# PhishDestroy domain threat record: app.duxavian.online Content language: English Canonical HTML report: https://phishdestroy.io/domain/app.duxavian.online/ Machine-readable companion: https://phishdestroy.io/domain/app.duxavian.online/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-10-21 20:49:44 UTC - Last availability or vendor check: 2026-10-22 10:49:32 UTC - Stored record updated: 2026-10-22 16:07:29 UTC - VirusTotal detections in the stored snapshot: 13/92 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: no stored flag ## Stored infrastructure - Observed IP address: 66.94.97.22 - Registrar in stored WHOIS data: NAMECHEAP INC - Registrar country in stored WHOIS data: US - Last stored HTTP status: 200 - Registration date (registry RDAP, duxavian.online): 2023-12-11 18:25:03 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a16038-4613-72ae-b366-b8acd501e283/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/app.duxavian.online - Certificate Transparency search: https://crt.sh/?q=%25.app.duxavian.online - Web Archive lookup: https://web.archive.org/web/*/https://app.duxavian.online/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview PhishDestroy listed app.duxavian.online on 2026-10-21 after its intake flagged the domain because VirusTotal reported 13 malicious detections. The page presents the title "DuxAvian" and returned HTTP 200 on the same date. The title does not indicate the phishing risk that triggered the listing. How the scam works The detections point to a generic phishing risk, meaning the site could be used to trick users into revealing credentials or personal data. No concrete phishing page or credential‑harvesting form was observed in the captured content, so the exact method remains undefined beyond the typical lure of deceptive branding. Evidence VirusTotal (analysis 2026-10-20) recorded 13 malicious votes from 92 engines, including BitDefender, ESET, Fortinet and others. Google Safe Browsing (checked 2026-10-21) did not flag the URL. Cloudflare Radar (2026-10-21) classified the domain as malicious with a phishing tag. urlscan.io (captured 2026-10-21) gave a malicious engine score of 58. OTX reported zero pulses. No external blocklists listed the domain, but PhishDestroy’s internal list marked it as suspicious. Infrastructure The domain resolved to 66.94.97.22, hosted by Contabo Inc. in the United States. TLS was provided by Let’s Encrypt, valid from 2026-09-01 to 2026-11-30, and the certificate lists several sub‑domains under duxavian.online. The site used Apache HTTP Server and Cloudflare DNS. Domain registration is over 1,000 days old. What to do Do not enter login credentials, private keys or personal information on this site. If credentials were submitted, change them immediately and enable multi‑factor authentication where possible. Network defenders should block app.duxavian.online at the firewall or proxy and monitor traffic for any attempts to contact the recorded IP address. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a16038-4613-72ae-b366-b8acd501e283/ Cloudflare Radar report: https://radar.cloudflare.com/scan/a32ef009-df46-4cea-9830-f98bd0783de7 URLQuery report: https://urlquery.net/report/1fd8389b-6094-42e1-aa47-42c29eb6c921 Stored capture screenshot: https://urlscan.io/screenshots/01a16038-4613-72ae-b366-b8acd501e283.png Cloudflare Radar screenshot (2026-10-21T21:24:06Z): https://screenshots.phishdestroy.io/cf/a32ef009-df46-4cea-9830-f98bd0783de7.png URLQuery screenshot: https://screenshots.phishdestroy.io/uq/1fd8389b-6094-42e1-aa47-42c29eb6c921.png