paycity[.]za-bzjw[.]cfd

paycity.za-bzjw.cfd is a subdomain of za-bzjw.cfd. PhishDestroy first observed the hostname on Sep 7, 2026. The captured page title is “Veuillez verifier que vous etes humain”. Current evidence score: 98/100 (critical).

Positive findings are stored from 3 sources: VirusTotal, Cloudflare Radar, and URLQuery. VirusTotal recorded 14 detections among 89 engines: alphaMountain.ai, CRDF, CyRadar, ESET, Emsisoft, Fortinet, G-Data, Gridinsoft, LevelBlue, Netcraft, Seclookup, SOCRadar, Sophos, Webroot on Sep 7, 2026 at 15:13 UTC. Cloudflare Radar classified the hostname as malicious and placed it in the phishing category; its verdict timestamp was not retained. URLQuery recorded 2 threat-system alerts on Sep 7, 2026 at 00:42 UTC. Non-positive and contextual checks: The separate external-blocklist snapshot contained no matches on Sep 7, 2026 at 14:20 UTC. Google Safe Browsing returned no flag on Sep 7, 2026 at 15:13 UTC. URLScan captured the page on Sep 7, 2026 at 00:36 UTC.

The collector marked the hostname reachable on Sep 7, 2026 at 00:36 UTC, but did not retain the HTTP response code. Registration records for the registrable domain za-bzjw.cfd list Dynadot Inc as the registrar and Sep 4, 2026 as the creation date. Registration preceded first observation by 2 days. At collection time, the hostname resolved to 172.67.178.223 on AS13335 (CLOUDFLARENET - Cloudflare, Inc., US). The IP and ASN identify shared Cloudflare edge infrastructure; the origin server is not established by this address. DOM analysis on Sep 7, 2026 at 02:22 UTC returned 98/100. The evidence archive retains 3 visual captures from PhishDestroy, URLScan, and URLQuery. TLS metadata lists Google Trust Services as the certificate issuer with validity through Dec 3, 2026; checked Sep 7, 2026 at 01:02 UTC.

The content indicators and 3 positive source findings support the current phishing classification. The stored fields do not identify an impersonated brand or victim interaction.