# PhishDestroy domain threat record: agenciaeletravel.com

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/agenciaeletravel.com/
Machine-readable companion: https://phishdestroy.io/domain/agenciaeletravel.com/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-09-21 09:49:54 UTC
- Last availability or vendor check: 2026-10-22 10:05:47 UTC
- Stored record updated: 2026-10-22 16:07:29 UTC
- VirusTotal detections in the stored snapshot: 16/89
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: instagram

## Stored infrastructure

- Observed IP address: 31.214.178.21
- Registrar in stored WHOIS data: DonDominio (SCIP)
- Last stored HTTP status: 200
- Registration date (registry RDAP, agenciaeletravel.com): 2023-05-22 11:36:02 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a0c368-0b10-70eb-bcaf-09793ee1d6c2/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/agenciaeletravel.com
- Certificate Transparency search: https://crt.sh/?q=%25.agenciaeletravel.com
- Web Archive lookup: https://web.archive.org/web/*/https://agenciaeletravel.com/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
agenciaeletravel.com is an impersonation phishing site whose name reads as a Spanish travel agency ("agencia" plus "travel"). It is built to borrow the trust of a legitimate business and catch people booking trips or paying for travel services. PhishDestroy first flagged it on 2026-09-21, and the site was still online with live content on 2026-10-19.

How the scam works
Impersonation pages copy the look, name or tone of a real company so visitors believe they are dealing with the genuine business. They then hand over login credentials, personal details, or payment for bookings that never exist. For a travel-themed lure, the usual losses are card numbers, deposits for fake reservations, and identity data such as passport or contact details. The page currently titles itself "Dominio no encontrado" (Spanish for "domain not found"), which differs from the impersonation classification we assigned.

Evidence
When VirusTotal checked the domain on 2026-09-22, 16 of 89 engines flagged it. That is a meaningful share for a site with a parked-looking title. The flagging vendors include BitDefender, Fortinet, Forcepoint ThreatSeeker, G-Data, alphaMountain.ai, ADMINUSLabs, CyRadar and the Vietnamese anti-scam group Chong Lua Dao. The domain also appears in 4 AlienVault OTX threat pulses, which means other researchers have tracked it independently. Among blocklists, it is currently listed by PhishDestroy.

Infrastructure
The domain was registered on 2023-05-22 through DonDominio (SCIP), more than three years before PhishDestroy detected it. An aged domain like this avoids the "newly registered" warnings that many filters apply. It resolves to 31.214.178.21 on the Soluciones Corporativas IP, SL network in Spain. That fits the Spanish-language page title and the travel-agency name it trades on.

What to do
If you booked or paid anything through this site, contact your bank or card issuer right away to dispute the charge and request a replacement card. Confirm any reservation directly with the real travel company through contact details you find yourself, not ones shown on this page. If you entered a password, change it everywhere you reused it and turn on two-factor authentication. Watch for follow-up emails or calls that cite your booking, since impersonation operators often reuse stolen details. Security teams should block the domain and its hosting IP at mail and web gateways and add it to phishing and brand-abuse watchlists.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a0c368-0b10-70eb-bcaf-09793ee1d6c2/
VirusTotal report: https://www.virustotal.com/gui/domain/agenciaeletravel.com
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=agenciaeletravel.com
Archived copy: https://web.archive.org/web/20260615075029/https://www.agenciaeletravel.com/
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 09:37:37 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/N21Tcr8y/80773b28ac8c.png
  Captured: 2026-09-21 10:01:06 UTC
- URLScan capture 1: https://screenshots.phishdestroy.io/01a0c368-0b10-70eb-bcaf-09793ee1d6c2.png
  Captured: 2026-09-21 10:01:06 UTC
  Source report: https://urlscan.io/result/01a0c368-0b10-70eb-bcaf-09793ee1d6c2/
- URLScan capture 2: https://urlscan.io/screenshots/01a071e0-9a1d-70dc-a45d-490d77809589.png
  Captured: 2026-09-21 09:49:54 UTC
  Source report: https://urlscan.io/result/01a0c368-0b10-70eb-bcaf-09793ee1d6c2/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/6a54bdfd-7454-4a86-a253-e1a5c8c721ab.png
  Captured: 2026-09-21 10:00:07 UTC
  Source report: https://radar.cloudflare.com/scan/6a54bdfd-7454-4a86-a253-e1a5c8c721ab
  SHA-256: 36d07495bcca5f3e48f8eca8aedf572633b1c8597772c12bfb5fcf7563770e66
- URLScan · 2026-09-05: https://screenshots.phishdestroy.io/us/01a071e0-9a1d-70dc-a45d-490d77809589.png
  Captured: 2026-09-05 14:02:26 UTC
  Source report: https://urlscan.io/result/01a071e0-9a1d-70dc-a45d-490d77809589/
  SHA-256: 26c3083b7c2dc6e31a4f02d697f2dfef3f630cc360c5c2f7d66fbd12015a4ea7
- URLScan · 2026-09-21: https://screenshots.phishdestroy.io/us/01a0c369-9eb1-723d-8e56-0de05e0eb27f.png
  Captured: 2026-09-21 10:01:21 UTC
  Source report: https://urlscan.io/result/01a0c369-9eb1-723d-8e56-0de05e0eb27f/
  SHA-256: 26c3083b7c2dc6e31a4f02d697f2dfef3f630cc360c5c2f7d66fbd12015a4ea7

