# PhishDestroy domain threat record: emitisandabtin.ae Content language: English Canonical HTML report: https://phishdestroy.io/domain/emitisandabtin.ae/ Machine-readable companion: https://phishdestroy.io/domain/emitisandabtin.ae/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-09-20 10:06:28 UTC - Last availability or vendor check: 2026-10-22 10:36:36 UTC - Stored record updated: 2026-10-22 16:07:29 UTC - VirusTotal detections in the stored snapshot: 10/91 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: no stored flag ## Stored classification - Targeted brand: gmail ## Stored infrastructure - Observed IP address: 192.232.217.50 - Registrar in stored WHOIS data: REGISTRAR_NOT_FOUND - Last stored HTTP status: 200 ## Evidence links - URLScan report: https://urlscan.io/result/01a0be65-5c00-71c4-ae0d-c6d50972c7e0/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/emitisandabtin.ae - Certificate Transparency search: https://crt.sh/?q=%25.emitisandabtin.ae - Web Archive lookup: https://web.archive.org/web/*/https://emitisandabtin.ae/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview emitisandabtin.ae is an impersonation phishing site on the United Arab Emirates country-code domain. It poses as a legitimate service so visitors will trust it with their information. PhishDestroy first recorded it on 2026-09-20. It was still online on 2026-10-19 and served content behind a protective layer. How the scam works Impersonation sites copy the look, name or wording of a service people already use. The odd, brand-like spelling of the domain plays on readers who skim rather than check every letter. Victims who arrive from a link in an email, message or ad are asked to sign in, confirm account details or complete a payment. Anything typed into those forms goes to the operators, who can use it to take over accounts or commit fraud. When last checked, the page title read "Not Acceptable!", a server error message rather than branded content, while our classification is impersonation phishing. Evidence On 2026-09-30, 10 of 91 VirusTotal engines flagged the domain. The flagging vendors include alphaMountain.ai, Chong Lua Dao, ESET, Forcepoint ThreatSeeker, Fortinet, Gridinsoft, Seclookup and SOCRadar. These are separate threat-intelligence and security-product vendors, so the verdict does not rest on one source. The domain also appears in five AlienVault OTX threat pulses, which shows other researchers have tracked it. PhishDestroy lists it on its own blocklist. Infrastructure The site runs on IP 192.232.217.50 in a network registered to Oracle Corporation in the United States, so a .ae domain is served from US cloud infrastructure. Its TLS certificate comes from Let's Encrypt (YR2). The browser padlock therefore only means the connection is encrypted and says nothing about whether the site is genuine. The domain stayed reachable for about a month after we first logged it, so it remains a live risk. What to do If you entered a password on this site, change it immediately on the real service and on any other account that shares it. Turn on two-factor authentication, then review recent logins and active sessions for activity you don't recognize. If you entered card or banking details, call your bank to block the card and dispute any unauthorized charges. Security teams should block emitisandabtin.ae and 192.232.217.50 at DNS and proxy level and search mail and web logs for earlier visits. Report the domain to the .ae registry and to the hosting provider's abuse contact so it can be taken down. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a0be65-5c00-71c4-ae0d-c6d50972c7e0/ VirusTotal report: https://www.virustotal.com/gui/domain/emitisandabtin.ae Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=emitisandabtin.ae Archived copy: https://web.archive.org/web/20260920104832/https://emitisandabtin.ae/ Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-19 09:38:19 UTC ## Stored page captures - Primary capture: https://i.ibb.co/BHW19LxG/f4b808fbdc40.png Captured: 2026-09-20 10:38:48 UTC - URLScan capture 1: https://screenshots.phishdestroy.io/01a0be65-5c00-71c4-ae0d-c6d50972c7e0.png Captured: 2026-09-20 10:38:48 UTC Source report: https://urlscan.io/result/01a0be65-5c00-71c4-ae0d-c6d50972c7e0/ - URLScan capture 2: https://urlscan.io/screenshots/019e0664-a2ab-732a-95b2-bb9149a9be27.png Captured: 2026-09-20 10:06:28 UTC Source report: https://urlscan.io/result/01a0be65-5c00-71c4-ae0d-c6d50972c7e0/ - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/1fca64fc-0f2d-4220-9e3f-31713ea5a499.png Captured: 2026-09-20 10:12:47 UTC Source report: https://radar.cloudflare.com/scan/1fca64fc-0f2d-4220-9e3f-31713ea5a499 SHA-256: c79d3fe07269bb08086177604216a4473c86906155ea6d127ffb1922e8c90fa9 - URLScan · 2026-09-20: https://screenshots.phishdestroy.io/us/01a0be59-5229-77dc-83a6-e645e11b7f24.png Captured: 2026-09-20 10:25:29 UTC Source report: https://urlscan.io/result/01a0be59-5229-77dc-83a6-e645e11b7f24/ SHA-256: dbb378f6718c0c31cce8c4346d9692cfdbceb642e7fb6d745643b649d962c3ff - URLScan · 2026-09-20: https://screenshots.phishdestroy.io/us/01a0be5a-a07d-76d5-89a7-902d21285979.png Captured: 2026-09-20 10:26:54 UTC Source report: https://urlscan.io/result/01a0be5a-a07d-76d5-89a7-902d21285979/ SHA-256: 5ae86a6402f30aeca509a6e8c8e144d12290449ace8f6e9210790b4249051838 ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-20T22:23:33Z", "uuid": "01a0be65-5c00-71c4-ae0d-c6d50972c7e0", "scanned_at": "2026-09-20T10:38:36Z", "final_url": "https://www.emitisandabtin.ae/", "status": 200, "redirected": "https-only", "redirects": [ { "to": "https://www.emitisandabtin.ae/", "from": "http://www.emitisandabtin.ae/", "status": 307 } ], "ip": "192.232.217.50", "ptr": "192-232-217-50.unifiedlayer.com", "domains": [ "www.gstatic.com", "www.google.com" ], "ips": [ "192.178.155.94", "142.251.151.119", "192.232.217.50" ], "asns": [ "15169", "31898" ], "countries": [ "US" ], "link_domains": [ "www.instagram.com", "www.freelancewebdesigneruae.com" ], "social": [ "https://www.instagram.com/nugenesisdubai" ], "doc_hash": "6bbd3ecf3402420d190b12fad3f2abc6c6fee01669383bf5c06add9806390388", "script_hashes": [ "7a6f60dc268c33e03b5458672ce7f514d71eced2d7671cb69b26e096832b9af9", "e5bda4e519371372e4a81ee2fa775302f47700f6cb26701b1c80052b7a7ef00a", "1e33e25019001918cd4628bbfa14b708e994e317350dad20516843b5f1a476f6", "c1081379611cb5dad53ad3b09e3184eaf1606b9f7a2c361f0f4337cc0eeb7351", "3e29b5cec01e86f088e627777b4b556876b115351aa243613a0ef4f59525def4", "ea46ecd27a55479d3e4ed5f0e9f01545b82e29d14e9381245ab6e0650eb45c00", "ccb181e68d2fb53fe406c36d901e6e1dac5cf967a2ec21910358279b39202baa" ], "globals": [ "$", "jQuery", "bootstrap", "jQuery19101953898746480749", "WOW", "wow", "openNav", "closeNav", "___grecaptcha_cfg", "grecaptcha", "__recaptcha_api", "__google_recaptcha_client", "recaptcha", "scrypt", "multiTg", "resizeFix" ], "tls": { "san": [ "*.afron.ae", "*.businnova.com", "*.emitisandabtin.ae", "*.freelancewebdesigneruae.com", "*.recgroup.ae", "afron.ae", "businnova.com", "emitisandabtin.ae", "mail.brooer.com", "recgroup.ae" ], "cipher": "AES_256_GCM", "issuer": "YR2", "subject": "*.afron.ae", "protocol": "TLS 1.3", "valid_to": "2026-10-23T15:20:46Z", "valid_from": "2026-07-25T15:20:47Z" }, "domain_age_days": 2500, "apex_age_days": 2500, "tls_age_days": 56, "tls_valid_days": 89, "requests": 55, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 28, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "Apache", "content-type": "text/html; charset=UTF-8" } }, "cf": { "v": 1, "fetched_at": "2026-10-20T22:31:26Z", "uuid": "1fca64fc-0f2d-4220-9e3f-31713ea5a499", "scanned_at": "2026-09-20T10:12:47Z", "final_url": "https://emitisandabtin.ae/", "status": 200, "history": [ { "url": "https://emitisandabtin.ae/", "status": 200 } ], "dom_hash": "d4a1c920bf7506ee01cb9752326ed7d82f01c96865fcb2aaeebc260334ad5e06", "doc_hash": "6bbd3ecf3402420d190b12fad3f2abc6c6fee01669383bf5c06add9806390388", "domain_risks": [ "Business", "Business & Economy" ], "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "emitisandabtin.ae", "type": "A", "value": "192.232.217.50" }, { "name": "www.emitisandabtin.ae", "type": "CNAME", "value": "emitisandabtin.ae" }, { "name": "emitisandabtin.ae", "type": "A", "value": "192.232.217.50" }, { "name": "www.emitisandabtin.ae", "type": "CNAME", "value": "emitisandabtin.ae" } ], "dnssec_valid": false, "ip": "192.232.217.50", "whois": { "registrar": "Etisalat", "nameservers": [ "auhans1.ecompany.ae", "auhans2.ecompany.ae", "ns6087.hostgator.com", "ns6088.hostgator.com" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-22T01:56:00Z", "analysis_at": "2026-10-14T00:53:55Z", "stats": { "timeout": 0, "harmless": 53, "malicious": 7, "suspicious": 2, "undetected": 30 }, "detections": { "ESET": "suspicious", "VIPRE": "phishing", "Webroot": "malicious", "Fortinet": "malware", "SOCRadar": "phishing", "URLQuery": "malicious", "Gridinsoft": "suspicious", "alphaMountain.ai": "phishing", "Forcepoint ThreatSeeker": "phishing" }, "reputation": 0, "popularity": { "Alexa": 331638 }, "first_seen": "2023-10-29T08:56:42Z", "dns": [ { "ttl": 14400, "type": "MX", "value": "mail.emitisandabtin.ae", "priority": 0 }, { "ttl": 21600, "type": "SOA", "rname": "root.gator3044.hostgator.com", "value": "ns6087.hostgator.com" }, { "ttl": 21600, "type": "NS", "value": "ns6087.hostgator.com" }, { "ttl": 21600, "type": "NS", "value": "ns6088.hostgator.com" }, { "ttl": 14400, "type": "TXT", "value": "v=spf1 ip4:50.87.147.253 ip4:50.87.145.69 +a +mx +ip4:50.87.144.63 ~all" }, { "ttl": 14400, "type": "A", "value": "192.232.217.50" } ], "dns_at": "2026-10-14T00:59:45Z", "jarm": "29d29d15d29d29d00042d42d000000cd600c085f371f8533aaf66051f8e5b1", "cert": { "san": [ "*.brooer.com", "*.businnova.com", "*.emitisandabtin.ae", "*.recgroup.ae", "bro.freelancewebdesigneruae.com", "brooer.com", "busi.freelancewebdesigneruae.com", "businnova.com", "emitisandabtin.ae", "recgroup.ae" ], "issuer": "Let's Encrypt / YR2", "serial": "672dffc3bfe8c15b689a9fe733756badaef", "sha256": "56887c9f92b8228e32c32a3be822d4182a3b61afbc600643f14acd27cdc1f077", "subject": "*.businnova.com", "valid_to": "2027-01-06T15:01:22Z", "valid_from": "2026-10-08T15:01:23Z" }, "whois": { "nameservers": [ "auhans1.ecompany.ae", "auhans2.ecompany.ae", "ns6087.hostgator.com", "ns6088.hostgator.com" ] } } } ```