# PhishDestroy domain threat record: especialistassm.com.mx Content language: English Canonical HTML report: https://phishdestroy.io/domain/especialistassm.com.mx/ Machine-readable companion: https://phishdestroy.io/domain/especialistassm.com.mx/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-10-10 23:27:06 UTC - Last availability or vendor check: 2026-10-22 10:27:59 UTC - Stored record updated: 2026-10-22 16:07:29 UTC - VirusTotal detections in the stored snapshot: 13/92 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: no stored flag ## Stored infrastructure - Observed IP address: 69.49.241.94 - Registrar in stored WHOIS data: GoDaddy.com - Registrar country in stored WHOIS data: US - Last stored HTTP status: 200 - Registration date in stored WHOIS data: 2018-09-17 22:00:00 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a12822-8439-72b8-aaa2-0957f59fbd28/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/especialistassm.com.mx - Certificate Transparency search: https://crt.sh/?q=%25.especialistassm.com.mx - Web Archive lookup: https://web.archive.org/web/*/https://especialistassm.com.mx/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview especialistassm.com.mx presents itself as the homepage of a Mexican company, with the page title "Home - Especialistas en Servicios Múltiples Tonac". PhishDestroy classifies it as an impersonation phishing page that uses a business identity to win the trust of visitors and customers. We first flagged it on 2026-10-11. As of 2026-10-19 the site is still online and serving content. How the scam works Impersonation pages borrow a familiar name and a convincing layout so that visitors drop their guard. They are then asked to log in, submit contact or payment details, or follow links and downloads that seem to come from the business. Victims typically lose account credentials, personal information or money paid for services that never arrive. The page title shows an ordinary services company homepage, while our classification is impersonation phishing. Evidence 13 of 92 VirusTotal engines flagged the domain as of 2026-10-12. The vendors include alphaMountain.ai, BitDefender, CyRadar, Dr.Web, Forcepoint ThreatSeeker, Fortinet, G-Data and Gridinsoft. Because these are independent vendors with different detection methods, their agreement is a meaningful signal even though most engines have not yet flagged the site. The domain appears in 34 AlienVault OTX pulses, so other researchers have tracked it as well. PhishDestroy lists it on its own blocklist. Infrastructure The domain was registered through GoDaddy.com on 2018-09-18, about eight years before we detected it. A long-standing domain like this carries more credibility than a freshly registered lookalike. It may also mean an older site has been repurposed or compromised. The site resolves to 69.49.241.94 on Oracle Corporation's network (ORACLE-BMC-31898), geolocated to Brazil, which is an unusual pairing for a business that presents as Mexican. Its certificate is a free one from Let's Encrypt, so the padlock in the browser only means the connection is encrypted and says nothing about whether the site is trustworthy. What to do If you entered a username and password here, change that password right away. Change it anywhere else you reused it too, and turn on two-factor authentication. If you submitted card or bank details, or paid for a service through this site, contact your bank to block the card and dispute the charges. Be wary of follow-up calls or emails that mention the business by name. Defenders should block the domain and its IP at the proxy and DNS layers, then search their logs for visits or form submissions from users since 2026-10-11. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a12822-8439-72b8-aaa2-0957f59fbd28/ VirusTotal report: https://www.virustotal.com/gui/domain/especialistassm.com.mx Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=especialistassm.com.mx Archived copy: https://web.archive.org/web/20250327224400/https://especialistassm.com.mx/ Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-19 09:27:09 UTC ## Stored page captures - Primary capture: https://i.ibb.co/GD3L7Mx/a8c22413b12f.png Captured: 2026-10-10 23:27:06 UTC - URLScan capture: https://screenshots.phishdestroy.io/01a12822-8439-72b8-aaa2-0957f59fbd28.png Captured: 2026-10-10 23:27:06 UTC Source report: https://urlscan.io/result/01a12822-8439-72b8-aaa2-0957f59fbd28/ - URLScan · 2026-10-17: https://screenshots.phishdestroy.io/us/01a1479e-c837-710c-8e9d-262ef3819d15.png Captured: 2026-10-17 02:09:29 UTC Source report: https://urlscan.io/result/01a1479e-c837-710c-8e9d-262ef3819d15/ SHA-256: 6dad963a9865d186b723cbd8b3c3fd64a57594305176f7e33d29e60be02c0b7e ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-20T18:33:02Z", "uuid": "01a12822-8439-72b8-aaa2-0957f59fbd28", "scanned_at": "2026-10-10T23:25:22Z", "final_url": "https://especialistassm.com.mx/", "status": 200, "redirected": "https-only", "redirects": [ { "to": "https://especialistassm.com.mx/", "from": "http://especialistassm.com.mx/", "status": 307 } ], "ip": "69.49.241.94", "ptr": "69-49-241-94.unifiedlayer.com", "domains": [ "images.builderservices.io", "gfonts-proxy.wzdev.co", "in-us-east-event-hubs.servicebus.windows.net", "hostingapi.mywebsitebuilder.com", "components.mywebsitebuilder.com", "storage.googleapis.com", "in-app.mywebsitebuilder.com", "runtime.builderservices.io" ], "ips": [ "2600:1901:4022:1b00::", "172.191.248.91", "2606:4700::6811:3e6f", "2606:4700::42eb:c80c", "2606:4700::6810:286d", "69.49.241.94" ], "asns": [ "396982", "8075", "13335", "31898" ], "countries": [ "US", "BR" ], "link_domains": [ "api.whatsapp.com", "storage.googleapis.com" ], "social": [ "https://api.whatsapp.com/send" ], "doc_hash": "ed3c5a218379c51b19acad4e02a72812f83acfc574c8ca580ebc1b2825d5a640", "script_hashes": [ "8f018d674b6caaf2c63e2a9574c7ae858aa66ccfdceea05b384019320a337131" ], "globals": [ "__features", "_featureSettings", "_page", "_WP_JSONP", "regeneratorRuntime", "2f1acc6c3a606b082e5eef5e54414ffb", "_xsrfToken", "Velocity", "_GoogleMapsApi", "_isPublished", "_site", "__bi__", "_feature_events", "showModal", "_zoomUpdateEvents", "EventHubHistory" ], "cookies": [ "__cf_bm", "app_key", "app_ses_key" ], "storage_keys": [ "a" ], "tls": { "san": [ "*.especialistassm.com.mx", "especialistassm.com.mx" ], "cipher": "AES_256_GCM", "issuer": "YR1", "subject": "especialistassm.com.mx", "protocol": "TLS 1.3", "valid_to": "2026-12-25T14:35:05Z", "valid_from": "2026-09-26T14:35:06Z" }, "domain_age_days": 2917, "apex_age_days": 2917, "tls_age_days": 14, "tls_valid_days": 89, "requests": 22, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": -92, "malicious": false }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "Apache", "content-type": "text/html" } }, "cf": { "v": 1, "fetched_at": "2026-10-20T18:44:28Z", "uuid": "d756958e-8ead-4075-8612-4b1938327190", "scanned_at": "2026-10-12T11:16:44Z" }, "vt": { "v": 1, "fetched_at": "2026-10-21T02:38:03Z", "analysis_at": "2026-10-11T00:17:55Z", "stats": { "timeout": 0, "harmless": 44, "malicious": 12, "suspicious": 1, "undetected": 35 }, "detections": { "Dr.Web": "malicious", "G-Data": "phishing", "Lionic": "malicious", "Sophos": "phishing", "CyRadar": "malicious", "Webroot": "malicious", "Fortinet": "malware", "SOCRadar": "malicious", "Seclookup": "malicious", "Gridinsoft": "malicious", "BitDefender": "phishing", "alphaMountain.ai": "phishing", "Forcepoint ThreatSeeker": "suspicious" }, "reputation": 0, "categories": { "alphaMountain.ai": "Phishing (alphaMountain.ai)" }, "popularity": { "Majestic": 749774 }, "registrar": "GoDaddy.com", "first_seen": "2023-10-05T12:49:13Z", "dns": [ { "ttl": 21600, "type": "NS", "value": "nspro36.hostgator.mx" }, { "ttl": 14400, "type": "MX", "value": "mail.especialistassm.com.mx", "priority": 0 }, { "ttl": 14400, "type": "A", "value": "69.49.241.94" }, { "ttl": 21600, "type": "SOA", "rname": "root.sh-pro36.hostgator.mx", "value": "nspro36.hostgator.mx" }, { "ttl": 21600, "type": "NS", "value": "nspro37.hostgator.mx" }, { "ttl": 14400, "type": "TXT", "value": "v=spf1 a mx include:websitewelcome.com ~all" } ], "dns_at": "2026-10-11T00:23:54Z", "jarm": "29d29d15d29d29d00042d42d000000cd600c085f371f8533aaf66051f8e5b1", "cert": { "san": [ "*.especialistassm.com.mx", "especialistassm.com.mx" ], "issuer": "Let's Encrypt / YR1", "serial": "5cfdde5eb900165c297df928c0746939927", "sha256": "ef8a302fe5c1cc27445c158117691468e7669075c68e991fdd3eaa89f24b8b5e", "subject": "especialistassm.com.mx", "valid_to": "2026-12-25T14:35:05Z", "valid_from": "2026-09-26T14:35:06Z" }, "whois": { "registrar": "GoDaddy.com" } } } ```