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-20T22:21:21Z",
        "uuid": "01a0c368-0b10-70eb-bcaf-09793ee1d6c2",
        "scanned_at": "2026-09-21T09:59:41Z",
        "final_url": "https://www.agenciaeletravel.com/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://www.agenciaeletravel.com/",
                "from": "http://www.agenciaeletravel.com/",
                "status": 307
            }
        ],
        "ip": "31.214.178.21",
        "ptr": "hostingsrv105.dondominio.com",
        "domains": [
            "fonts.gstatic.com",
            "fonts.googleapis.com"
        ],
        "ips": [
            "173.194.114.94",
            "172.217.197.95",
            "31.214.178.21"
        ],
        "asns": [
            "15169",
            "57910"
        ],
        "countries": [
            "US",
            "ES"
        ],
        "link_domains": [
            "wa.me",
            "www.instagram.com"
        ],
        "social": [
            "https://wa.me/34623992566",
            "https://www.instagram.com/agenciaeletravel"
        ],
        "doc_hash": "49edafd9401951670d85867b2c7e9ff0c91bbdb9cfa962e17a8ece0efa662349",
        "script_hashes": [
            "cb6f2d32c49d1c2b25e9ffc9aaafa3f83075346c01bcd4ae6eb187392a4292cf",
            "5274f11e6fb32ae0cf2dfb9f8043272865c397a7c4223b4cfa7d50ea52fbde89",
            "0b8ffaa7c45831d22e7f5fbafbf6f9492625eff743a65e28f6aacffa41b3273b",
            "ac59be8a212c4120fdedc435d80b41d978a0097a48879a149583752d9f613135",
            "98f1fdaa85bdfd64c2b39823c66d8d5618cc5b606c0a61e6968fa54ea571f7b5",
            "83eda8e5540512ca57e2216df1c90dd4bb2cb49f3f58188345de9582855648e0",
            "99aaf7045a5c801db73f65f4108f8ef0893178c0fb726b70d986641845588ec1",
            "fc774906082b59dedcfc55b8ef127783b6d056578ff4586a8ebbdb81bbe286f1",
            "5083905862c2b7aa8a84c4f2313d359d2288fb25fbe1ff577fa7325eff2ed2d9",
            "1110d342a7031617a862f62bca8765ab7d2251db6b9e8541e7aa599d6c93cf69"
        ],
        "globals": [
            "gform",
            "jQuery",
            "gf_global",
            "gform_i18n",
            "gf_legacy_multi",
            "gform_gravityforms",
            "astra",
            "astraGetParents",
            "astraToggleClass",
            "astraTriggerEvent",
            "astraSmoothScroll",
            "astScrollToTopHandler",
            "popupTriggerClick",
            "AstraToggleSubMenu",
            "AstraToggleSetup",
            "astraNavMenuToggle",
            "wp",
            "gform_theme_config",
            "gformBindFormatPricingFields",
            "Currency",
            "gformCleanNumber",
            "gformGetDecimalSeparator",
            "gformIsNumber",
            "gformIsNumeric",
            "gformDeleteUploadedFile",
            "_gformPriceFields",
            "gformIsHidden",
            "gformCalculateTotalPrice",
            "gformUpdateTotalFieldPrice",
            "gformGetShippingPrice",
            "gformGetFieldId",
            "gformCalculateProductPrice",
            "gformGetProductQuantity",
            "gformIsProductSelected",
            "gformGetBasePrice",
            "gformParseChoiceValue",
            "gformFormatMoney",
            "gformFormatPricingField",
            "gformToNumber",
            "gformGetPriceDifference"
        ],
        "storage_keys": [
            "wpEmojiSettingsSupports"
        ],
        "tls": {
            "san": [
                "agenciaeletravel.com",
                "www.agenciaeletravel.com"
            ],
            "cipher": "AES_256_GCM",
            "issuer": "Don Dominio RSA DV SSL CA 2",
            "subject": "agenciaeletravel.com",
            "protocol": "TLS 1.3",
            "valid_to": "2026-12-06T23:59:59Z",
            "valid_from": "2026-05-22T00:00:00Z"
        },
        "domain_age_days": 1217,
        "apex_age_days": 1217,
        "tls_age_days": 122,
        "tls_valid_days": 198,
        "requests": 30,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": -29,
                "malicious": false
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "Apache",
            "content-type": "text/html; charset=UTF-8",
            "strict-transport-security": "max-age=31536000"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-20T22:29:47Z",
        "uuid": "6a54bdfd-7454-4a86-a253-e1a5c8c721ab",
        "scanned_at": "2026-09-21T10:00:07Z",
        "final_url": "https://agenciaeletravel.com/",
        "history": [
            {
                "url": "https://agenciaeletravel.com/",
                "status": 0
            }
