# PhishDestroy domain threat record: rxc.aldex.com.au Content language: English Canonical HTML report: https://phishdestroy.io/domain/rxc.aldex.com.au/ Machine-readable companion: https://phishdestroy.io/domain/rxc.aldex.com.au/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-10-13 15:40:44 UTC - Last availability or vendor check: 2026-10-23 10:56:11 UTC - Stored record updated: 2026-10-23 18:22:30 UTC - VirusTotal detections in the stored snapshot: 10/92 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: no stored flag ## Stored infrastructure - Observed IP address: 122.201.80.143 - Registrar in stored WHOIS data: Tucows (Australia) Pty Ltd trading as OpenSRS ## Evidence links - URLScan report: https://urlscan.io/result/01a135ed-b3a3-76dc-8323-f7c12b2cdc4c/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/rxc.aldex.com.au - Certificate Transparency search: https://crt.sh/?q=%25.rxc.aldex.com.au - Web Archive lookup: https://web.archive.org/web/*/https://rxc.aldex.com.au/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview rxc.aldex.com.au is a subdomain that PhishDestroy classifies as an impersonation phishing page. It poses as a legitimate service so that visitors trust it with information they would only give the real one. PhishDestroy first flagged it on 2026-10-13, and it was still online and serving content when last checked on 2026-10-19. How the scam works Impersonation pages copy the look, wording or name of a trusted service. Victims usually arrive through a link in an email, message or ad. They are then asked to sign in, verify an account or submit personal details, and whatever they type goes straight to the operators. Those credentials are then used to take over accounts or resold. When checked, the page title read "Index of /", a bare directory listing, which differs from the impersonation content behind our classification. Evidence Ten of 92 VirusTotal engines flagged the address in a scan on 2026-10-17. The named vendors include BitDefender, CRDF, CyRadar, ESET, Fortinet, G-Data, Gridinsoft and SOCRadar. Ten detections is a modest share, but these are independent vendors with separate detection pipelines, and their agreement backs the phishing verdict. Among public blocklists, the domain currently appears on PhishDestroy's. Infrastructure The parent domain is registered through Tucows (Australia) Pty Ltd trading as OpenSRS. The site is hosted in Australia on the Dreamscape Networks Limited network (DREAMSCAPE-AS-AP). Local registration and hosting can make an .com.au address look more credible to Australian users, which is part of why a subdomain like this is easy to trust at a glance. The certificate comes from Let's Encrypt, so the padlock in the browser says nothing about whether the site is genuine. What to do If you entered a username or password on this site, change it now on the real service and on any other account that shares it. Then turn on two-factor authentication, preferably with an authenticator app or hardware key. Review recent sign-ins and account activity for anything you did not do. If you submitted payment or identity details, contact your bank or the relevant provider. Security teams should block the subdomain at DNS and web proxies, search mail and chat logs for links to it, and report it to the parent domain's owner and hosting provider so it can be taken down. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a135ed-b3a3-76dc-8323-f7c12b2cdc4c/ VirusTotal report: https://www.virustotal.com/gui/domain/rxc.aldex.com.au Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=rxc.aldex.com.au Archived copy: https://web.archive.org/web/20261013154223/https://rxc.aldex.com.au/ Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-19 09:25:27 UTC ## Stored page captures - Primary capture: https://urlscan.io/screenshots/01a135ed-b3a3-76dc-8323-f7c12b2cdc4c.png Captured: 2026-10-13 15:44:14 UTC - URLScan capture 1: https://screenshots.phishdestroy.io/01a135ed-b3a3-76dc-8323-f7c12b2cdc4c.png Captured: 2026-10-13 15:44:14 UTC Source report: https://urlscan.io/result/01a135ed-b3a3-76dc-8323-f7c12b2cdc4c/ - URLScan capture 2: https://urlscan.io/screenshots/01a1355e-2aee-7673-b99c-a26c10bdfb60.png Captured: 2026-10-13 15:40:44 UTC Source report: https://urlscan.io/result/01a135ed-b3a3-76dc-8323-f7c12b2cdc4c/ - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/f221405d-2f62-474e-8c18-e6e37f664a90.png Captured: 2026-10-13 15:44:45 UTC Source report: https://radar.cloudflare.com/scan/f221405d-2f62-474e-8c18-e6e37f664a90 SHA-256: 59d3101f56c11bc5b3f8a431d6a03b2e6b634c4f678d877ac535780709acd84c ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-20T17:48:29Z", "uuid": "01a135ed-b3a3-76dc-8323-f7c12b2cdc4c", "scanned_at": "2026-10-13T15:42:20Z", "final_url": "https://rxc.aldex.com.au/blue/v4mt/", "status": 200, "redirected": "same-domain", "redirects": [ { "to": "https://rxc.aldex.com.au/blue/v4mt", "from": "http://rxc.aldex.com.au/blue/v4mt", "status": 307 }, { "to": "https://rxc.aldex.com.au/blue/v4mt/", "from": "https://rxc.aldex.com.au/blue/v4mt", "status": 301 } ], "ip": "122.201.80.143", "ptr": "whois01.turboservers.com.au", "domains": [ "ipapi.co", "api.ipify.org", "fonts.gstatic.com" ], "ips": [ "104.26.8.44", "172.67.74.152", "142.251.110.94", "122.201.80.143" ], "asns": [ "13335", "15169", "38719" ], "countries": [ "US", "AU" ], "doc_hash": "59958bab6bb715f1c973177b8afa25e7df8884625c42cc519a4b26ae7c46f7c9", "globals": [ "isMobile", "detectOS", "escapeHTML", "showMobileModal", "sendReport", "reportVisit", "reportDownload", "triggerDownload", "initiateDownload", "WINDOWS_DOWNLOAD", "MAC_DOWNLOAD", "MAC_CONFIG_DOWNLOAD", "visitReported", "spinnerSVG", "envelopeSVG", "successSVG" ], "tls": { "san": [ "*.aldex.com.au", "aldex.com.au" ], "cipher": "AES_128_GCM", "issuer": "YR2", "subject": "*.aldex.com.au", "protocol": "TLS 1.3", "valid_to": "2026-12-25T10:56:25Z", "valid_from": "2026-09-26T10:56:26Z" }, "domain_age_days": 0, "apex_age_days": 2865, "tls_age_days": 17, "tls_valid_days": 89, "requests": 8, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 56, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "Apache", "content-type": "text/html" } }, "cf": { "v": 1, "fetched_at": "2026-10-20T18:00:54Z", "uuid": "f221405d-2f62-474e-8c18-e6e37f664a90", "scanned_at": "2026-10-13T15:44:45Z", "final_url": "https://rxc.aldex.com.au/", "status": 200, "history": [ { "url": "https://rxc.aldex.com.au/", "status": 200 } ], "dom_hash": "d0a098f187564851e37e8f4dbf015ed81b3dadc839af95e75c92d5aa56a7486c", "doc_hash": "16c5c512ecdaf98c0b01dea562bb204eb42ce2e4e1a3bac0c5d002646f50b85c", "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "rxc.aldex.com.au", "type": "A", "value": "122.201.80.143" } ], "dnssec_valid": false, "ip": "122.201.80.143", "whois": { "registrar": "Tucows (Australia) Pty Ltd trading as OpenSRS", "updated": "2026-08-15T20:24:51Z", "nameservers": [ "ns1.australiawhois.com", "ns2.australiawhois.com" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-20T21:12:52Z", "analysis_at": "2026-10-17T02:00:17Z", "stats": { "timeout": 0, "harmless": 47, "malicious": 9, "suspicious": 1, "undetected": 35 }, "detections": { "CRDF": "malicious", "ESET": "suspicious", "VIPRE": "phishing", "G-Data": "phishing", "Sophos": "phishing", "CyRadar": "phishing", "Fortinet": "phishing", "SOCRadar": "phishing", "Gridinsoft": "phishing", "BitDefender": "phishing" }, "reputation": 0, "categories": { "Sophos": "phishing and fraud" }, "first_seen": "2026-10-06T16:07:21Z", "dns": [ { "ttl": 14400, "type": "A", "value": "122.201.80.143" } ], "dns_at": "2026-10-17T02:00:35Z", "jarm": "25d3fd00025d25d00042d43d0000001b0c486b0c0bae33c7ce67177fe8bab5", "cert": { "san": [ "*.aldex.com.au", "aldex.com.au" ], "issuer": "Let's Encrypt / YR2", "serial": "6198b392ba3445f6c9447ff4c804903b4e", "sha256": "d1cc20d948b2d7bb78c381f9bbec7075749224d2c38631fc76efb87447ee0130", "subject": "*.aldex.com.au", "valid_to": "2026-12-25T10:56:25Z", "valid_from": "2026-09-26T10:56:26Z" }, "whois": { "registrar_url": "https://tucowsdomains.com/compliance-form/", "nameservers": [ "ns1.australiawhois.com", "ns2.australiawhois.com" ], "dnssec": "unsigned" } } } ```