# PhishDestroy threat dossier — attvip.mx ================================================================ Fetched: 2026-07-24 02:46:55 UTC Canonical: https://phishdestroy.io/domain/attvip.mx/ ## VERDICT ---------------------------------------------------------------- CRITICAL THREAT — DO NOT VISIT Composite threat score: 100/100 (PhishDestroy scoring — see methodology below) Scam classification: Generic Phishing ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 11/91 security vendors flagged this domain Flagging vendors: ADMINUSLabs, alphaMountain.ai, Bfore.Ai PreCrime, Chong Lua Dao, Forcepoint ThreatSeeker, Fortinet, Gridinsoft, Seclookup, SOCRadar, Sophos, Webroot AlienVault OTX: 50 pulses (threat-intel feed mentions) Public blocklists: listed on 1 independent blocklist ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 67.217.36.132 (US, Chicago) ASN: ASAS22458 NETSOURCE - CONVERGEONE HOLDINGS, INC., US Hosting org: AS22458 CONVERGEONE HOLDINGS, INC. Registrar: GoDaddy.com Nameservers: ns1-bolon.hosting-mexico.net, ns2-bolon.hosting-mexico.net Registered: 2021-03-30 Expires: 2027-03-30 Page title: Aviso de Privacidad HTTP response: 200 ## TLS CERTIFICATE ---------------------------------------------------------------- Issuer: Let's Encrypt / YR1 Expires: 2026-09-07 Status: INVALID chain Fingerprint: ad61e53a3be9a1b89e55269b5cb243c61b6111cbd085ac6f73f18ad79edded90 ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: pending notification queue. No abuse reports filed yet — this domain is waiting for the next cycle of our automated abuse-reporter. ## TIMELINE ---------------------------------------------------------------- Domain registered: 2021-03-30 (per WHOIS / CT — may reflect a renewal or transfer date, not first-ever registration) First detected: 2026-06-18 14:33:31 UTC (by PhishDestroy tracker) Last verified: 2026-07-24 04:20:29 UTC Current status: ACTIVE / observable ## EXTERNAL CORROBORATION (third-party evidence) ---------------------------------------------------------------- URLScan.io: https://urlscan.io/result/019edab8-32ed-739f-aaa9-f3e2982da193/ Wayback Machine: https://web.archive.org/web/*/attvip.mx crt.sh CT logs: https://crt.sh/?q=%25.attvip.mx Google transparency: https://transparencyreport.google.com/safe-browsing/search?url=attvip.mx AlienVault OTX: https://otx.alienvault.com/indicator/domain/attvip.mx URLhaus: https://urlhaus.abuse.ch/host/attvip.mx/ ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-07-08 15:05:43 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] Is attvip.mx a Fake Privacy Notice Phishing Site? This domain, attvip.mx, is flagged as a generic phishing site designed to mimic legitimate privacy notices, a tactic commonly used to deceive users into disclosing sensitive information. Analysis indicates the domain hosts content titled 'Aviso de Privacidad,' a Spanish-language privacy notice, which is frequently exploited in phishing campaigns targeting Spanish-speaking users. While no specific brand impersonation or drainer kit is confirmed, the domain’s structure and content align with credential harvesting schemes, where victims are tricked into entering login details or personal data under false pretenses. Infrastructure analysis reveals multiple technical indicators of compromise. The domain was registered on March 30, 2021, through GoDaddy.com and currently resolves to the IP address 67.217.36.132, hosted on AS22458 (CONVERGEONE HOLDINGS, INC.) in the United States. It is flagged by 11 out of 95 security vendors on VirusTotal, appears on two security blocklists, and is actively blocked by PhishDestroy and PhishingDB. The SSL certificate is issued by Let's Encrypt (YR1), a common choice for both legitimate and malicious domains, providing minimal assurance of authenticity. The domain’s creation date suggests it has been operational for an extended period, increasing the likelihood of prolonged malicious activity. As of the latest assessment, attvip.mx remains active and poses a high risk to users. While it is blocked by multiple security platforms, the domain’s continued resolution and lack of takedown indicate persistent threats. Users are advised to avoid interacting with this domain, and organizations should implement network-level blocks for 67.217.36.132 and associated indicators. Given the domain’s age and blocklist presence, monitoring for related infrastructure or newly registered lookalike domains is recommended to mitigate further exposure. ## EVIDENCE HASHES ---------------------------------------------------------------- Favicon MD5: 549cca63038881187bac188c458545b7 TLS cert SHA-256: ad61e53a3be9a1b89e55269b5cb243c61b6111cbd085ac6f73f18ad79edded90 ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (operator takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/attvip.mx/ JSON API: https://api.destroy.tools/v1/check?domain=attvip.mx Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: independent open-source threat-intelligence platform. Tracked: 188,976 domains (58,403 alive under monitoring, 128,955 confirmed takedowns/dead). Site: https://phishdestroy.io