        ],
        "domain_risks": [
            "Malware",
            "Security threats",
            "CIPA Filter",
            "CIPA"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "agenciaeletravel.com",
                "type": "A",
                "value": "31.214.178.21"
            }
        ],
        "dnssec_valid": false,
        "verdict": {
            "tags": [
                "malware"
            ],
            "malicious": true,
            "categories": [
                "malware"
            ]
        },
        "whois": {
            "registrar": "Soluciones Corporativas IP, SL",
            "created": "2023-05-22T11:36:02Z",
            "updated": "2026-05-22T08:10:57Z",
            "expires": "2027-05-22T11:36:02Z",
            "nameservers": [
                "ns1.dondominio.com",
                "ns2.dondominio.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-22T00:28:21Z",
        "analysis_at": "2026-10-13T16:11:42Z",
        "stats": {
            "timeout": 0,
            "harmless": 43,
            "malicious": 17,
            "suspicious": 1,
            "undetected": 31
        },
        "detections": {
            "DNS8": "suspicious",
            "VIPRE": "phishing",
            "G-Data": "phishing",
            "Lionic": "phishing",
            "Sophos": "phishing",
            "CyRadar": "phishing",
            "Webroot": "malicious",
            "Fortinet": "phishing",
            "SOCRadar": "phishing",
            "URLQuery": "malicious",
            "Kaspersky": "phishing",
            "Seclookup": "malicious",
            "Gridinsoft": "phishing",
            "ADMINUSLabs": "malicious",
            "BitDefender": "phishing",
            "Chong Lua Dao": "malicious",
            "alphaMountain.ai": "phishing",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "categories": {
            "alphaMountain.ai": "Phishing (alphaMountain.ai)"
        },
        "registrar": "DonDominio (SCIP)",
        "created": "2023-05-22T11:36:02Z",
        "expires": "2027-05-22T11:36:02Z",
        "updated": "2026-05-22T10:10:57Z",
        "first_seen": "2024-01-06T01:05:01Z",
        "dns": [
            {
                "ttl": 60,
                "type": "SOA",
                "rname": "dnsadmin.dondominio.com",
                "value": "ns1.dondominio.com"
            },
            {
                "ttl": 60,
                "type": "A",
                "value": "31.214.178.21"
            },
            {
                "ttl": 60,
                "type": "NS",
                "value": "ns2.dondominio.com"
            },
            {
                "ttl": 60,
                "type": "MX",
                "value": "mx01.dondominio.com",
                "priority": 10
            },
            {
                "ttl": 60,
                "type": "TXT",
                "value": "v=spf1 include:spf.dondominio.com"
            },
            {
                "ttl": 60,
                "type": "NS",
                "value": "ns1.dondominio.com"
            }
        ],
        "dns_at": "2026-10-13T16:17:01Z",
        "jarm": "2ad2ad16d2ad2ad00042d42d000000a0d14c559c674ff8857d4e511e7563d1",
        "cert": {
            "san": [
                "*.dondominio.com",
                "dondominio.com"
            ],
            "issuer": "Sectigo Limited / Sectigo Public Server Authentication CA DV R36",
            "serial": "89bec46e91a9dc240c8cdda99869cb0f",
            "sha256": "ae8ca6a31516c82365f71aa45dae57876b120e99b3b0f48781c7192ef4a8c585",
            "subject": "*.dondominio.com",
            "valid_to": "2027-02-21T23:59:59Z",
            "valid_from": "2026-01-22T00:00:00Z"
        },
        "whois": {
            "registrar": "DonDominio (SCIP)",
            "registrar_iana_id": "1383",
            "registrar_url": "http://www.dondominio.com",
            "created": "2023-05-22T11:36:02Z",
            "updated": "2026-05-22T08:10:57Z",
            "expires": "2027-05-22T11:36:02Z",
            "status": [
                "ok"
            ],
            "nameservers": [
                "ns1.dondominio.com",
                "ns2.dondominio.com"
            ],
            "dnssec": "Unsigned"
        },
        "rdap": {
            "status": [
                "active"
            ],
            "events": {
                "expiration": "2027-05-22T11:36:02Z",
                "last changed": "2026-05-22T08:10:57Z",
                "registration": "2023-05-22T11:36:02Z",
                "last update of RDAP database": "2026-10-13T16:16:53Z"
            }
        }
    }
}
```