# PhishDestroy domain threat record: avtech-ltd.com

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/avtech-ltd.com/
Machine-readable companion: https://phishdestroy.io/domain/avtech-ltd.com/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-16 14:24:52 UTC
- Last availability or vendor check: 2026-10-22 10:30:05 UTC
- Stored record updated: 2026-10-22 22:00:53 UTC
- VirusTotal detections in the stored snapshot: 11/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: genericemail

## Stored infrastructure

- Observed IP address: 125.253.92.186
- Registrar in stored WHOIS data: CV. Jogjacamp
- Registrar country in stored WHOIS data: BD
- Last stored HTTP status: 302
- Registration date (registry RDAP, avtech-ltd.com): 2024-01-28 11:52:19 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a14529-bd2a-7708-bc01-2edaa6426517/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/avtech-ltd.com
- Certificate Transparency search: https://crt.sh/?q=%25.avtech-ltd.com
- Web Archive lookup: https://web.archive.org/web/*/https://avtech-ltd.com/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
avtech-ltd.com is an impersonation phishing page that presents itself as the corporate website of Avtech Technologies Ltd. It targets people who expect to deal with that company, such as clients, suppliers and staff, and steers them toward handing over email account credentials. PhishDestroy first saw the domain on 2026-10-16. As of 2026-10-19 the site was alive and serving live content.

How the scam works
The page carries the title "Home - Avtech Technologies Ltd," which makes it look like an ordinary company homepage. That title reads as a legitimate business site, while we classify the domain as impersonation phishing. Scans matched the page to a generic email login lure. Schemes of this type usually start with a link in an email about an invoice, a shared document or a business request, followed by a prompt to sign in. Anyone who enters a username and password gives attackers access to their mailbox. Attackers then use that access to read correspondence, reset other accounts and send convincing fraud emails to the victim's contacts.

Evidence
urlscan.io returned a malicious verdict and identified generic email branding on the page. Spamhaus DBL lists the domain as spam, and four AlienVault OTX pulses reference it. On VirusTotal, only 1 of 92 engines flagged it when checked on 2026-10-16, and that vendor was CRDF, so antivirus coverage remains thin. The domain is on the PhishDestroy blocklist.

Infrastructure
The domain was registered on 2024-01-28 through CV. Jogjacamp. It is hosted at 125.253.92.186 on the PHOENIXNAP-AS-SG1 network operated by PhoenixNAP in Singapore. The site uses a TLS certificate from Let's Encrypt (YR2), so the browser padlock says nothing about whether the site is legitimate.

