# PhishDestroy domain threat record: dotechbt.com

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/dotechbt.com/
Machine-readable companion: https://phishdestroy.io/domain/dotechbt.com/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-25 11:01:59 UTC
- Last availability or vendor check: 2026-10-25 23:01:50 UTC
- Stored record updated: 2026-10-25 23:22:23 UTC
- VirusTotal detections in the stored snapshot: 16/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored infrastructure

- Observed IP address: 77.245.159.230
- Registrar in stored WHOIS data: Realtime Register B.V.
- Last stored HTTP status: 200
- Registration date in stored WHOIS data: 2026-04-12 16:52:08 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a172b9-26e9-727b-a49b-5db61213968e/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/dotechbt.com
- Certificate Transparency search: https://crt.sh/?q=%25.dotechbt.com
- Web Archive lookup: https://web.archive.org/web/*/https://dotechbt.com/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
PhishDestroy listed dotechbt.com on 2026-10-25 after a trusted intake rule flagged the domain based on its age and external signals. The recorded HTTP response was 200 and the page title displayed “Bu alan adı park edilmiştir,” which translates to a parked domain notice. The first observation by PhishDestroy occurred on 2026-10-25.

How the scam works
The listing relies on multiple vendor detections of phishing or malware, but no specific malicious payload, credential‑phishing form, or wallet‑draining behavior was observed on the page. Consequently the risk is described generically as a suspicious domain that could be used for deceptive purposes.

Evidence
VirusTotal analysis on 2026-10-23 reported 16 detections from 92 engines, including 13 malicious and 3 suspicious labels from vendors such as BitDefender, ESET and G‑Data. Google Safe Browsing checked on 2026-10-25 returned no flag. urlscan.io scan on 2026-10-25 assigned a malicious engine score of 75, though its overall verdict was non‑malicious. Cloudflare Radar scan on 2026-10-25 marked the domain malicious under the malware category. OTX recorded five pulses referencing the domain as of 2026-10-25. PhishDestroy’s internal blocklist contains the domain, while external blocklists showed zero hits on the same date.

Infrastructure
The domain was registered with Realtime Register B.V. on 2026-04-12, making it 195 days old at the time of first sighting. The recorded IP address was 77.245.159.230, which the observed location data linked to Niobe Bilisim Ltd. in Pendik, Turkey. The TLS certificate observed was issued by Let’s Encrypt / YE2, covering *.dotechbt.com and dotechbt.com, and was valid from 2026-09-17 to 2026-12-16. Nameservers p3.hosting.com.tr and p4.hosting.com.tr were listed, and DNSSEC was not enabled. Open ports seen in the scan included 25, 53, 80, 443 and 587.

