# PhishDestroy domain threat record: mimultasmx.com Content language: English Canonical HTML report: https://phishdestroy.io/domain/mimultasmx.com/ Machine-readable companion: https://phishdestroy.io/domain/mimultasmx.com/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-10-23 08:27:39 UTC - Last availability or vendor check: 2026-10-23 11:24:23 UTC - Stored record updated: 2026-10-23 18:22:04 UTC - VirusTotal detections in the stored snapshot: 0/92 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: no stored flag ## Stored infrastructure - Observed IP address: 68.66.226.115 - Registrar in stored WHOIS data: Hosting Concepts B.V. d/b/a Registrar.eu - Registrar country in stored WHOIS data: MX - Last stored HTTP status: 200 - Registration date (registry RDAP, mimultasmx.com): 2026-10-01 12:07:13 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a167de-2b6e-701e-a3e3-5fc7a7ff85bf/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/mimultasmx.com - Certificate Transparency search: https://crt.sh/?q=%25.mimultasmx.com - Web Archive lookup: https://web.archive.org/web/*/https://mimultasmx.com/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview PhishDestroy’s intake AI assessment marked mimultasmx.com as malicious because the site impersonates the Gobierno de México, displays a “Sistema Digital de Infracciones” title and requests vehicle identifiers and payment information. The domain was registered on 2026-10-01, making it 21 days old at the time of the first sighting. PhishDestroy first observed the page on 2026-10-23 and recorded an HTTP 200 response. How the scam works In this phishing variant attackers clone the visual design and language of an official government portal to lure users into entering vehicle registration data such as plate, VIN or driver’s license and to submit online payments. The harvested information can be used for identity theft, fraudulent billing or resale to other criminals. Evidence A VirusTotal scan retrieved on 2026-10-23 (analysis date 2026-10-18) reported 0 malicious and 0 suspicious detections from 92 engines. Google Safe Browsing checked on 2026-10-23 did not flag the domain. URLScan’s analysis on 2026-10-23 gave a malicious verdict with a score of 100, categorising the site as phishing and associating it with the Mexican government brand. OTX listed three pulses referencing the domain as of 2026-10-23. PhishDestroy’s internal blocklist contains the domain while external blocklists returned no matches on the same date. Infrastructure The domain was registered on 2026-10-01 through Hosting Concepts B.V. d/b/a Registrar.eu and resolves to 68.66.226.115, an address owned by A2 Hosting, Inc. in the United States. TLS was provided by Let’s Encrypt, valid from 2026-10-02 to 2026-12-31, and the authoritative nameservers are ns1‑ns4.a2hosting.com. What to do Anyone who may have entered personal or payment details should treat those credentials as compromised, change related passwords and monitor financial statements for unauthorized activity. Organizations should add mimultasmx.com to their threat‑intel feeds and block the domain at the network perimeter, while reviewing logs for connections to the recorded IP address. Continue to monitor the domain for any changes in behavior or new indicators. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a167de-2b6e-701e-a3e3-5fc7a7ff85bf/ Cloudflare Radar report: https://radar.cloudflare.com/scan/eb6bd5dd-a276-41bd-b0da-f3f5d313af63 URLQuery report: https://urlquery.net/report/7b77f29f-23ee-45b7-b512-cc46e68338dc Stored capture screenshot: https://i.ibb.co/rRFDKf32/a8bc2498a5ee.png Cloudflare Radar screenshot (2026-10-23T08:59:26Z): https://screenshots.phishdestroy.io/cf/eb6bd5dd-a276-41bd-b0da-f3f5d313af63.png URLQuery screenshot: https://screenshots.phishdestroy.io/uq/7b77f29f-23ee-45b7-b512-cc46e68338dc.png URLScan screenshot (2026-10-23T08:31:11Z): https://screenshots.phishdestroy.io/us/01a167e2-8f39-7527-98ea-c8549c576efb.png URLScan capture report: https://urlscan.io/result/01a167e2-8f39-7527-98ea-c8549c576efb/ VirusTotal report: https://www.virustotal.com/gui/domain/mimultasmx.com Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=mimultasmx.com Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-23 09:00:38 UTC ## Stored page captures - Primary capture: https://i.ibb.co/rRFDKf32/a8bc2498a5ee.png Captured: 2026-10-23 08:27:39 UTC - URLScan capture: https://screenshots.phishdestroy.io/01a167de-2b6e-701e-a3e3-5fc7a7ff85bf.png Captured: 2026-10-23 08:27:39 UTC Source report: https://urlscan.io/result/01a167de-2b6e-701e-a3e3-5fc7a7ff85bf/ - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/eb6bd5dd-a276-41bd-b0da-f3f5d313af63.png Captured: 2026-10-23 08:59:26 UTC Source report: https://radar.cloudflare.com/scan/eb6bd5dd-a276-41bd-b0da-f3f5d313af63 SHA-256: c5e05c5aee30049d46f60b4d5a1c1c1a558e32d7f18ef9be1ec4f06d6439a5fc - URLQuery: https://screenshots.phishdestroy.io/uq/7b77f29f-23ee-45b7-b512-cc46e68338dc.png Source report: https://urlquery.net/report/7b77f29f-23ee-45b7-b512-cc46e68338dc SHA-256: 5ecbc463a15f26a76542c6a291c7cec3416c92938f81720781b7f62ae30ccbe2 - URLScan · 2026-10-23: https://screenshots.phishdestroy.io/us/01a167e2-8f39-7527-98ea-c8549c576efb.png Captured: 2026-10-23 08:31:11 UTC Source report: https://urlscan.io/result/01a167e2-8f39-7527-98ea-c8549c576efb/ SHA-256: ef3116aebc2775432acc1d9c728bf840bfed68e377f5734e6c32c1123c18870c ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-23T08:59:40Z", "uuid": "01a167de-2b6e-701e-a3e3-5fc7a7ff85bf", "scanned_at": "2026-10-23T08:26:23Z", "final_url": "https://mimultasmx.com/", "status": 200, "ip": "68.66.226.115", "ptr": "az1-ss101.a2hosting.com", "domains": [ "cdnjs.cloudflare.com", "cdn.tailwindcss.com", "fonts.gstatic.com", "fonts.googleapis.com", "framework-gb.cdn.gob.mx" ], "ips": [ "142.250.195.163", "104.17.24.14", "142.250.195.138", "104.26.2.143", "68.66.226.115" ], "asns": [ "15169", "13335", "55293" ], "countries": [ "US" ], "link_domains": [ "web.mimultasmx.com" ], "doc_hash": "9b78afc60f140f040e48d844d569a2696695fa53f7e32d29f5093380c2bbddfc", "globals": [ "tailwind", "/template.html", "toggleMobileMenu", "handleSystemRedirect" ], "tls": { "san": [ "autoconfig.mimultasmx.com", "autodiscover.mimultasmx.com", "cpanel.mimultasmx.com", "cpcalendars.mimultasmx.com", "cpcontacts.mimultasmx.com", "mail.mimultasmx.com", "mimultasmx.com", "webdisk.mimultasmx.com", "webmail.mimultasmx.com", "www.mimultasmx.com" ], "cipher": "AES_128_GCM", "issuer": "YR1", "subject": "webdisk.mimultasmx.com", "protocol": "TLS 1.3", "valid_to": "2026-12-31T01:12:42Z", "valid_from": "2026-10-02T01:12:43Z" }, "domain_age_days": 21, "apex_age_days": 21, "tls_age_days": 21, "tls_valid_days": 89, "requests": 10, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 98, "malicious": true }, "overall": { "tags": [ "phishing" ], "score": 100, "brands": [ "govmx" ], "malicious": true, "categories": [ "phishing" ] }, "urlscan": { "tags": [ "phishing" ], "score": 100, "brands": [ "Mexican Government" ], "malicious": true, "categories": [ "phishing" ] } }, "headers": { "server": "LiteSpeed", "content-type": "text/html", "strict-transport-security": "max-age=63072000; includeSubDomains", "x-frame-options": "SAMEORIGIN", "x-content-type-options": "nosniff" } }, "cf": { "v": 1, "fetched_at": "2026-10-23T08:59:46Z", "uuid": "eb6bd5dd-a276-41bd-b0da-f3f5d313af63", "scanned_at": "2026-10-23T08:59:26Z", "final_url": "https://mimultasmx.com/", "status": 200, "history": [ { "url": "https://mimultasmx.com/", "status": 200 } ], "dom_hash": "bcfec5359b9ad36b7cf93360c63ca3c8f6fc9f5e425e63607d4862bd066e2937", "doc_hash": "9b78afc60f140f040e48d844d569a2696695fa53f7e32d29f5093380c2bbddfc", "domain_risks": [ "Newly Seen Domains", "Security Risks", "New Domains", "Politics, Advocacy, and Government-Related", "Government & Politics" ], "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "mimultasmx.com", "type": "A", "value": "68.66.226.115" } ], "dnssec_valid": false, "ip": "68.66.226.115", "whois": { "registrar": "Hosting Concepts B.V. d/b/a Registrar.eu", "created": "2026-10-01T12:07:13Z", "updated": "2026-10-15T16:13:31Z", "expires": "2027-10-01T12:07:13Z", "nameservers": [ "ns1.a2hosting.com", "ns2.a2hosting.com", "ns3.a2hosting.com", "ns4.a2hosting.com" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-23T08:59:23Z", "analysis_at": "2026-10-18T18:33:16Z", "stats": { "timeout": 0, "harmless": 55, "malicious": 0, "suspicious": 0, "undetected": 37 }, "reputation": 0, "registrar": "Hosting Concepts B.V. d/b/a Registrar.eu", "created": "2026-10-01T12:07:13Z", "expires": "2027-10-01T12:07:13Z", "updated": "2026-10-02T03:33:03Z", "first_seen": "2026-10-02T03:44:54Z", "dns": [ { "ttl": 21600, "type": "NS", "value": "ns4.a2hosting.com" }, { "ttl": 21600, "type": "NS", "value": "ns2.a2hosting.com" }, { "ttl": 14400, "type": "TXT", "value": "v=spf1 +a +mx +ip4:68.66.226.115 include:spf.a2hosting.com ~all" }, { "ttl": 21600, "type": "NS", "value": "ns1.a2hosting.com" }, { "ttl": 14400, "type": "MX", "value": "mail.mimultasmx.com", "priority": 0 }, { "ttl": 21600, "type": "NS", "value": "ns3.a2hosting.com" }, { "ttl": 14400, "type": "A", "value": "68.66.226.115" }, { "ttl": 21600, "type": "SOA", "rname": "root.az1-ss101.a2hosting.com", "value": "ns1.a2hosting.com" } ], "dns_at": "2026-10-18T18:43:25Z", "jarm": "2ad2ad0002ad2ad00042d43d00041d598ac0c1012db967bb1ad0ff2491b3ae", "cert": { "san": [ "autoconfig.mimultasmx.com", "autodiscover.mimultasmx.com", "cpanel.mimultasmx.com", "cpcalendars.mimultasmx.com", "cpcontacts.mimultasmx.com", "mail.mimultasmx.com", "mimultasmx.com", "webdisk.mimultasmx.com", "webmail.mimultasmx.com", "www.mimultasmx.com" ], "issuer": "Let's Encrypt / YR1", "serial": "58eb9bae958d9fa9d9870d85779eac3e82c", "sha256": "d69755d3c63f6d22f27c34a8e8927de1ca9b4721798ac0b9b00f746ab7b8590d", "subject": "webdisk.mimultasmx.com", "valid_to": "2026-12-31T01:12:42Z", "valid_from": "2026-10-02T01:12:43Z" }, "whois": { "registrar": "Hosting Concepts B.V. d/b/a Registrar.eu", "registrar_iana_id": "1647", "registrar_url": "http://www.openprovider.com", "created": "2026-10-01T12:07:13Z", "updated": "2026-10-02T01:33:01Z", "expires": "2027-10-01T12:07:13Z", "status": [ "clientTransferProhibited" ], "nameservers": [ "ns1.a2hosting.com", "ns2.a2hosting.com", "ns3.a2hosting.com", "ns4.a2hosting.com" ], "dnssec": "unsigned" }, "rdap": { "status": [ "client transfer prohibited" ], "events": { "expiration": "2027-10-01T12:07:13Z", "registration": "2026-10-01T12:07:13Z", "registrar expiration": "2027-10-01T12:07:13Z", "last update of RDAP database": "2026-10-18T18:43:25Z" } } }, "webcheck": { "v": 1, "fetched_at": "2026-10-23T08:36:51Z", "mail_config": { "mx": [ "mail.mimultasmx.com" ], "spf": "v=spf1 +a +mx +ip4:68.66.226.115 include:spf.a2hosting.com ~all", "dkim": [ "default" ], "dmarc": true, "dkim_bits": 2048, "spf_lookups": 4 }, "caa_records": { "domain": "mimultasmx.com" }, "block_lists": { "resolvers": 12, "blocked_count": 0 }, "social_tags": { "title": "Sistema Digital de Infracciones | Gobierno de México", "author": "Gobierno de México", "robots": "index, follow", "keywords": "infracciones, multas transito, consulta vehicular, adeudos tenencia, pago multas, gobierno mexico, placa, niv, licencia conducir, repuve, sdi", "description": "Consulta y paga tus infracciones de tránsito federales y estatales en línea. Verifica adeudos vehiculares por Placa, NIV o Licencia en el Sistema Digital de Infracciones del Gobierno de México." }, "mixed_content": { "no_sri": [ "https://cdn.tailwindcss.com/" ], "third_party_scripts": 1 }, "status": { "up": true, "code": 200, "timings": { "dns": 15, "tls": 172, "wait": 170, "connect": 165, "download": 158 }, "response_ms": 680 }, "tls_connection": { "alpn": "h2", "cipher": "TLS_AES_256_GCM_SHA384", "protocol": "TLSv1.3", "versions": [ "TLSv1.2", "TLSv1.3" ], "authorized": true, "forward_secrecy": true }, "ports": { "open": [ 21, 22, 25, 80, 110, 143, 443, 587, 993, 995 ] }, "carbon": { "bytes": 25015, "co2_grams": 0.0009, "cleaner_than": 52 }, "dns_server": { "ns": [ { "ip": "75.2.118.134", "host": "ns2.a2hosting.com" }, { "ip": "76.223.26.245", "host": "ns3.a2hosting.com" }, { "ip": "13.248.158.180", "host": "ns1.a2hosting.com" }, { "ip": "99.83.147.209", "host": "ns4.a2hosting.com" } ], "zone": "mimultasmx.com" }, "location": { "ip": "68.66.226.115", "asn": "55293", "org": "A2 Hosting, Inc.", "city": "Phoenix", "country": "US" }, "ssl": { "issuer": "Let's Encrypt / YR1", "subject": "webdisk.mimultasmx.com" }, "dns": { "A": [ "68.66.226.115" ], "MX": [ "{\"exchange\": \"mail.mimultasmx.com\", \"priority\": 0}" ], "NS": [ "ns4.a2hosting.com", "ns3.a2hosting.com", "ns2.a2hosting.com", "ns1.a2hosting.com" ], "SOA": "{\"nsname\": \"ns1.a2hosting.com\", \"hostmaster\": \"root.az1-ss101.a2hosting.com\", \"serial\": 2026100212, \"refresh\": 3600, \"retry\": 1800, \"expire\": 1209600, \"minttl\": 86400}", "TXT": [ "v=spf1 +a +mx +ip4:68.66.226.115 include:spf.a2hosting.com ~all" ] }, "dnssec": { "ds": false, "rrsig": false, "dnskey": false }, "hsts": { "header": "max-age=63072000; includeSubDomains", "message": "HSTS header does not contain the preload directive." }, "http_security": { "xFrameOptions": "SAMEORIGIN", "referrerPolicy": false, "xXSSProtection": false, "permissionsPolicy": false, "xContentTypeOptions": "nosniff", "contentSecurityPolicy": false, "strictTransportPolicy": "max-age=63072000; includeSubDomains", "crossOriginOpenerPolicy": false, "crossOriginEmbedderPolicy": false, "crossOriginResourcePolicy": false }, "get_ip": { "ip": "68.66.226.115", "family": 4 }, "redirects": { "chain": [ "https://mimultasmx.com" ] }, "linked_pages": { "external": [ "https://web.mimultasmx.com/" ], "external_count": 1, "internal_count": 4 }, "whois": { "registrar": "Hosting Concepts B.V. d/b/a Registrar.eu", "created": "2026-10-01T12:07:13Z", "updated": "2026-10-15T16:13:31Z", "expires": "2027-10-01T12:07:13Z", "status": [ "clientTransferProhibited https://icann.org/epp" ], "nameservers": [ "ns1.a2hosting.com", "ns2.a2hosting.com", "ns3.a2hosting.com", "ns4.a2hosting.com" ] }, "headers": { "headers": { "server": "LiteSpeed", "content-type": "text/html", "strict-transport-security": "max-age=63072000; includeSubDomains", "x-frame-options": "SAMEORIGIN", "x-content-type-options": "nosniff" } } } } ```