# PhishDestroy threat dossier — home.estrovisionplus.com ================================================================ Fetched: 2026-05-01 12:15:48 UTC Canonical: https://phishdestroy.io/domain/home.estrovisionplus.com/ ## VERDICT ---------------------------------------------------------------- TAKEN DOWN (neutralised) Composite threat score: 74/100 (PhishDestroy scoring — see methodology below) ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 1/91 security vendors flagged this domain Flagging vendors: Netcraft URLQuery: 2 detections ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 198.251.83.106 (US, Staten Island) ASN: AS53667 FranTech Solutions Hosting org: FranTech Solutions Registrar: Global Domain Group LLC Nameservers: ["ns25.asurahosting.com", "ns25.my-control-panel.com", "ns26.asurahosting.com", "ns26.my-control-panel.com"] Registered: 2026-04-27 Page title: Bot Verification HTTP response: 200 ## TLS CERTIFICATE ---------------------------------------------------------------- Issuer: Let's Encrypt / R12 Expires: 2026-06-27 Status: INVALID chain Fingerprint: 4e57bc667a49234256bf012eeb812ac943494ac8a6c7f3c889ce732d317ef133 Subject Alternative Names (related infrastructure — often same operator): - www.home.estrovisionplus.com ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: CLOSED — no report required. This domain was neutralised before the abuse-report cycle could be dispatched — either the hosting provider / registrar suspended it on their own, the DNS went dead, or the operator abandoned the infrastructure. PhishDestroy keeps the evidence bundle on file for audit but no formal notice was sent. ## TIMELINE ---------------------------------------------------------------- Domain registered: 2026-04-27 (per WHOIS / CT — may reflect a renewal or transfer date, not first-ever registration) First detected: 2026-04-27 20:15:08 UTC (by PhishDestroy tracker) Earliest abuse rec: 2026-04-27 17:20:36 UTC — PREDATES current WHOIS registration; retained from a previous registration cycle of the same domain name Last verified: 2026-05-01 11:58:59 UTC Neutralised: 2026-04-28 14:43:35 UTC Current status: taken down (registrar suspended or DNS dead) Note: one or more events above predate the WHOIS creation date. This typically means the same domain name was previously registered, detected, dropped, and then re-registered by a new party. PhishDestroy preserves the full historical record for operator-attribution research even when the underlying infrastructure changes hands. ## EXTERNAL CORROBORATION (third-party evidence) ---------------------------------------------------------------- URLScan.io: https://urlscan.io/result/019dcfee-dd49-733d-a228-4b32b72d10e0/ URLQuery: https://urlquery.net/report/0e776bb7-53b5-4676-bdc2-4583acac2ec4 Wayback Machine: https://web.archive.org/web/*/home.estrovisionplus.com crt.sh CT logs: https://crt.sh/?q=%25.home.estrovisionplus.com Google transparency: https://transparencyreport.google.com/safe-browsing/search?url=home.estrovisionplus.com AlienVault OTX: https://otx.alienvault.com/indicator/domain/home.estrovisionplus.com URLhaus: https://urlhaus.abuse.ch/host/home.estrovisionplus.com/ ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-04-27 20:16:34 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] PhishDestroy identifies the domain home.estrovisionplus.com as an active phishing page titled 'Bot Verification'. This site mimics a security checkpoint to steal login credentials from unsuspecting users. It is currently unflagged by VirusTotal despite being created on May 17, 2025, and resolves to IP 198.251.83.106 hosted through Global Domain Group LLC using a Let's Encrypt SSL certificate. This threat falls under technical-support phishing designed to trick visitors into entering personal or financial information under the guise of bot detection. The domain's recent creation and low detection count highlight the importance of verifying unknown sites before clicking. PhishDestroy's analysis relies on VirusTotal's static scan results and infrastructure tracking to flag emerging threats like this one. If you visited home.estrovisionplus.com, cease any interaction immediately and avoid entering personal details on the page. Clear your browser cache and run a malware scan using a trusted antivirus tool. Report the domain to your IT team or security platform to help disrupt its operation. Always verify URLs carefully and use bookmarks for trusted sites to avoid similar traps in the future. ## EVIDENCE HASHES ---------------------------------------------------------------- PhishDestroy Case ID: PD-20260427-263332 TLS cert SHA-256: 4e57bc667a49234256bf012eeb812ac943494ac8a6c7f3c889ce732d317ef133 ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (volunteer takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/home.estrovisionplus.com/ JSON API: https://api.destroy.tools/v1/check?domain=home.estrovisionplus.com Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: volunteer-driven open-source threat-intelligence platform. Tracked: 131,000+ phishing domains. Confirmed takedowns: 91,000+. Site: https://phishdestroy.io