What to do
Visitors should treat dotechbt.com as untrusted and avoid entering any personal or credential information. Organizations can block the domain and monitor network logs for connections to 77.245.159.230. Password changes are only needed if credentials were submitted, and no wallet‑related actions are indicated.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a172b9-26e9-727b-a49b-5db61213968e/
Cloudflare Radar report: https://radar.cloudflare.com/scan/5adcc99b-de64-49b3-bbd8-a336f0211d95
URLQuery report: https://urlquery.net/report/08f6b908-0a36-42a1-af2b-d40b8b4812ef
Stored capture screenshot: https://i.ibb.co/fdjFL83C/3245a384bc08.png
Cloudflare Radar screenshot (2026-10-25T11:34:06Z): https://screenshots.phishdestroy.io/cf/5adcc99b-de64-49b3-bbd8-a336f0211d95.png
URLQuery screenshot: https://screenshots.phishdestroy.io/uq/08f6b908-0a36-42a1-af2b-d40b8b4812ef.png
URLScan screenshot (2026-10-25T10:51:16Z): https://screenshots.phishdestroy.io/us/01a172af-8f43-7432-9447-d67d00215a8b.png
URLScan capture report: https://urlscan.io/result/01a172af-8f43-7432-9447-d67d00215a8b/
VirusTotal report: https://www.virustotal.com/gui/domain/dotechbt.com
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=dotechbt.com
Archived copy: https://web.archive.org/web/20261025110326/https://dotechbt.com/
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-25 12:04:38 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/fdjFL83C/3245a384bc08.png
  Captured: 2026-10-25 11:01:59 UTC
- URLScan capture: https://screenshots.phishdestroy.io/01a172b9-26e9-727b-a49b-5db61213968e.png
  Captured: 2026-10-25 11:01:59 UTC
  Source report: https://urlscan.io/result/01a172b9-26e9-727b-a49b-5db61213968e/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/5adcc99b-de64-49b3-bbd8-a336f0211d95.png
  Captured: 2026-10-25 11:34:06 UTC
  Source report: https://radar.cloudflare.com/scan/5adcc99b-de64-49b3-bbd8-a336f0211d95
  SHA-256: 02290b278926d022b12ab2e92e9a7318ea3d9f58615202ed2d4458a6a6190739
- URLQuery: https://screenshots.phishdestroy.io/uq/08f6b908-0a36-42a1-af2b-d40b8b4812ef.png
  Source report: https://urlquery.net/report/08f6b908-0a36-42a1-af2b-d40b8b4812ef
  SHA-256: c9042b2e6a537bcf9b49c7a2d1b753efad91dc199ca9fb2f446b32540d53df9b
- URLScan · 2026-10-25: https://screenshots.phishdestroy.io/us/01a172af-8f43-7432-9447-d67d00215a8b.png
  Captured: 2026-10-25 10:51:16 UTC
  Source report: https://urlscan.io/result/01a172af-8f43-7432-9447-d67d00215a8b/
  SHA-256: 1cc958dc9ed26edc9e7dfc0a29ce74040da901614eb673d0fb69d7074cac014d

