# PhishDestroy domain threat record: fanaticaviation.com

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/fanaticaviation.com/
Machine-readable companion: https://phishdestroy.io/domain/fanaticaviation.com/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-10 22:08:01 UTC
- Last availability or vendor check: 2026-10-22 10:28:20 UTC
- Stored record updated: 2026-10-22 16:07:29 UTC
- VirusTotal detections in the stored snapshot: 14/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored infrastructure

- Observed IP address: 202.183.141.189
- Registrar in stored WHOIS data: Onlinenic Inc
- Registrar country in stored WHOIS data: TH
- Last stored HTTP status: 200
- Registration date (registry RDAP, fanaticaviation.com): 2019-03-13 07:12:04 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a127da-ec73-70dc-8341-98430d4a6ec3/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/fanaticaviation.com
- Certificate Transparency search: https://crt.sh/?q=%25.fanaticaviation.com
- Web Archive lookup: https://web.archive.org/web/*/https://fanaticaviation.com/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
fanaticaviation.com is on the PhishDestroy blocklist as a suspicious domain. Its page presents itself as "Fanaticaviation - Home", the kind of title you would expect on an ordinary aviation-themed homepage, which contrasts with the security flags it has collected. PhishDestroy first logged it on 2026-10-11. As of 2026-10-19 the site was still online and serving content.

How the scam works
No specific scheme or impersonated brand has been confirmed for this domain, so the risk comes from its reputation rather than an identified kit. A site flagged by multiple security vendors may host phishing forms, push malicious downloads or redirect visitors to fraudulent pages. For crypto users, the realistic dangers are typing credentials or seed phrases into the page, or approving wallet prompts that hand control of funds to someone else. Treat anything on the site that asks for logins, recovery phrases or a wallet connection as hostile.

Evidence
On 2026-10-12, 14 of 92 VirusTotal engines marked the domain as malicious. The flagging vendors include Kaspersky, BitDefender, Dr.Web, G-Data, Forcepoint ThreatSeeker, alphaMountain.ai, CyRadar and Gridinsoft, a spread of independent engines rather than one outlier. The domain also appears in 34 AlienVault OTX threat pulses, which indicates repeated attention from the wider threat-intelligence community. Among blocklists, only PhishDestroy currently lists it.

Infrastructure
The domain was registered on 2019-03-13 through Onlinenic Inc, more than seven years before PhishDestroy flagged it. An aged domain like this can be a legitimate site that was later compromised, or one that changed hands, so its age does not make it safe. It resolves to an address on the SBN-ISP/AWN-ISP network in Thailand.

