activar-bhd[.]zya[.]me

Analysis of the domain activar-bhd.zya.me, first observed on September 01, 2021, shows that the infrastructure is still active as of the report date (August 06, 2026). The domain is registered through Porkbun LLC, a widely used registrar, and resolves to the IPv4 address 185.27.134.57. No nameserver information could be retrieved (NS_NOT_FOUND), which may indicate a deliberately minimal DNS footprint. The hosting IP is not currently flagged by major reputation services, but the domain has been listed on a single security blocklist and was blocked by the PhishDestroy platform, indicating that at least one security vendor has identified malicious usage. VirusTotal records show that the domain was submitted for scanning and examined by 91 vendor engines; none reported a detection at the time of the scan.

The absence of detections does not guarantee benign behavior, and the domain remains classified as a generic phishing vector in the supplied intelligence. No public SSL certificate details, HTTP response codes, or page title information are available, limiting the ability to assess the site’s content or the specific credential‑ harvesting technique employed. The lack of publicly visible page title or brand targeting means that the specific victim profile cannot be inferred, and threat actors may be leveraging the domain as part of a broader credential‑stealing campaign. Defenders should continue to monitor DNS queries for the 185.27.134.57 address and enforce network‑level blocking of activar-bhd.zya.me.

Adding the domain to local deny lists, as well as to external threat‑intel feeds, is advisable. Because the registrar is Porkbun LLC, abuse‑reporting channels provided by that registrar should be used to request takedown or suspension. Continuous re‑scanning on VirusTotal or similar platforms is recommended to capture any future changes in detection status.