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-25T11:35:24Z",
        "uuid": "01a172b9-26e9-727b-a49b-5db61213968e",
        "scanned_at": "2026-10-25T11:01:46Z",
        "final_url": "https://dotechbt.com/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://dotechbt.com/",
                "from": "http://dotechbt.com/",
                "status": 307
            }
        ],
        "ip": "77.245.159.230",
        "ptr": "park2.hosting.com.tr",
        "domains": [
            "www.hosting.com.tr"
        ],
        "ips": [
            "2606:4700:20::681a:8ca",
            "77.245.159.230"
        ],
        "asns": [
            "13335",
            "42868"
        ],
        "countries": [
            "TR"
        ],
        "doc_hash": "deb50c06526c06feb50849a771823f7a82da738ad421b3be06ff3f0155db4b38",
        "globals": [
            "openRoute",
            "domain",
            "domainHeading",
            "accentColors",
            "accentColor",
            "routes",
            "logo"
        ],
        "tls": {
            "san": [
                "*.dotechbt.com",
                "dotechbt.com"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "YE2",
            "subject": "*.dotechbt.com",
            "protocol": "TLS 1.3",
            "valid_to": "2026-12-16T22:57:59Z",
            "valid_from": "2026-09-17T22:58:00Z"
        },
        "domain_age_days": 195,
        "apex_age_days": 195,
        "tls_age_days": 37,
        "tls_valid_days": 89,
        "requests": 5,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 75,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "LiteSpeed",
            "content-type": "text/html"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-25T11:35:30Z",
        "uuid": "5adcc99b-de64-49b3-bbd8-a336f0211d95",
        "scanned_at": "2026-10-25T11:34:06Z",
        "final_url": "https://dotechbt.com/",
        "status": 200,
        "history": [
            {
                "url": "https://dotechbt.com/",
                "status": 200
            }
        ],
        "dom_hash": "71ba416dac3b80cfadc5d81369f7565b7b8cdcb31139fa2b0957bcd5d7e3e735",
        "doc_hash": "deb50c06526c06feb50849a771823f7a82da738ad421b3be06ff3f0155db4b38",
        "phishing_v2": [
            "phishing"
        ],
        "domain_risks": [
            "Malware",
            "Security threats",
            "CIPA Filter",
            "CIPA"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "dotechbt.com",
                "type": "A",
                "value": "77.245.159.230"
            }
        ],
        "dnssec_valid": false,
        "ip": "77.245.159.230",
        "verdict": {
            "tags": [
                "malware"
            ],
            "malicious": true,
            "categories": [
                "malware"
            ]
        },
        "whois": {
            "registrar": "Realtime Register B.V.",
            "created": "2026-04-12T18:52:08Z",
            "updated": "2026-07-06T14:38:38Z",
            "expires": "2027-04-12T18:52:08Z",
            "nameservers": [
                "p3.hosting.com.tr",
                "p4.hosting.com.tr"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-25T12:03:26Z",
        "analysis_at": "2026-10-23T06:10:22Z",
        "stats": {
            "timeout": 0,
            "harmless": 43,
            "malicious": 13,
            "suspicious": 3,
            "undetected": 33
        },
        "detections": {
            "DNS8": "suspicious",
            "ESET": "suspicious",
            "VIPRE": "malware",
            "G-Data": "phishing",
            "Lionic": "phishing",
            "Sophos": "phishing",
            "CyRadar": "phishing",
            "Webroot": "malicious",
            "Fortinet": "phishing",
            "SOCRadar": "phishing",
            "Kaspersky": "phishing",
            "Seclookup": "malicious",
            "Gridinsoft": "suspicious",
            "BitDefender": "phishing",
            "alphaMountain.ai": "phishing",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "categories": {
            "Google": "domain_parking",
            "Sophos": "phishing and fraud",
            "Webroot": "Phishing and Other Frauds",
            "alphaMountain.ai": "Phishing (alphaMountain.ai)",
            "Forcepoint ThreatSeeker": "phishing and other frauds"
        },
        "created": "2026-04-12T00:00:00Z",
        "updated": "2026-04-12T00:00:00Z",
        "first_seen": "2026-04-15T16:25:09Z",
        "dns": [
            {
                "ttl": 300,
                "type": "MX",
                "value": "mail.dotechbt.com",
                "priority": 10
            },
            {
                "ttl": 300,
                "type": "TXT",
                "value": "v=spf1 a mx ip4:77.245.159.230 ~all"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "77.245.159.230"
            },
            {
                "ttl": 300,
                "type": "NS",
                "value": "p3.hosting.com.tr"
            },
            {
                "ttl": 300,
                "type": "NS",
                "value": "p4.hosting.com.tr"
            },
            {
                "ttl": 300,
                "type": "SOA",
                "rname": "hostmaster.dotechbt.com",
                "value": "p3.hosting.com.tr"
            }
        ],
        "dns_at": "2026-10-23T06:16:01Z",
        "jarm": "27d27d27d00027d00042d43d00041dba951fb796b4b956c9799ba19149e94a",