What to do
If you only browsed the site, clear your browser cache and run a malware scan, especially if anything was downloaded. If you entered a password there, change it everywhere you reuse it and turn on two-factor authentication. If you typed in a seed phrase, assume the wallet is compromised and move funds to a new wallet created on a clean device. If you connected a wallet and signed anything, review and revoke token approvals with a trusted approval-checking tool. Defenders should block the domain and its hosting IP at DNS and proxy level and check logs for past visits from internal users.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a127da-ec73-70dc-8341-98430d4a6ec3/
VirusTotal report: https://www.virustotal.com/gui/domain/fanaticaviation.com
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=fanaticaviation.com
Archived copy: https://web.archive.org/web/20230529122303/http://fanaticaviation.com/
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 10:39:45 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/RkP14ggP/7b84cb4a7f31.png
  Captured: 2026-10-10 22:08:01 UTC
- URLScan capture 1: https://screenshots.phishdestroy.io/01a127da-ec73-70dc-8341-98430d4a6ec3.png
  Captured: 2026-10-10 22:08:01 UTC
  Source report: https://urlscan.io/result/01a127da-ec73-70dc-8341-98430d4a6ec3/
- URLScan capture 2: https://urlscan.io/screenshots/01a0d264-8b5e-774a-8a14-21b1763ffed2.png
  Captured: 2026-10-10 21:34:54 UTC
  Source report: https://urlscan.io/result/01a127da-ec73-70dc-8341-98430d4a6ec3/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/06c6d951-9b3e-45fd-948e-df2b7a53443d.png
  Captured: 2026-10-12 11:52:23 UTC
  Source report: https://radar.cloudflare.com/scan/06c6d951-9b3e-45fd-948e-df2b7a53443d
  SHA-256: 6a6425ad1153e5f8c508867f6c465ce7ec51557bd73361ff0512219c818e6c2a
- URLQuery: https://screenshots.phishdestroy.io/uq/8ab3613e-aaf8-49ff-9a65-5104642561d1.png
  Source report: https://urlquery.net/report/8ab3613e-aaf8-49ff-9a65-5104642561d1
  SHA-256: 8b7b8eeaec29fd637b6f954d32454cedc466278a6f330478e581b3c11377ef3f
- URLScan · 2026-09-24: https://screenshots.phishdestroy.io/us/01a0d264-8b5e-774a-8a14-21b1763ffed2.png
  Captured: 2026-09-24 07:50:08 UTC
  Source report: https://urlscan.io/result/01a0d264-8b5e-774a-8a14-21b1763ffed2/
  SHA-256: ab606fd399302ef6499c3d9a073c5d21cc7d3ad73f508970416b5d67936ef53f
- URLScan · 2026-10-10: https://screenshots.phishdestroy.io/us/01a127bf-79df-7486-9fdb-e6cd33bfe82c.png
  Captured: 2026-10-10 21:37:34 UTC
  Source report: https://urlscan.io/result/01a127bf-79df-7486-9fdb-e6cd33bfe82c/
  SHA-256: f212a92cf5f5120a2854484ae06722eb135519bcceb80adb2094e9bf5dfa17bf
- URLScan · 2026-10-10: https://screenshots.phishdestroy.io/us/01a127c7-25f7-7346-adbc-9f8d1ad334da.png
  Captured: 2026-10-10 21:45:57 UTC
  Source report: https://urlscan.io/result/01a127c7-25f7-7346-adbc-9f8d1ad334da/
  SHA-256: f212a92cf5f5120a2854484ae06722eb135519bcceb80adb2094e9bf5dfa17bf

