
                995,
                3306
            ]
        },
        "carbon": {
            "bytes": 167003,
            "co2_grams": 0.0061,
            "cleaner_than": 11
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "64.247.177.104",
                    "host": "ns1.pxymrg.shop"
                },
                {
                    "ip": "64.247.177.104",
                    "host": "ns2.pxymrg.shop"
                }
            ],
            "zone": "zs.ebivyt.net"
        },
        "cookies": {
            "cookies": [
                {
                    "name": "akacd_m2pr",
                    "secure": true,
                    "session": true,
                    "same_site": "None"
                },
                {
                    "name": "_abck",
                    "secure": true,
                    "same_site": "None"
                },
                {
                    "name": "bm_sz",
                    "secure": true,
                    "same_site": "None"
                }
            ]
        },
        "location": {
            "ip": "64.247.177.104",
            "asn": "31898",
            "org": "Oracle Corporation",
            "city": "Phoenix",
            "country": "US"
        },
        "ssl": {
            "issuer": "Let's Encrypt / YR2",
            "subject": "*.zs.ebivyt.net"
        },
        "dns": {
            "A": [
                "64.247.177.104"
            ],
            "MX": [
                "{\"exchange\": \"zs.ebivyt.net\", \"priority\": 0}"
            ],
            "NS": [
                "ns1.pxymrg.shop",
                "ns2.pxymrg.shop"
            ],
            "SOA": "{\"nsname\": \"ns1.pxymrg.shop\", \"hostmaster\": \"root.chainimage.com\", \"serial\": 2026091405, \"refresh\": 3600, \"retry\": 1800, \"expire\": 1209600, \"minttl\": 86400}",
            "TXT": [
                "v=spf1 +a +mx +ip4:64.247.177.104 ~all"
            ]
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "hsts": {
            "message": "Site does not serve any HSTS headers."
        },
        "http_security": {
            "xFrameOptions": false,
            "referrerPolicy": false,
            "xXSSProtection": false,
            "permissionsPolicy": false,
            "xContentTypeOptions": false,
            "contentSecurityPolicy": false,
            "strictTransportPolicy": false,
            "crossOriginOpenerPolicy": false,
            "crossOriginEmbedderPolicy": false,
            "crossOriginResourcePolicy": false
        },
        "get_ip": {
            "ip": "64.247.177.104",
            "family": 4
        },
        "redirects": {
            "chain": [
                "https://zs.ebivyt.net",
                "https://zs.ebivyt.net/connect/sec/login.php"
            ],
            "count": 1
        },
        "subdomains": {
            "count": 13,
            "subdomains": [
                "ab.ebivyt.net",
                "gv.ebivyt.net",
                "gw.ebivyt.net",
                "kg.ebivyt.net",
                "ki.ebivyt.net",
                "mr.ebivyt.net",
                "nu.ebivyt.net",
                "nx.ebivyt.net",
                "px.ebivyt.net",
                "qj.ebivyt.net",
                "qm.ebivyt.net",
                "yk.ebivyt.net",
                "yu.ebivyt.net"
            ]
        },
        "linked_pages": {
            "internal_count": 1
        },
        "whois": {
            "registrar": "IONOS SE",
            "created": "2026-06-20T19:24:09Z",
            "updated": "2026-07-06T02:05:51Z",
            "expires": "2027-06-20T19:24:09Z",
            "status": [
                "clientTransferProhibited https://icann.org/epp"
            ],
            "nameservers": [
                "ns1.pxymrg.shop",
                "ns2.pxymrg.shop"
            ]
        },
        "headers": {
            "headers": {
                "server": "Apache",
                "content-type": "text/html; charset=UTF-8"
            }
        }
    }
}
```