        "cert": {
            "san": [
                "*.dotechbt.com",
                "dotechbt.com"
            ],
            "issuer": "Let's Encrypt / YE2",
            "serial": "636d74a1e880e093b897b9554d957599f05",
            "sha256": "56f70f578f90b5ee8479658453401a912aaf25b6ea062705ea5603a831b83e49",
            "subject": "*.dotechbt.com",
            "valid_to": "2026-12-16T22:57:59Z",
            "valid_from": "2026-09-17T22:58:00Z"
        },
        "rdap": {
            "status": [
                "client transfer prohibited"
            ],
            "events": {
                "expiration": "2027-04-12T18:52:08Z",
                "last changed": "2026-07-06T14:38:39Z",
                "registration": "2026-04-12T18:52:08Z",
                "registrar expiration": "2027-04-12T18:52:08Z",
                "last update of RDAP database": "2026-10-23T06:16:00Z"
            },
            "registrar": "REALTIME REGISTER B.V.",
            "registrar_iana_id": "839"
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-25T11:36:46Z",
        "mail_config": {
            "mx": [
                "mail.dotechbt.com"
            ],
            "spf": "v=spf1 a mx ip4:77.245.159.230 ~all",
            "spf_lookups": 2
        },
        "caa_records": {
            "domain": "dotechbt.com"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_by": [
                "CloudFlare Family"
            ],
            "blocked_count": 1
        },
        "archives": {
            "last": "2026-10-25T11:03:26Z",
            "first": "2026-10-11T21:00:10Z",
            "changes": 1,
            "days_archived": 2,
            "scans_per_day": 0.07,
            "avg_page_bytes": 3885
        },
        "social_tags": {
            "title": "Bu alan adı park edilmiştir",
            "robots": "noindex,nofollow"
        },
        "trackers": {
            "requests": 2
        },
        "mixed_content": {
            "third_party_scripts": 0
        },
        "status": {
            "up": true,
            "code": 200,
            "timings": {
                "dns": 500,
                "tls": 127,
                "wait": 359,
                "connect": 73,
                "download": 0
            },
            "response_ms": 1059
        },
        "tls_connection": {
            "alpn": "h2",
            "cipher": "TLS_AES_256_GCM_SHA384",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                25,
                53,
                80,
                443,
                587
            ]
        },
        "carbon": {
            "bytes": 11044,
            "co2_grams": 0.0004,
            "cleaner_than": 70
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "77.245.159.230",
                    "host": "p4.hosting.com.tr"
                },
                {
                    "ip": "77.245.158.230",
                    "host": "p3.hosting.com.tr"
                }
            ],
            "zone": "dotechbt.com"
        },
        "location": {
            "ip": "77.245.159.230",
            "asn": "42868",
            "org": "Niobe Bilisim Ltd. Sti.",
            "city": "Pendik",
            "country": "TR"
        },
        "ssl": {
            "issuer": "Let's Encrypt / YE2",
            "subject": "*.dotechbt.com"
        },
        "dns": {
            "A": [
                "77.245.159.230"
            ],
            "MX": [
                "{\"exchange\": \"mail.dotechbt.com\", \"priority\": 10}"
            ],
            "NS": [
                "p3.hosting.com.tr",
                "p4.hosting.com.tr"
            ],
            "SOA": "{\"nsname\": \"p3.hosting.com.tr\", \"hostmaster\": \"hostmaster.dotechbt.com\", \"serial\": 2026101301, \"refresh\": 3600, \"retry\": 3600, \"expire\": 1209600, \"minttl\": 300}",
            "TXT": [
                "v=spf1 a mx ip4:77.245.159.230 ~all"
            ]
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "hsts": {
            "message": "Site does not serve any HSTS headers."
        },
        "http_security": {
            "xFrameOptions": false,
            "referrerPolicy": false,
            "xXSSProtection": false,
            "permissionsPolicy": false,
            "xContentTypeOptions": false,
            "contentSecurityPolicy": false,
            "strictTransportPolicy": false,
            "crossOriginOpenerPolicy": false,
            "crossOriginEmbedderPolicy": false,
            "crossOriginResourcePolicy": false
        },
        "get_ip": {
            "ip": "77.245.159.230",
            "family": 4
        },
        "redirects": {
            "chain": [
                "https://dotechbt.com"
            ]
        },
        "subdomains": {
            "count": 1,
            "subdomains": [
                "qrmenu.dotechbt.com"
            ]
        },
        "whois": {
            "registrar": "Realtime Register B.V.",
            "created": "2026-04-12T18:52:08Z",
            "updated": "2026-07-06T14:38:38Z",
            "expires": "2027-04-12T18:52:08Z",
            "status": [
                "clientTransferProhibited https://icann.org/epp"
            ],
            "nameservers": [
                "p3.hosting.com.tr",
                "p4.hosting.com.tr"
            ]
        },
        "headers": {
            "headers": {
                "server": "LiteSpeed",
                "content-type": "text/html"
            }
        }
    }
}
```