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-20T18:33:42Z",
        "uuid": "01a127da-ec73-70dc-8341-98430d4a6ec3",
        "scanned_at": "2026-10-10T22:07:35Z",
        "final_url": "https://fanaticaviation.com/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://fanaticaviation.com/",
                "from": "http://fanaticaviation.com/",
                "status": 307
            }
        ],
        "ip": "202.183.141.189",
        "ptr": "clnhost1959.thaidata.cloud",
        "domains": [
            "stackpath.bootstrapcdn.com",
            "fonts.googleapis.com"
        ],
        "ips": [
            "104.18.10.207",
            "142.251.20.95",
            "202.183.141.189"
        ],
        "asns": [
            "13335",
            "15169",
            "45458"
        ],
        "countries": [
            "US",
            "TH"
        ],
        "link_domains": [
            "www.linkedin.com",
            "www.hinetcomputer.com"
        ],
        "doc_hash": "a4fb2b18dcb2d88caa6152721dc2d79a7ac645437cb56e5f22320b520900d301",
        "tls": {
            "san": [
                "fanaticaviation.com",
                "www.fanaticaviation.com"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "RapidSSL TLS RSA CA G1",
            "subject": "fanaticaviation.com",
            "protocol": "TLS 1.3",
            "valid_to": "2027-04-25T23:59:59Z",
            "valid_from": "2026-10-09T00:00:00Z"
        },
        "domain_age_days": 2502,
        "apex_age_days": 2502,
        "tls_age_days": 1,
        "tls_valid_days": 198,
        "requests": 8,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 69,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "LiteSpeed",
            "content-type": "text/html",
            "x-powered-by": "PleskLin"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-20T18:45:06Z",
        "uuid": "06c6d951-9b3e-45fd-948e-df2b7a53443d",
        "scanned_at": "2026-10-12T11:52:23Z",
        "final_url": "https://fanaticaviation.com/",
        "status": 200,
        "history": [
            {
                "url": "https://fanaticaviation.com/",
                "status": 200
            }
        ],
        "dom_hash": "98df8c22f5147b631d4f58e5e86d683966144a92622ef2057cc6329b9677515c",
        "doc_hash": "a4fb2b18dcb2d88caa6152721dc2d79a7ac645437cb56e5f22320b520900d301",
        "domain_risks": [
            "Business",
            "Business & Economy"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "fanaticaviation.com",
                "type": "A",
                "value": "202.183.141.189"
            },
            {
                "name": "www.fanaticaviation.com",
                "type": "A",
                "value": "202.183.141.189"
            }
        ],
        "dnssec_valid": false,
        "ip": "202.183.141.189",
        "whois": {
            "registrar": "OnlineNIC, Inc.",
            "created": "2019-03-13T07:12:04Z",
            "updated": "2026-10-04T06:59:07Z",
            "expires": "2027-03-13T07:12:04Z",
            "nameservers": [
                "jill.ns.cloudflare.com",
                "phil.ns.cloudflare.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-21T02:38:51Z",
        "analysis_at": "2026-10-15T20:02:14Z",
        "stats": {
            "timeout": 0,
            "harmless": 46,
            "malicious": 13,
            "suspicious": 2,
            "undetected": 31
        },
        "detections": {
            "VIPRE": "malware",
            "Dr.Web": "malicious",
            "G-Data": "malware",
            "Lionic": "malware",
            "Sophos": "malware",
            "CyRadar": "malicious",
            "Webroot": "malicious",
            "SOCRadar": "phishing",
            "URLQuery": "suspicious",
            "Kaspersky": "phishing",
            "Seclookup": "malicious",
            "Gridinsoft": "malicious",
            "BitDefender": "malware",
            "alphaMountain.ai": "malicious",
            "Forcepoint ThreatSeeker": "suspicious"
        },
        "reputation": 0,
        "categories": {
            "Dr.Web": "known infection source",
            "Sophos": "spyware and malware",
            "Webroot": "Malware Sites",
            "BitDefender": "auto",
            "alphaMountain.ai": "Business/Economy, Malicious (alphaMountain.ai)",
            "Forcepoint ThreatSeeker": "compromised websites. business and economy"
        },
        "popularity": {
            "Majestic": 875934
        },
        "created": "2019-03-13T00:00:00Z",
        "updated": "2026-03-08T00:00:00Z",
        "first_seen": "2023-09-29T05:14:27Z",
        "dns": [
            {
                "ttl": 300,
                "type": "A",
                "value": "202.183.141.189"
            },
            {
                "ttl": 3600,
                "type": "MX",
                "value": "mx.zoho.com",
                "priority": 10
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "jill.ns.cloudflare.com"
            },
            {
                "ttl": 3600,
                "type": "MX",
                "value": "mx2.zoho.com",
                "priority": 20
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "phil.ns.cloudflare.com"
            },
            {
                "ttl": 1800,
                "type": "SOA",
                "rname": "dns.cloudflare.com",
                "value": "jill.ns.cloudflare.com"
            },
            {
                "ttl": 3600,
                "type": "TXT",
                "value": "zoho-verification=zb37839195.zmverify.zoho.com"
            },
            {
                "ttl": 3600,
                "type": "MX",
                "value": "mx3.zoho.com",
                "priority": 50
            },
            {
                "ttl": 3600,
                "type": "TXT",
                "value": "v=spf1 a ip4:114.119.188.73 mx ip4:27.254.81.83 include:spf.mandrillapp.com include:spf.smtp2go.com include:spf.mailmaster.co.th include:zoho.com ~all"
            }
        ],
        "dns_at": "2026-10-15T20:14:54Z",
        "jarm": "29d29d00029d29d00042d43d00041d598ac0c1012db967bb1ad0ff2491b3ae",
        "cert": {
            "san": [
                "fanaticaviation.com",
                "www.fanaticaviation.com"
            ],
            "issuer": "DigiCert Inc / RapidSSL TLS RSA CA G1",
            "serial": "1ca594a2c0edce0d13f80f091766a9b",
            "sha256": "3dcba7ceaa70a3f684ec933d23d58498f97653cd450ddbe499f83a4f82c75580",
            "subject": "fanaticaviation.com",
            "valid_to": "2027-04-25T23:59:59Z",
            "valid_from": "2026-10-09T00:00:00Z"
        },
        "whois": [],
        "rdap": {
            "status": [
                "active"
            ],
            "events": {
                "expiration": "2027-03-13T04:00:00Z",
                "registration": "2019-03-13T04:00:00Z",
                "registrar expiration": "2027-03-13T04:00:00Z",
                "last update of RDAP database": "2026-02-27T05:07:24Z"
            },
            "registrar": "OnlineNIC, Inc.",
            "registrar_iana_id": "82"
        }
    }
}
```