# PhishDestroy domain threat record: agenciadlx.com.br Content language: English Canonical HTML report: https://phishdestroy.io/domain/agenciadlx.com.br/ Machine-readable companion: https://phishdestroy.io/domain/agenciadlx.com.br/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-10-04 03:47:58 UTC - Last availability or vendor check: 2026-10-22 10:37:30 UTC - Stored record updated: 2026-10-22 16:07:29 UTC - VirusTotal detections in the stored snapshot: 17/91 - Independent public blocklist matches in the stored snapshot: 1 - Matching public blocklists: Phishunt - Google Safe Browsing stored result: no stored flag ## Stored infrastructure - Observed IP address: 162.240.37.223 - Registrar in stored WHOIS data: REGISTRAR_NOT_FOUND - Registrar country in stored WHOIS data: BR - Last stored HTTP status: 302 - Registration date (registry RDAP, agenciadlx.com.br): 2020-09-17 22:27:35 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a1050a-6d2f-73cd-9ba9-1f48988ab909/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/agenciadlx.com.br - Certificate Transparency search: https://crt.sh/?q=%25.agenciadlx.com.br - Web Archive lookup: https://web.archive.org/web/*/https://agenciadlx.com.br/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview agenciadlx.com.br is an impersonation phishing page titled "Mail Verification" that poses as a generic email provider's login check. It targets anyone with a mailbox, not one specific brand's customers. PhishDestroy first flagged it on 2026-10-04. As of 2026-10-19 the site was still alive and its content was reachable through a redirect. How the scam works Victims usually arrive from an email warning that their mailbox must be verified, will be suspended, or has undelivered messages. The "Mail Verification" page then asks for an email address and password, which go straight to the attacker. A stolen mailbox is valuable because it can reset passwords for exchanges, wallets, banking and cloud accounts. It can also send convincing phishing to the victim's contacts. Evidence 17 of 91 VirusTotal engines flagged the domain at the 2026-10-06 check. Those engines include BitDefender, ESET, Emsisoft, Forcepoint ThreatSeeker, Criminal IP, alphaMountain.ai, CyRadar and Chong Lua Dao. urlscan.io returned a malicious verdict and recognised generic email branding on the page. Spamhaus lists the domain in its DBL as abused for phishing. Phishunt and PhishFeed carry it alongside PhishDestroy, and 50 AlienVault OTX pulses reference it, which shows wide circulation among threat-intel teams. Infrastructure The domain was registered on 2020-09-17, roughly six years before it surfaced as a phishing page, so it was not freshly created for this campaign. It resolves to 162.240.37.223 on Unified Layer's network in the United States, a large shared-hosting provider. The free certificate only means the padlock in the browser says nothing about whether the page is legitimate. What to do If you typed your email password on this page, change it immediately from your provider's real site or app. Then change it on every other account that used the same password, starting with exchanges, wallets and banking. Turn on app-based or hardware two-factor authentication and sign out all other sessions. Check your mailbox for new forwarding rules, filters or recovery addresses the attacker may have added. Defenders should block the domain and its IP at mail gateways and DNS, search mail logs for messages linking to it, and reset credentials for any users who clicked. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a1050a-6d2f-73cd-9ba9-1f48988ab909/ VirusTotal report: https://www.virustotal.com/gui/domain/agenciadlx.com.br Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=agenciadlx.com.br Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-19 09:31:27 UTC ## Stored page captures - Primary capture: https://i.ibb.co/23qn9H8c/f14dce2aba68.png Captured: 2026-10-04 03:52:53 UTC - URLScan capture 1: https://screenshots.phishdestroy.io/01a1050a-6d2f-73cd-9ba9-1f48988ab909.png Captured: 2026-10-04 03:52:53 UTC Source report: https://urlscan.io/result/01a1050a-6d2f-73cd-9ba9-1f48988ab909/ - URLScan capture 2: https://urlscan.io/screenshots/01a10473-5646-7524-9e2b-96348dd6f5a3.png Captured: 2026-10-04 03:47:58 UTC Source report: https://urlscan.io/result/01a1050a-6d2f-73cd-9ba9-1f48988ab909/ - URLScan · 2026-08-06: https://screenshots.phishdestroy.io/us/019fd85f-72a8-718f-8a04-773db070da99.png Captured: 2026-08-06 18:39:32 UTC Source report: https://urlscan.io/result/019fd85f-72a8-718f-8a04-773db070da99/ SHA-256: e9ac2784db3fd6980a75feff8ab6aebed7230406e8a7f449a09e88c0814a228b - URLScan · 2026-09-08: https://screenshots.phishdestroy.io/us/01a07f67-11ce-7548-b6fb-fc22b089e081.png Captured: 2026-09-08 05:04:25 UTC Source report: https://urlscan.io/result/01a07f67-11ce-7548-b6fb-fc22b089e081/ SHA-256: 161bc5f4089471e274feb57ea073d97cc5c05a47833469cd1a2badf5d19a820a - URLScan · 2026-10-08: https://screenshots.phishdestroy.io/us/01a11995-71fa-748a-99f1-60acc900aa8a.png Captured: 2026-10-08 03:36:36 UTC Source report: https://urlscan.io/result/01a11995-71fa-748a-99f1-60acc900aa8a/ SHA-256: 085087b0e4fbba709ca6863f640d4976a1d33106c27472cfdcba68c6fc28f751 - URLScan · 2026-10-13: https://screenshots.phishdestroy.io/us/01a132b8-b7a6-74f9-b39a-8e294f44a59e.png Captured: 2026-10-13 00:45:38 UTC Source report: https://urlscan.io/result/01a132b8-b7a6-74f9-b39a-8e294f44a59e/ SHA-256: dce66d809c3a5fdbba027b4dc042be9bdc7fccf81fadaefc2498775695eb727c - URLScan · 2026-10-16: https://screenshots.phishdestroy.io/us/01a1423d-5b83-7343-a6cd-edd1a32c6798.png Captured: 2026-10-16 01:04:46 UTC Source report: https://urlscan.io/result/01a1423d-5b83-7343-a6cd-edd1a32c6798/ SHA-256: 6a82e019e8d76913f0dd7ba1015259de8604c5b5c93360f255115c49a7f8968c - URLScan · 2026-10-21: https://screenshots.phishdestroy.io/us/01a15c37-e05a-7341-8515-8aa19789fecf.png Captured: 2026-10-21 02:08:55 UTC Source report: https://urlscan.io/result/01a15c37-e05a-7341-8515-8aa19789fecf/ SHA-256: 3d4fcb7cca7485b53498441fbeaea3a27399da5fc7afe19a8cddee73a7dc6a08 ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-20T19:33:28Z", "uuid": "01a1050a-6d2f-73cd-9ba9-1f48988ab909", "scanned_at": "2026-10-04T03:52:17Z", "final_url": "https://agenciadlx.com.br/930/pui/boxMrenewal.php", "status": 200, "redirected": "same-domain", "redirects": [ { "to": "https://agenciadlx.com.br/930/pui/index.php", "from": "http://agenciadlx.com.br/930/pui/index.php", "status": 307 }, { "to": "https://agenciadlx.com.br/930/pui/boxMrenewal.php", "from": "https://agenciadlx.com.br/930/pui/index.php", "status": 302 } ], "ip": "162.240.37.223", "ptr": "vps-7818080.upspro.com.br", "domains": [ "petstop.com.sg" ], "ips": [ "162.240.37.223" ], "asns": [ "46606" ], "countries": [ "US" ], "doc_hash": "07e8a04692d80e3021cb088783dd0dd91bd0745b14b5e092f295da19fa743062", "tls": { "san": [ "*.agenciadlx.com.br", "agenciadlx.com.br" ], "cipher": "AES_128_GCM", "issuer": "YR2", "subject": "*.agenciadlx.com.br", "protocol": "TLS 1.2", "valid_to": "2026-11-25T00:18:43Z", "valid_from": "2026-08-27T00:18:44Z" }, "domain_age_days": 2126, "apex_age_days": 2126, "tls_age_days": 38, "tls_valid_days": 89, "requests": 4, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 80, "malicious": true }, "overall": { "tags": [ "phishing" ], "score": 100, "brands": [ "genericemail" ], "malicious": true, "categories": [ "phishing" ] }, "urlscan": { "tags": [ "phishing" ], "score": 100, "brands": [ "Generic Email" ], "malicious": true, "categories": [ "phishing" ] } }, "headers": { "server": "Apache", "content-type": "text/html; charset=UTF-8" } }, "vt": { "v": 1, "fetched_at": "2026-10-21T13:18:13Z", "analysis_at": "2026-10-19T13:23:25Z", "stats": { "timeout": 0, "harmless": 45, "malicious": 15, "suspicious": 2, "undetected": 30 }, "detections": { "DNS8": "phishing", "ESET": "phishing", "VIPRE": "malware", "G-Data": "phishing", "Lionic": "malicious", "Sophos": "phishing", "CyRadar": "phishing", "Webroot": "malicious", "Emsisoft": "phishing", "Fortinet": "phishing", "SOCRadar": "phishing", "URLQuery": "suspicious", "Gridinsoft": "phishing", "SafeToOpen": "phishing", "BitDefender": "phishing", "alphaMountain.ai": "phishing", "Forcepoint ThreatSeeker": "suspicious" }, "reputation": 0, "expires": "2028-09-17T00:00:00Z", "first_seen": "2024-03-05T21:12:23Z", "dns": [ { "ttl": 14400, "type": "TXT", "value": "v=spf1 ip4:162.240.37.223 +a +mx ~all" }, { "ttl": 21600, "type": "NS", "value": "ns2.upspro.com.br" }, { "ttl": 21600, "type": "NS", "value": "ns1.upspro.com.br" }, { "ttl": 1721, "type": "SOA", "rname": "root.vps-7818080.upspro.com.br", "value": "ns1.upspro.com.br" }, { "ttl": 14400, "type": "MX", "value": "mail.agenciadlx.com.br", "priority": 0 }, { "ttl": 4440, "type": "A", "value": "162.240.37.223" } ], "dns_at": "2026-10-19T13:23:41Z", "jarm": "15d3fd16d29d29d00015d3fd15d29dd7d473c13818c4075312b20b785cad90", "cert": { "san": [ "*.agenciadlx.com.br", "agenciadlx.com.br" ], "issuer": "Let's Encrypt / YR2", "serial": "56e01c4dbb43acd622b4baa1c8f856ecc4c", "sha256": "8d39273516598f63b82ac06d40225da31a37e478793e6f5466ff9af3997cd1e0", "subject": "*.agenciadlx.com.br", "valid_to": "2026-11-25T00:18:43Z", "valid_from": "2026-08-27T00:18:44Z" } } } ```