# PhishDestroy threat dossier — chelvestonrenewableenergyltd.co.uk ================================================================ Fetched: 2026-07-30 21:07:28 UTC Canonical: https://phishdestroy.io/domain/chelvestonrenewableenergyltd.co.uk/ ## VERDICT ---------------------------------------------------------------- CRITICAL THREAT — DO NOT VISIT Composite threat score: 95/100 (PhishDestroy scoring — see methodology below) ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 6/91 security vendors flagged this domain Flagging vendors: alphaMountain.ai, CRDF, Forcepoint ThreatSeeker, Gridinsoft, Netcraft, SOCRadar Public blocklists: listed on 1 independent blocklist ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 92.113.23.24 (LT, Vilnius) ASN: AS47583 Hostinger International Limited Hosting org: Hostinger CDN Registrar: Realtime Register BV t/a Axidomains [Tag = AXIDOMAINS] Nameservers: ns1.dns-parking.com, ns2.dns-parking.com Registered: 2025-08-16 Expires: 2026-08-16 Page title: Chelveston Renewable Energy Ltd - Investments Capital ## TLS CERTIFICATE ---------------------------------------------------------------- Issuer: Let's Encrypt / YE2 Expires: 2026-09-10 Status: INVALID chain Fingerprint: afd88eb4d3a15c96526fdfcd80dcef52c21b4a3af6f8ee383a9abe74f5aee7f2 Subject Alternative Names (related infrastructure — often same operator): - www.chelvestonrenewableenergyltd.co.uk ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: pending notification queue. No abuse reports filed yet — this domain is waiting for the next cycle of our automated abuse-reporter. ## TIMELINE ---------------------------------------------------------------- Domain registered: 2025-08-16 (per WHOIS / CT — may reflect a renewal or transfer date, not first-ever registration) First detected: 2026-07-27 05:41:10 UTC (by PhishDestroy tracker) First reported: 2026-07-27 04:58:51 UTC (abuse notice filed) Last verified: 2026-07-30 21:05:16 UTC Current status: ACTIVE / observable ## EXTERNAL CORROBORATION (third-party evidence) ---------------------------------------------------------------- URLScan.io: https://urlscan.io/result/019fa292-440a-778a-8a95-b13d568340cc/ URLQuery: https://urlquery.net/report/c3fc3455-8303-4ef3-9cb4-9b4b4f1bbe3a Wayback Machine: https://web.archive.org/web/*/chelvestonrenewableenergyltd.co.uk crt.sh CT logs: https://crt.sh/?q=%25.chelvestonrenewableenergyltd.co.uk Google transparency: https://transparencyreport.google.com/safe-browsing/search?url=chelvestonrenewableenergyltd.co.uk AlienVault OTX: https://otx.alienvault.com/indicator/domain/chelvestonrenewableenergyltd.co.uk URLhaus: https://urlhaus.abuse.ch/host/chelvestonrenewableenergyltd.co.uk/ ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-07-27 05:42:30 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] chelvestonrenewableenergyltd.co.uk: Confirmed Phishing Site This domain, chelvestonrenewableenergyltd.co.uk, is presently active and has been identified as a generic phishing infrastructure. The domain was registered on August 16, 2025 through Realtime Register BV trading as Axidomains (Tag = AXIDOMAINS). Authoritative name servers are ns1.dns-parking.com and ns2.dns-parking.com, indicating the use of a parking service rather than a dedicated hosting provider. DNS resolution points to the IPv4 address 84.32.84.206. The address is currently listed on a single security blocklist and has been explicitly blocked by the PhishDestroy feed. VirusTotal analysis shows that one out of ninety‑one security vendors submitted a detection for this domain, confirming malicious intent despite the low overall detection count. No additional public intelligence such as SSL certificate details, HTTP response codes, Safe Browsing verdicts, or page‑title metadata has been published, leaving the exact content of the site unverified. The limited visibility suggests the operators may be leveraging a short‑lived hosting arrangement or rotating infrastructure to evade detection. Defenders should immediately add chelvestonrenewableenergyltd.co.uk to DNS‑based blocklists and enforce URL filtering across enterprise gateways. Monitoring of the IP address 84.32.84.206 for any outbound connections or traffic spikes is advisable, as is periodic re‑scanning with multi‑engine services to capture any change in detection status. Given the registrar’s reputation for facilitating rapid domain turnover, continuous watch on newly created domains from Axidomains may provide early warning of similar campaigns. Until further forensic analysis of the landing page is available, the domain should be treated as high‑risk and blocked at the perimeter. ## EVIDENCE HASHES ---------------------------------------------------------------- PhishDestroy Case ID: PD-20260727-AE3F20 Favicon MD5: f76e0c87b4911bafb777f67e6070f121 TLS cert SHA-256: afd88eb4d3a15c96526fdfcd80dcef52c21b4a3af6f8ee383a9abe74f5aee7f2 ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (operator takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/chelvestonrenewableenergyltd.co.uk/ JSON API: https://api.destroy.tools/v1/check?domain=chelvestonrenewableenergyltd.co.uk Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: independent open-source threat-intelligence platform. Tracked: 196,028 domains (83,726 alive under monitoring, 110,042 confirmed takedowns/dead). Site: https://phishdestroy.io