URLScan screenshot (2026-10-21T20:49:39Z): https://screenshots.phishdestroy.io/us/01a16039-ea1b-712f-9f32-6f9fb5078ac0.png URLScan capture report: https://urlscan.io/result/01a16039-ea1b-712f-9f32-6f9fb5078ac0/ VirusTotal report: https://www.virustotal.com/gui/domain/app.duxavian.online Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=app.duxavian.online Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-21 21:25:54 UTC ## Stored page captures - Primary capture: https://urlscan.io/screenshots/01a16038-4613-72ae-b366-b8acd501e283.png Captured: 2026-10-21 20:49:44 UTC - URLScan capture: https://screenshots.phishdestroy.io/01a16038-4613-72ae-b366-b8acd501e283.png Captured: 2026-10-21 20:49:44 UTC Source report: https://urlscan.io/result/01a16038-4613-72ae-b366-b8acd501e283/ - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/a32ef009-df46-4cea-9830-f98bd0783de7.png Captured: 2026-10-21 21:24:06 UTC Source report: https://radar.cloudflare.com/scan/a32ef009-df46-4cea-9830-f98bd0783de7 SHA-256: bf6328d15109d7a99a9f69ecc573e3ef5c0b32166923d4feb5e20740b60dd459 - URLQuery: https://screenshots.phishdestroy.io/uq/1fd8389b-6094-42e1-aa47-42c29eb6c921.png Source report: https://urlquery.net/report/1fd8389b-6094-42e1-aa47-42c29eb6c921 SHA-256: 476a283ba86a6dea89f2d32b7cac2bb729348d82b966122a4fbf80f710465d05 - URLScan · 2026-10-21: https://screenshots.phishdestroy.io/us/01a16039-ea1b-712f-9f32-6f9fb5078ac0.png Captured: 2026-10-21 20:49:39 UTC Source report: https://urlscan.io/result/01a16039-ea1b-712f-9f32-6f9fb5078ac0/ SHA-256: 4471dae926e284362a033002257217f792e509c8206fc24631d7ea9c5a71032b ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-21T21:16:19Z", "uuid": "01a16038-4613-72ae-b366-b8acd501e283", "scanned_at": "2026-10-21T20:47:58Z", "final_url": "https://app.duxavian.online/", "status": 200, "redirected": "https-only", "redirects": [ { "to": "https://app.duxavian.online/", "from": "http://app.duxavian.online/", "status": 307 } ], "ip": "66.94.97.22", "ptr": "vmi3273097.contaboserver.net", "domains": [ "fonts.gstatic.com" ], "ips": [ "142.251.45.195", "66.94.97.22" ], "asns": [ "15169", "40021" ], "countries": [ "US" ], "doc_hash": "bea45babe80306ae934f05118b85b14f8473c2ab3657d49dcb0675f2196c28dc", "script_hashes": [ "dc729fc986559a26e822a50bc3b90125a08456af454c252c54a1fb3532cdb90e", "89dc97a765fbc9bff6482a7ee72bc468a45946661e4a8a2fc53d6f278a1572f0", "f1b639b89ac4e9a6f97211e1cf42dc3ee57d47d44d04f4a147dfd4206c09418d", "ef7f91be21ee8fed8c41f993b4415ea149a0bdd701096275c2068219970f01ab", "abdfbf8908818ecc50914f4e9b01fedb2b58f334438bf7fa2ee11b4bbc907b91", "f1f308d97367a000859e95efec09bf3317eb4807d7e654719f0cd76b502d3149", "4016f8e72fda98e9216f9db6c60dbbe37fd20cbf9c1b008125205997cc26ee34", "493033c5fd7e2ac4855f9a59ee1728c8184ad1d9e4e3ef88f7a729118a9cf34c", "7eda7494308f4a0de6c4013714906e4b6712caeddd4749111972136d2748f0fe", "289a75f7796fd5d6c814e4dda4dcf66fdcc142804acaca84c8e0530a7fc407c5" ], "globals": [ "webpackChunkapp", "__Zone_disable_customElements", "Zone", "__zone_symbol__Promise", "__zone_symbol__fetch", "__zone_symbol__setTimeout", "__zone_symbol__clearTimeout", "__zone_symbol__setInterval", "__zone_symbol__clearInterval", "__zone_symbol__requestAnimationFrame", "__zone_symbol__cancelAnimationFrame", "__zone_symbol__webkitRequestAnimationFrame", "__zone_symbol__webkitCancelAnimationFrame", "__zone_symbol__alert", "__zone_symbol__prompt", "__zone_symbol__confirm", "__zone_symbol__MutationObserver", "__zone_symbol__WebKitMutationObserver", "__zone_symbol__IntersectionObserver", "__zone_symbol__FileReader", "__zone_symbol__ononpagerevealpatched", "__zone_symbol__ononsearchpatched", "__zone_symbol__ononappinstalledpatched", "__zone_symbol__ononbeforeinstallpromptpatched", "__zone_symbol__ononabortpatched", "__zone_symbol__ononbeforeinputpatched", "__zone_symbol__ononbeforematchpatched", "__zone_symbol__ononbeforetogglepatched", "__zone_symbol__ononblurpatched", "__zone_symbol__ononcancelpatched", "__zone_symbol__ononcanplaypatched", "__zone_symbol__ononcanplaythroughpatched", "__zone_symbol__ononchangepatched", "__zone_symbol__ononclickpatched", "__zone_symbol__ononclosepatched", "__zone_symbol__ononcommandpatched", "__zone_symbol__ononcontentvisibilityautostatechangepatched", "__zone_symbol__ononcontextlostpatched", "__zone_symbol__ononcontextmenupatched", "__zone_symbol__ononcontextrestoredpatched" ], "tls": { "san": [ "apis-app.duxavian.online", "app.duxavian.online", "back2.duxavian.online", "back3.duxavian.online", "duxavian.online", "web.duxavian.online" ], "cipher": "AES_128_GCM", "issuer": "YR1", "subject": "apis-app.duxavian.online", "protocol": "TLS 1.3", "valid_to": "2026-11-30T02:06:55Z", "valid_from": "2026-09-01T02:06:56Z" }, "domain_age_days": 1040, "apex_age_days": 1044, "tls_age_days": 50, "tls_valid_days": 89, "requests": 61, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 58, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "Apache", "content-type": "text/html" } }, "cf": { "v": 1, "fetched_at": "2026-10-21T21:25:11Z", "uuid": "a32ef009-df46-4cea-9830-f98bd0783de7", "scanned_at": "2026-10-21T21:24:06Z", "final_url": "https://app.duxavian.online/", "status": 200, "history": [ { "url": "https://app.duxavian.online/", "status": 200 } ], "dom_hash": "b001261ecbfdf83d9808dc457f95d99911b8f3d092800a4951ad5444f6214a12", "doc_hash": "bea45babe80306ae934f05118b85b14f8473c2ab3657d49dcb0675f2196c28dc", "domain_risks": [ "Phishing", "Security threats", "CIPA Filter", "CIPA" ], "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "app.duxavian.online", "type": "A", "value": "66.94.97.22" } ], "dnssec_valid": false, "ip": "66.94.97.22", "verdict": { "tags": [ "phishing" ], "malicious": true, "categories": [ "phishing" ] }, "whois": { "registrar": "NameCheap, Inc.", "created": "2023-12-11T18:25:03Z", "updated": "2026-02-01T10:05:32Z", "expires": "2026-12-11T23:59:59Z", "nameservers": [ "ian.ns.cloudflare.com", "norah.ns.cloudflare.com" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-21T21:23:32Z", "analysis_at": "2026-10-20T00:13:16Z", "stats": { "timeout": 0, "harmless": 44, "malicious": 13, "suspicious": 0, "undetected": 35 }, "detections": { "ESET": "phishing", "VIPRE": "malware", "G-Data": "phishing", "Lionic": "phishing", "Sophos": "phishing", "CyRadar": "phishing", "Webroot": "malicious", "Fortinet": "phishing", "Kaspersky": "phishing", "Gridinsoft": "phishing", "BitDefender": "phishing", "Chong Lua Dao": "malicious", "Forcepoint ThreatSeeker": "phishing" }, "reputation": 0, "categories": { "Sophos": "phishing and fraud", "Webroot": "Phishing and Other Frauds", "Forcepoint ThreatSeeker": "phishing and other frauds" }, "registrar": "NameCheap, Inc.", "created": "2023-12-11T18:25:03Z", "expires": "2026-12-11T23:59:59Z", "updated": "2026-02-01T10:05:32Z", "first_seen": "2024-06-08T05:56:11Z", "dns": [ { "ttl": 300, "type": "A", "value": "66.94.97.22" } ], "dns_at": "2026-10-20T00:13:31Z", "jarm": "15d3fd16d29d29d00042d43d0000001ae0802418786940cae38f1d9eed5b9b", "cert": { "san": [ "apis-app.duxavian.online", "app.duxavian.online", "back2.duxavian.online", "back3.duxavian.online", "duxavian.online", "web.duxavian.online" ], "issuer": "Let's Encrypt / YR1", "serial": "5cb911cb5de378999654bb13ba010ff34b2", "sha256": "e7afe22822e63ecd4327397476d341222f4416a3cec2d861600491eb0467daaa", "subject": "apis-app.duxavian.online", "valid_to": "2026-11-30T02:06:55Z", "valid_from": "2026-09-01T02:06:56Z" }, "whois": { "registrar": "NameCheap, Inc.", "registrar_iana_id": "1068", "registrar_url": "https://www.namecheap.com/", "created": "2023-12-11T18:25:03Z", "updated": "2026-02-01T10:05:32Z", "expires": "2026-12-11T23:59:59Z", "status": [ "clientTransferProhibited" ], "nameservers": [ "ian.ns.cloudflare.com", "norah.ns.cloudflare.com" ], "dnssec": "unsigned" }, "rdap": { "status": [ "client transfer prohibited" ], "events": { "last changed": "2026-02-01T10:05:32Z", "registration": "2023-12-11T18:25:03Z", "registrar expiration": "2026-12-11T23:59:59Z", "last update of RDAP database": "2026-10-20T00:13:21Z" } } }, "webcheck": { "v": 1, "fetched_at": "2026-10-21T21:25:28Z", "caa_records": { "domain": "app.duxavian.online" }, "block_lists": { "resolvers": 12, "blocked_by": [ "CloudFlare Family" ], "blocked_count": 1 }, "archives": { "last": "2026-10-21T20:54:07Z", "first": "2024-04-19T23:22:51Z", "changes": 4, "days_archived": 10, "scans_per_day": 0.01, "avg_page_bytes": 4284 }, "social_tags": { "title": "DuxAvian" }, "trackers": { "requests": 59, "trackers": [ { "name": "Google Static", "company": "Google", "country": "US", "category": "Hosting", "requests": 1 } ] }, "mixed_content": { "third_party_scripts": 0 }, "status": { "up": true, "code": 200, "timings": { "dns": 3, "tls": 108, "wait": 95, "connect": 92, "download": 98 }, "response_ms": 396 }, "tls_connection": { "alpn": "http/1.1", "cipher": "TLS_AES_256_GCM_SHA384", "protocol": "TLSv1.3", "versions": [ "TLSv1.2", "TLSv1.3" ], "authorized": true, "forward_secrecy": true }, "ports": { "open": [ 22, 25, 53, 80, 443 ] }, "carbon": { "bytes": 15534, "co2_grams": 0.0006, "cleaner_than": 62 }, "dns_server": { "ns": [ { "ip": "108.162.194.70", "host": "norah.ns.cloudflare.com" }, { "ip": "173.245.59.118", "host": "ian.ns.cloudflare.com" } ], "zone": "duxavian.online" }, "location": { "ip": "66.94.97.22", "asn": "40021", "org": "Contabo Inc.", "city": "Orangeburg", "country": "US" }, "ssl": { "issuer": "Let's Encrypt / YR1", "subject": "apis-app.duxavian.online" }, "dns": { "A": [ "66.94.97.22" ] }, "dnssec": { "ds": false, "rrsig": false, "dnskey": false }, "hsts": { "message": "Site does not serve any HSTS headers." }, "http_security": { "xFrameOptions": false, "referrerPolicy": false, "xXSSProtection": false, "permissionsPolicy": false, "xContentTypeOptions": false, "contentSecurityPolicy": false, "strictTransportPolicy": false, "crossOriginOpenerPolicy": false, "crossOriginEmbedderPolicy": false, "crossOriginResourcePolicy": false }, "get_ip": { "ip": "66.94.97.22", "family": 4 }, "redirects": { "chain": [ "https://app.duxavian.online" ] }, "tech_stack": { "technologies": [ "TypeScript", "Ionic", "Zone.js", "Angular", "Apache HTTP Server", "metisMenu", "jQuery", "DataTables", "core-js", "Google Font API", "Webpack", "Module Federation" ] }, "whois": { "registrar": "NameCheap, Inc.", "created": "2023-12-11T18:25:03Z", "updated": "2026-02-01T10:05:32Z", "expires": "2026-12-11T23:59:59Z", "status": [ "clientTransferProhibited https://icann.org/epp" ], "nameservers": [ "ian.ns.cloudflare.com", "norah.ns.cloudflare.com" ] }, "headers": { "headers": { "server": "Apache", "content-type": "text/html" } } } } ```