# PhishDestroy domain threat record: elemintur.com Content language: English Canonical HTML report: https://phishdestroy.io/domain/elemintur.com/ Machine-readable companion: https://phishdestroy.io/domain/elemintur.com/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-10-25 16:03:21 UTC - Last availability or vendor check: 2026-10-25 16:12:02 UTC - Stored record updated: 2026-10-25 19:30:50 UTC - VirusTotal detections in the stored snapshot: 13/92 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: flagged ## Stored infrastructure - Observed IP address: 5.180.185.136 - Registrar in stored WHOIS data: Atak Domain - Registrar country in stored WHOIS data: GB - Last stored HTTP status: 200 - Registration date in stored WHOIS data: 2024-05-07 14:08:33 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a173d3-7848-743f-8709-bc1b760157c0/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/elemintur.com - Certificate Transparency search: https://crt.sh/?q=%25.elemintur.com - Web Archive lookup: https://web.archive.org/web/*/https://elemintur.com/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview PhishDestroy has placed elemintur.com on its internal blocklist as a suspicious domain. The recorded page title advertises a travel service for Umrah and Hajj tours. The domain was first seen by PhishDestroy on 2026-10-25, when an HTTP 200 response was recorded. How the scam works Listings of this type arise when sites are identified as potential social‑engineering or phishing venues. Attackers typically mimic legitimate organisations to lure visitors into disclosing credentials, personal data, or payment information, but no specific credential‑capture form was observed on this page. Evidence Google Safe Browsing flagged the domain as SOCIAL_ENGINEERING on 2026-10-25. VirusTotal recorded 13 detections from 92 engines on 2026-10-24, with 12 malicious and 1 suspicious verdicts from vendors including BitDefender, Fortinet, G‑Data and Lionic. urlscan.io captured the site on 2026-10-25; its engine analysis gave a malicious score of 72 while the overall verdict was clean. Cloudflare Radar (2026-10-25) tagged the domain as phishing and malicious. OTX reported one pulse on 2026-10-25, and PhishDestroy’s internal blocklist marks the domain as blocked while external blocklists showed no matches on the check date. Infrastructure The domain was registered with Atak Domain Bilgi Teknolojileri A.S. on 2024-05-07 (age 899 days). The recorded IP was 5.180.185.136 and the network was identified as Voyar Verimerkezi Teknolojileri Ltd. STI in Turkey. TLS was provided by a Let’s Encrypt certificate issued on 2026-10-16, valid until 2027-01-14. The recorded nameservers were dns7.internetbilisim.net and dns8.internetbilisim.net; DNSSEC was not enabled. What to do Visitors should avoid entering any personal or login information on the site and treat it as untrusted. If credentials were submitted, change the associated passwords immediately; defenders should block elemintur.com, monitor outbound traffic for connections to 5.180.185.136, and add the domain to internal blocklists. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a173d3-7848-743f-8709-bc1b760157c0/ Cloudflare Radar report: https://radar.cloudflare.com/scan/d02f32d8-c200-46a2-a89d-7a91c3e8c989 Stored capture screenshot: https://urlscan.io/screenshots/01a173d3-7848-743f-8709-bc1b760157c0.png Cloudflare Radar screenshot (2026-10-25T16:10:48Z): https://screenshots.phishdestroy.io/cf/d02f32d8-c200-46a2-a89d-7a91c3e8c989.png VirusTotal report: https://www.virustotal.com/gui/domain/elemintur.com Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=elemintur.com Archived copy: https://web.archive.org/web/20261025160341/https://elemintur.com/ Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-25 16:15:15 UTC ## Stored page captures - Primary capture: https://urlscan.io/screenshots/01a173d3-7848-743f-8709-bc1b760157c0.png Captured: 2026-10-25 16:12:02 UTC - URLScan capture 1: https://screenshots.phishdestroy.io/01a173d3-7848-743f-8709-bc1b760157c0.png Captured: 2026-10-25 16:12:02 UTC Source report: https://urlscan.io/result/01a173d3-7848-743f-8709-bc1b760157c0/ - URLScan capture 2: https://urlscan.io/screenshots/01a08eef-51ff-72d2-a6c9-938af406f250.png Captured: 2026-10-25 16:03:21 UTC Source report: https://urlscan.io/result/01a173d3-7848-743f-8709-bc1b760157c0/ - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/d02f32d8-c200-46a2-a89d-7a91c3e8c989.png Captured: 2026-10-25 16:10:48 UTC Source report: https://radar.cloudflare.com/scan/d02f32d8-c200-46a2-a89d-7a91c3e8c989 SHA-256: a9c5cf3b5eadb1e470d2d00d82855b47c26fe51db5c341cc5310bec8788a7fe7 - URLQuery: https://screenshots.phishdestroy.io/uq/d834248a-b4fc-4201-bf4a-20a01448dee5.png Source report: https://urlquery.net/report/d834248a-b4fc-4201-bf4a-20a01448dee5 SHA-256: c94dd01871af127be258503b38b6fd9471a1d12c5b0caff6a7fcb92fe53368dc ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-25T16:14:17Z", "uuid": "01a173d3-7848-743f-8709-bc1b760157c0", "scanned_at": "2026-10-25T16:10:09Z", "final_url": "https://elemintur.com/", "status": 200, "redirected": "https-only", "redirects": [ { "to": "https://elemintur.com/", "from": "http://elemintur.com/", "status": 307 } ], "ip": "5.180.185.136", "ptr": "da4.internetbilisim.net", "domains": [ "www.youtube-nocookie.com", "fonts.gstatic.com", "fonts.googleapis.com", "jnn-pa.googleapis.com", "www.youtube.com", "ssl.gstatic.com", "www.google.com" ], "ips": [ "2a00:1450:4001:c1f::5e", "2001:4860:4846:400::", "142.251.151.119", "142.251.20.91", "142.250.154.94", "2a00:1450:4001:c15::88", "2001:4860:482b:400::", "142.251.13.94", "2a00:1450:4001:c17::5f", "5.180.185.136" ], "asns": [ "15169", "219450" ], "countries": [ "DE", "US", "TR" ], "link_domains": [ "youtube.com", "www.youtube.com" ], "social": [ "https://youtube.com/watchhttps://www.facebook.com/watch", "https://www.youtube.com" ], "doc_hash": "2d8c7e20c9994dc3b8e29bcb879ea86770473a561adcff14a8f0f20150485838", "script_hashes": [ "cb6f2d32c49d1c2b25e9ffc9aaafa3f83075346c01bcd4ae6eb187392a4292cf", "5274f11e6fb32ae0cf2dfb9f8043272865c397a7c4223b4cfa7d50ea52fbde89", "6a247cc4a7dfabf12ea2797a38fc01a2e762988d0ba7c8e6111a4f87f11733fa", "c4596b16b126326b0d8fc2fb8bf91389ad3dc4671a269187913c19a8f2ad1094", "6956a11abacef46d5ddb093efc77c666cb767197089d2cb8ebe5ac501d753e4a", "2ba11c3b234c64786353775595d28f75a5ce348df1685843985cdce133375ccd", "15acfbe1cf32f08b01c71dfe0512b0eced12cebef829b03d17b180f0fdc379dd", "8f7c7e7f2cd797919266144048e09f6ff020251d802170cd396360c097e958f6", "b4bbbeb410140adf0ad76bf74e2a6525427e7fd867020599bcce5ce6c724646e", "b9bc222aa72b968c5069428671e53c22206025bc9a71e184f9470253d5494bfa" ], "globals": [ "jQuery", "setREVStartSize", "RSIW", "RSIH", "RS_MODULES", "revslider_showDoubleJqueryError", "gsapVersions", "tpGS", "punchgs", "Codevz", "RSANYID", "RSANYID_sliderID", "_R_is_Editor", "Codevz_Plus", "webpackChunkelementorFrontend", "elementorModules", "elementorFrontendConfig", "elementorFrontend", "jpictura", "EvEmitter", "imagesLoaded", "jQueryBridget", "getSize", "matchesSelector", "fizzyUIUtils", "Outlayer", "Isotope", "Masonry", "xtraElementorTilt", "xtraElementorParallax", "tpj", "revapi2", "RSBrowser", "isSafari11", "T", "_rs_firefox13", "_rs_firefox", "_rs_ie", "_rs_ie9", "_rs_desktop" ], "cookies": [ "__Secure-YNID", "YSC", "__Secure-ROLLOUT_TOKEN", "VISITOR_INFO1_LIVE", "VISITOR_PRIVACY_METADATA" ], "tls": { "san": [ "*.elemintur.com", "elemintur.com" ], "cipher": "AES_128_GCM", "issuer": "YE2", "subject": "*.elemintur.com", "protocol": "TLS 1.3", "valid_to": "2027-01-14T23:17:47Z", "valid_from": "2026-10-16T23:17:48Z" }, "domain_age_days": 899, "apex_age_days": 899, "tls_age_days": 8, "tls_valid_days": 89, "requests": 88, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 72, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "LiteSpeed", "content-type": "text/html; charset=UTF-8" } }, "cf": { "v": 1, "fetched_at": "2026-10-25T16:14:20Z", "uuid": "d02f32d8-c200-46a2-a89d-7a91c3e8c989", "scanned_at": "2026-10-25T16:10:48Z", "final_url": "https://elemintur.com/", "status": 200, "history": [ { "url": "https://elemintur.com/", "status": 200 } ], "dom_hash": "26f836a38cd8d3b70c708579ce38657b062500974c031204ee11fdbb92a740c1", "doc_hash": "f91686ad03e94bda501c40dbc6dc4bed5db6a577b0ed60cf1964749e3c6e51d8", "domain_risks": [ "Phishing", "Security threats", "CIPA Filter", "CIPA" ], "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "elemintur.com", "type": "A", "value": "5.180.185.136" } ], "dnssec_valid": false, "ip": "5.180.185.136", "verdict": { "tags": [ "phishing" ], "malicious": true, "categories": [ "phishing" ] }, "whois": { "registrar": "Atak Domain Bilgi Teknolojileri A.S.", "created": "2024-05-07T16:08:33Z", "updated": "2026-04-29T07:09:59Z", "expires": "2027-05-07T16:08:33Z", "nameservers": [ "dns7.internetbilisim.net", "dns8.internetbilisim.net" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-25T16:09:36Z", "analysis_at": "2026-10-24T00:30:54Z", "stats": { "timeout": 0, "harmless": 46, "malicious": 12, "suspicious": 1, "undetected": 33 }, "detections": { "VIPRE": "malware", "G-Data": "phishing", "Lionic": "phishing", "Sophos": "phishing", "Webroot": "malicious", "Fortinet": "phishing", "URLQuery": "malicious", "Seclookup": "malicious", "Gridinsoft": "suspicious", "BitDefender": "phishing", "alphaMountain.ai": "phishing", "Google Safe Browsing": "phishing", "Forcepoint ThreatSeeker": "phishing" }, "reputation": 0, "categories": { "alphaMountain.ai": "Phishing (alphaMountain.ai)" }, "registrar": "Atak Domain", "created": "2024-05-07T16:08:33Z", "expires": "2027-05-07T16:08:33Z", "updated": "2026-04-29T07:09:59Z", "first_seen": "2024-05-09T16:05:11Z", "dns": [ { "ttl": 3600, "type": "SOA", "rname": "hostmaster.elemintur.com", "value": "dns7.internetbilisim.net" }, { "ttl": 3600, "type": "NS", "value": "dns8.internetbilisim.net" }, { "ttl": 3600, "type": "A", "value": "5.180.185.136" }, { "ttl": 3600, "type": "MX", "value": "mail.elemintur.com", "priority": 10 }, { "ttl": 3600, "type": "NS", "value": "dns7.internetbilisim.net" }, { "ttl": 3600, "type": "TXT", "value": "v=spf1 a mx ip4:5.180.185.136 ip6:0:0:0:0:0:0:0:1 ~all" } ], "dns_at": "2026-10-24T00:36:39Z", "jarm": "27d27d27d00027d00042d43d00041dba951fb796b4b956c9799ba19149e94a", "cert": { "san": [ "*.elemintur.com", "elemintur.com" ], "issuer": "Let's Encrypt / YE2", "serial": "60c877edc905af43919062bd3314b15a088", "sha256": "b5e14163537c231a9b58274655828a57f6f5c8176953dd8867eed0daae9d5b22", "subject": "*.elemintur.com", "valid_to": "2027-01-14T23:17:47Z", "valid_from": "2026-10-16T23:17:48Z" }, "whois": { "registrar": "Atak Domain", "registrar_iana_id": "1601", "registrar_url": "http://apiname.com", "created": "2024-05-07T16:08:33Z", "updated": "2026-04-29T07:09:59Z", "expires": "2027-05-07T16:08:33Z", "status": [ "http://www.icann.org/epp", "ok" ], "nameservers": [ "dns7.internetbilisim.net", "dns8.internetbilisim.net" ], "dnssec": "unsigned" }, "rdap": { "status": [ "ok" ], "events": { "expiration": "2027-05-07T16:08:33Z", "last changed": "2026-04-29T07:09:59Z", "registration": "2024-05-07T16:08:33Z", "registrar expiration": "2027-05-07T16:08:33Z", "last update of RDAP database": "2026-09-16T23:27:38Z" } } }, "webcheck": { "v": 1, "fetched_at": "2026-10-25T16:14:44Z", "mail_config": { "mx": [ "mail.elemintur.com" ], "spf": "v=spf1 a mx ip4:5.180.185.136 ip6:0:0:0:0:0:0:0:1 ~all", "spf_lookups": 2 }, "caa_records": { "domain": "elemintur.com" }, "block_lists": { "resolvers": 12, "blocked_by": [ "CloudFlare Family" ], "blocked_count": 1 }, "archives": { "last": "2026-10-25T16:03:41Z", "first": "2026-10-25T16:03:41Z", "changes": 0, "days_archived": 1, "avg_page_bytes": 33854 }, "robots_txt": { "agents": [ "*" ], "present": true, "sitemaps": [ "https://elemintur.com/wp-sitemap.xml" ] }, "social_tags": { "title": "EL-Emin Turizm – Umre ve Hac Organizasyonu", "robots": "max-image-preview:large", "generator": "WordPress 7.1.3", "themeColor": "#d7ae51", "canonicalUrl": "https://elemintur.com/" }, "mixed_content": { "third_party_scripts": 0 }, "status": { "up": true, "code": 200, "timings": { "dns": 6, "tls": 73, "wait": 8660, "connect": 55, "download": 2169 }, "response_ms": 10963 }, "tls_connection": { "alpn": "h2", "cipher": "TLS_AES_256_GCM_SHA384", "protocol": "TLSv1.3", "versions": [ "TLSv1.2", "TLSv1.3" ], "authorized": true, "forward_secrecy": true }, "ports": { "open": [ 21, 25, 53, 80, 110, 143, 443, 587, 993, 995, 5060 ] }, "dns_server": { "ns": [ { "ip": "5.180.185.136", "host": "dns7.internetbilisim.net" }, { "ip": "83.150.213.117", "host": "dns8.internetbilisim.net" } ], "zone": "elemintur.com" }, "location": { "ip": "5.180.185.136", "asn": "219450", "org": "Voyar Verimerkezi Teknolojileri Ltd. STI", "city": "Umraniye", "country": "TR" }, "ssl": { "issuer": "Let's Encrypt / YE2", "subject": "*.elemintur.com" }, "dns": { "A": [ "5.180.185.136" ], "MX": [ "{\"exchange\": \"mail.elemintur.com\", \"priority\": 10}" ], "NS": [ "dns8.internetbilisim.net", "dns7.internetbilisim.net" ], "SOA": "{\"nsname\": \"dns7.internetbilisim.net\", \"hostmaster\": \"hostmaster.elemintur.com\", \"serial\": 2026101705, \"refresh\": 3600, \"retry\": 3600, \"expire\": 1209600, \"minttl\": 86400}", "TXT": [ "v=spf1 a mx ip4:5.180.185.136 ip6:0:0:0:0:0:0:0:1 ~all" ] }, "dnssec": { "ds": false, "rrsig": false, "dnskey": false }, "hsts": { "message": "Site does not serve any HSTS headers." }, "http_security": { "xFrameOptions": false, "referrerPolicy": false, "xXSSProtection": false, "permissionsPolicy": false, "xContentTypeOptions": false, "contentSecurityPolicy": false, "strictTransportPolicy": false, "crossOriginOpenerPolicy": false, "crossOriginEmbedderPolicy": false, "crossOriginResourcePolicy": false }, "get_ip": { "ip": "5.180.185.136", "family": 4 }, "redirects": { "chain": [ "https://elemintur.com" ] }, "linked_pages": { "external": [ "https://youtube.com/watchhttps://www.facebook.com/watch/" ], "external_count": 1, "internal_count": 21 }, "whois": { "registrar": "Atak Domain Bilgi Teknolojileri A.S.", "created": "2024-05-07T16:08:33Z", "updated": "2026-04-29T07:09:59Z", "expires": "2027-05-07T16:08:33Z", "status": [ "ok https://icann.org/epp" ], "nameservers": [ "dns7.internetbilisim.net", "dns8.internetbilisim.net" ] }, "headers": { "headers": { "server": "LiteSpeed", "content-type": "text/html; charset=UTF-8" } } } } ```