billing-update-account.com is an impersonation phishing site whose name is built to pass as a routine account billing notice. It targets people who receive "update your billing" messages and expect a familiar login or payment page. PhishDestroy first saw it on 2026-09-27. As of 2026-10-19 the site was still online, with its content reachable through a redirect. The page title reads "Plesk Obsidian 18.0.77", the name of a web hosting control panel, while we classify the domain as an impersonation phishing page.
How the scam works
Billing-update lures follow a set script. A message warns that a payment failed or an account will be suspended, then links to a page that copies a trusted service's sign-in or payment form. Whatever the victim types, usually a username, password and card details, goes straight to the operators. Stolen logins are used to take over the account or are resold, and card data is used for fraudulent charges.
Evidence
On 2026-10-07, 17 of 92 VirusTotal engines flagged the domain. That is a meaningful minority for a site only weeks old. The vendors include BitDefender, ESET, Fortinet, Forcepoint ThreatSeeker, alphaMountain.ai, Criminal IP, CRDF and CyRadar. Spamhaus lists it in its domain blocklist under the phishing category (DBL_PHISH). It also appears in three AlienVault OTX threat pulses, so other researchers have tracked it independently.
Infrastructure
The domain was registered on 2026-09-24 through Hosting Concepts B.V. (Registrar.eu), just three days before PhishDestroy detected it. That short gap is typical of throwaway phishing domains set up for a single campaign. It resolves to 180.178.180.53 on the SLAYER GROUP LIMITED network, which is registered in Great Britain, with the address located in Pakistan. Its Let's Encrypt (R13) certificate gives the site a browser padlock, but the padlock only means the connection is encrypted and does not show who runs the site.
What to do
If you entered a password on this site, change it at once on the real service and on any other account that uses the same password. Then turn on two-factor authentication and review recent logins. If you entered card or bank details, call your card issuer to block the card and dispute any unfamiliar charges. In future, go to billing pages by typing the service's address yourself, never through a link in a message. Defenders should block the domain and 180.178.180.53, search mail logs for messages linking to it, and reset credentials for any user who clicked through.
登録情報作成日 2026年9月24日 (25d · Very New!)—Expires 2027年9月24日
HTTPステータス303 Redirect
技術詳細Provenance & timestamps
初確認2026年9月27日
DOM Analysisanalyzed 2026年10月9日score 100/100
Submitted URLhttp://billing-update-account.com/
Favicon Hash
Observed page title
Plesk Obsidian 18.0.77
TLS証明書
発行者 Let's Encrypt / R13
Network & certificates
Stored technical evidence
Network & DNS
Resolved IP
180.178.180.53
Network ASN
AS213441
Organization
SLAYER-AS SLAYER GROUP LIMITED, GB
Observed location
PK
Server header
nginx
ネームサーバー 1
ns3.openprovider.eu
Location describes the IP network.
TLS証明書
Issuer
Let's Encrypt / R13
Valid from
2026-01-12 14:30:54
Valid until
2026-04-12 14:30:53
Hostname coverage
Certificate hostname mismatch
Validity
Stored certificate expired
Collection time
2026-10-09 13:03:37 UTC
Collection source
PhishDestroy collector
Certificate fingerprintf224a96013213d586bd908561a2c32c70abee24970819e3efb1c585241e97fbfCertificate names · 1 SANs
vigilant-kare.223-29-226-66.plesk.page
Saved certificate metadata. Certificate dates without a timezone are shown as stored. Transport encryption does not establish that the site is trustworthy.
Latest HTTP observationRedirectingHTTP redirect observed80%2026-10-20 10:06:34 UTC
RDAP registration不明
Observed timelinelast reachable: 2026-10-20 10:06:34 UTC
Availability, content, DNS and registration are independent evidence layers. NXDOMAIN, an unreachable origin or missing content alone does not prove registrar action. A registrar or provider is credited only when a direct technical marker identifies that actor. Report causality is shown separately.
脅威情報の照合 · source references
ScamAdviserPublic lookup
A public ScamAdviser lookup is available. Review its current score and warnings at the source; the existence of a lookup page is not itself a malicious verdict.
Keep original emails, receipts, messages and screenshots in a secure place. A factual timeline helps the receiving authority understand what happened. IC3 evidence guidance ↗
Payment records — if you paid, save the receipt, amount, date, payment provider and recipient details.
Your bank or payment provider — contact its fraud team promptly through official contact details if money or card information was exposed.
地元の警察 — たとえ直ちに行動を起こせなくても、公式な記録が残される
A report is not a guarantee of recovery or investigation, but prompt, accurate transaction data can help authorities and service providers trace the incident.
詐欺による金銭の返還を装った詐欺 — fraudsters pose as recovery agents and demand upfront fees. Never share a seed phrase or pay before independently verifying the provider
About this reportSources, observation dates and corrections
This report combines saved page captures, registration and network records, scanner results and PhishDestroy reporting history. Each source keeps its own observation date. Open a source report to inspect the original result.
The AI-assisted analysis was written on . It describes the evidence available at that time; later source checks can change.
A capture documents what was shown. A scanner result records that provider’s assessment at the time of its check. Neither a valid certificate nor a zero-detection result is a guarantee of safety.
(NL)