What to do
If you opened this site, close it and do not return. If you entered an email address and password, change that password right away, along with any other account that shares it. Turn on multi-factor authentication, then check your mailbox for unfamiliar forwarding rules, recovery addresses and active sessions. Warn your contacts if messages they did not expect came from your account, and report the incident to your IT or security team. Defenders should block the domain at the email gateway, DNS and web proxy, search mail logs for messages containing it, and reset credentials for any users who clicked through.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a14529-bd2a-7708-bc01-2edaa6426517/
VirusTotal report: https://www.virustotal.com/gui/domain/avtech-ltd.com
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=avtech-ltd.com
Archived copy: https://web.archive.org/web/20261016142728/https://avtech-ltd.com/
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 09:21:54 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/Lh2gHGtf/d7a60af816ff.png
  Captured: 2026-10-16 14:42:57 UTC
- URLScan capture 1: https://screenshots.phishdestroy.io/01a14529-bd2a-7708-bc01-2edaa6426517.png
  Captured: 2026-10-16 14:42:57 UTC
  Source report: https://urlscan.io/result/01a14529-bd2a-7708-bc01-2edaa6426517/
- URLScan capture 2: https://urlscan.io/screenshots/01a144cf-f718-71e7-a7f6-4287c7f54fba.png
  Captured: 2026-10-16 14:24:52 UTC
  Source report: https://urlscan.io/result/01a14529-bd2a-7708-bc01-2edaa6426517/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/969a074f-aa01-4419-99cb-f361948714ea.png
  Captured: 2026-10-16 14:27:04 UTC
  Source report: https://radar.cloudflare.com/scan/969a074f-aa01-4419-99cb-f361948714ea
  SHA-256: a3c2c2a70e2861dca163e686f3008059ffcf100b340cba76c3e93c8c7fc25a74
- URLQuery: https://screenshots.phishdestroy.io/uq/7e5b1951-b9b1-47dd-8c41-3cdd6ee81a9b.png
  Source report: https://urlquery.net/report/7e5b1951-b9b1-47dd-8c41-3cdd6ee81a9b
  SHA-256: 8a43a45ae9bd003dd7cebd0cc55db438c5e4f56151ed8c81ee4371b8aa6c4a40
- URLScan · 2026-08-22: https://screenshots.phishdestroy.io/us/01a028bf-58f9-70d4-84c5-cdf88b793266.png
  Captured: 2026-08-22 09:14:07 UTC
  Source report: https://urlscan.io/result/01a028bf-58f9-70d4-84c5-cdf88b793266/
  SHA-256: 0de71202cca50515a513e8f22632e4ac8c0044d21435e4ec97805364b42e50ff
- URLScan · 2026-10-16: https://screenshots.phishdestroy.io/us/01a144cf-f718-71e7-a7f6-4287c7f54fba.png
  Captured: 2026-10-16 13:04:08 UTC
  Source report: https://urlscan.io/result/01a144cf-f718-71e7-a7f6-4287c7f54fba/
  SHA-256: 697b5fd8c3b6a1d77f837e3df9a4e9e7020174006b6417f0389a2e352e6755c0
- URLScan · 2026-10-16: https://screenshots.phishdestroy.io/us/01a1451f-6c78-73a0-b3f0-69b3375add82.png
  Captured: 2026-10-16 14:30:57 UTC
  Source report: https://urlscan.io/result/01a1451f-6c78-73a0-b3f0-69b3375add82/
  SHA-256: c3bf250b41e643e200ee1b84974fdd228be386167325af9962213fb6ffd54760
- URLScan · 2026-10-16: https://screenshots.phishdestroy.io/us/01a14524-27a4-7011-8b31-fb826e0a54a2.png
  Captured: 2026-10-16 14:36:07 UTC
  Source report: https://urlscan.io/result/01a14524-27a4-7011-8b31-fb826e0a54a2/
  SHA-256: c3bf250b41e643e200ee1b84974fdd228be386167325af9962213fb6ffd54760
- URLScan · 2026-10-17: https://screenshots.phishdestroy.io/us/01a14754-3a1e-7688-8cd3-08f97846e420.png
  Captured: 2026-10-17 00:48:14 UTC
  Source report: https://urlscan.io/result/01a14754-3a1e-7688-8cd3-08f97846e420/
  SHA-256: 697b5fd8c3b6a1d77f837e3df9a4e9e7020174006b6417f0389a2e352e6755c0

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-20T18:32:17Z",
        "uuid": "01a14529-bd2a-7708-bc01-2edaa6426517",
        "scanned_at": "2026-10-16T14:42:12Z",
        "final_url": "https://avtech-ltd.com/xinu9.html",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://avtech-ltd.com/xinu9.html",
                "from": "http://avtech-ltd.com/xinu9.html",
                "status": 307
            }
        ],
        "ip": "125.253.92.186",
        "ptr": "server8.webhostbd.net",
        "domains": [
            "ajax.googleapis.com",
            "stackpath.bootstrapcdn.com"
        ],
        "ips": [
            "2a00:1450:4001:c0f::5f",
            "104.18.11.207",
            "125.253.92.186"
        ],
        "asns": [
            "15169",
            "13335",
            "59210"
        ],
        "countries": [
            "DE",
            "SG"
        ],
        "doc_hash": "dbf4dda6a7342546f9e9132b5f5c62acae717af254b64c43ad1b72b64e1deb69",
        "globals": [
            "$",
            "jQuery",
            "AntiBOT",
            "tmsend"
        ],
        "tls": {
            "san": [
                "*.avtech-ltd.com",
                "avtech-ltd.com"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "YR2",
            "subject": "avtech-ltd.com",
            "protocol": "TLS 1.3",
            "valid_to": "2026-12-01T13:47:21Z",
            "valid_from": "2026-09-02T13:47:22Z"
        },
        "domain_age_days": 992,
        "apex_age_days": 992,
        "tls_age_days": 44,
        "tls_valid_days": 89,
        "requests": 5,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 97,
                "malicious": true
            },
            "overall": {
                "tags": [
                    "phishing"
                ],
                "score": 100,
                "brands": [
                    "genericemail"
                ],
                "malicious": true,
                "categories": [
                    "phishing"
                ]
            },
            "urlscan": {
                "tags": [
                    "phishing"
                ],
                "score": 100,
                "brands": [
                    "Generic Email"
                ],
                "malicious": true,
                "categories": [
                    "phishing"
                ]
            }
        },
        "headers": {
            "content-type": "text/html"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-20T17:58:50Z",
        "uuid": "969a074f-aa01-4419-99cb-f361948714ea",
        "scanned_at": "2026-10-16T14:27:04Z",
        "final_url": "https://avtech-ltd.com/",
        "status": 200,
        "history": [
            {
                "url": "https://avtech-ltd.com/",
                "status": 200
            }
        ],
        "dom_hash": "dda263e124f5c404d132affa43895ac0db92fe976efd644009666fc3dc31e85b",
        "doc_hash": "16d89a31e95eb1a260b52e11130233122327cdebb8399649aaad7a161ef70ed0",
        "domain_risks": [
            "Ecommerce",
            "Shopping & Auctions",
            "Technology",
            "Business",
            "Business & Economy"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "avtech-ltd.com",
                "type": "A",
                "value": "125.253.92.186"
            }
        ],
        "dnssec_valid": false,
        "ip": "125.253.92.186",
        "whois": {
            "registrar": "CV. Jogjacamp",
            "created": "2024-01-28T11:52:19Z",
            "updated": "2026-01-16T05:17:38Z",
            "expires": "2027-01-28T11:52:19Z",
            "nameservers": [
                "ns1.webhostbd.net",
                "ns2.webhostbd.net"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-20T19:44:49Z",
        "analysis_at": "2026-10-20T18:49:07Z",
        "stats": {
            "timeout": 0,
            "harmless": 50,
            "malicious": 9,
            "suspicious": 2,
            "undetected": 31
        },
        "detections": {
            "CRDF": "malicious",
            "ESET": "suspicious",
            "VIPRE": "malware",
            "G-Data": "phishing",
            "Fortinet": "spam",
            "SOCRadar": "phishing",
            "URLQuery": "malicious",
            "Gridinsoft": "phishing",
            "BitDefender": "phishing",
            "alphaMountain.ai": "phishing",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "popularity": {
            "Majestic": 843382
        },
        "registrar": "CV. Jogjacamp",
        "created": "2024-01-28T11:52:19Z",
        "expires": "2027-01-28T11:52:19Z",
        "updated": "2026-01-16T05:22:40Z",
        "first_seen": "2024-01-30T08:03:10Z",
        "dns": [
            {
                "ttl": 21600,
                "type": "NS",
                "value": "ns2.webhostbd.net"
            },
            {
                "ttl": 14400,
                "type": "A",
                "value": "125.253.92.186"
            },
            {
                "ttl": 21600,
                "type": "SOA",
                "rname": "arif.populardiagnostic.com",
                "value": "ns1.webhostbd.net"
            },
            {
                "ttl": 14400,
                "type": "MX",
                "value": "avtech-ltd.com",
                "priority": 0
            },
            {
                "ttl": 14400,
                "type": "TXT",
                "value": "v=spf1 +a +mx +ip4:125.253.92.186 ~all"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "ns1.webhostbd.net"
            }
        ],
        "dns_at": "2026-10-20T18:49:32Z",
        "jarm": "29d29d00029d29d00042d43d00041d598ac0c1012db967bb1ad0ff2491b3ae",
        "cert": {
            "san": [
                "*.avtech-ltd.com",
                "avtech-ltd.com"
            ],
            "issuer": "Let's Encrypt / YR2",
            "serial": "524746c0a29298ca9babe936186c87e5a23",
            "sha256": "6464652b096f200e69db3ea6677719f99b0b50da1fa577f54d629de3d4a3b7f7",
            "subject": "avtech-ltd.com",
            "valid_to": "2026-12-01T13:47:21Z",
            "valid_from": "2026-09-02T13:47:22Z"
        },
        "whois": {
            "registrar": "CV. Jogjacamp",
            "registrar_iana_id": "1478",
            "registrar_url": "http://resellercamp.com",
            "created": "2024-01-28T11:52:19Z",
            "updated": "2026-01-16T05:17:38Z",
            "expires": "2027-01-28T11:52:19Z",
            "status": [
                "OK",
                "ok"
            ],
            "nameservers": [
                "ns1.webhostbd.net",
                "ns2.webhostbd.net"
            ],
            "dnssec": "Unsigned"
        },
        "rdap": {
            "status": [
                "active"
            ],
            "events": {
                "expiration": "2027-01-28T11:52:19Z",
                "last changed": "2026-01-16T05:22:40Z",
                "registration": "2024-01-28T11:52:19Z",
                "registrar expiration": "2027-01-28T11:52:19Z",
                "last update of RDAP database": "2026-10-16T05:15:25Z"
            }
        }
    }
}
```