# PhishDestroy domain threat record: tictel.pt

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/tictel.pt/
Machine-readable companion: https://phishdestroy.io/domain/tictel.pt/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-09-19 11:02:41 UTC
- Last availability or vendor check: 2026-10-22 10:33:52 UTC
- Stored record updated: 2026-10-22 16:07:29 UTC
- VirusTotal detections in the stored snapshot: 12/91
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored infrastructure

- Observed IP address: 185.113.141.250
- Registrar in stored WHOIS data: REGISTRAR_NOT_FOUND
- Registrar country in stored WHOIS data: Unknown
- Last stored HTTP status: 200
- Registration date in stored WHOIS data: 2004-05-02 22:00:00 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a0b953-b0ea-751e-a508-07aee6c8ffc1/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/tictel.pt
- Certificate Transparency search: https://crt.sh/?q=%25.tictel.pt
- Web Archive lookup: https://web.archive.org/web/*/https://tictel.pt/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
tictel.pt is an impersonation phishing page that carries the title "TICTEL — Clothing Manufacturer" and presents itself as a garment-industry business. The page title points to a clothing manufacturer, while PhishDestroy classifies the site as impersonation phishing. It is aimed at customers, suppliers and business contacts who expect a legitimate manufacturer's website. PhishDestroy first recorded it on 2026-09-19, and it was still online with live content on 2026-10-19.

How the scam works
Impersonation pages borrow a believable business identity so that visitors lower their guard. A manufacturer's branding suits schemes aimed at trade contacts, such as fake order portals, invoice or payment-detail requests, and login prompts that capture email or account credentials. Victims who interact typically lose passwords, personal or company information, or money sent against what looks like a routine business transaction.

Evidence
On 2026-09-29, 12 of 91 VirusTotal engines flagged the domain. The vendors that flagged it include alphaMountain.ai, BitDefender, Chong Lua Dao, ESET, Forcepoint ThreatSeeker, Fortinet, Gridinsoft and Lionic. That is a minority of engines, but the flags come from several unrelated security companies, which makes a single false positive an unlikely explanation. The domain also appears in five AlienVault OTX threat pulses and on the PhishDestroy blocklist.

Infrastructure
The domain was registered on 2004-05-03, more than two decades before PhishDestroy detected it. Its age does not make it safe, because a long-established name can carry trust that a freshly registered one cannot. The site is hosted in Portugal on the I4W - Web Solutions, Lda network at 185.113.141.250.

What to do
If you entered a password on this site, change it immediately, along with any other account that shares it, and turn on two-factor authentication. If you submitted payment or bank details, or paid an invoice linked to it, contact your bank right away to dispute or stop the transfer. Confirm any order or payment request through a phone number or contact you already trust, not one shown on the page. Security teams should block the domain at DNS, proxy and mail gateways. They should also search mail logs for messages referencing it and reset credentials for any user who reached the page.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a0b953-b0ea-751e-a508-07aee6c8ffc1/
VirusTotal report: https://www.virustotal.com/gui/domain/tictel.pt
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=tictel.pt
Archived copy: https://web.archive.org/web/20260919110122/https://tictel.pt/
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 09:39:10 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/W432Qvz7/e270976db0ad.png
  Captured: 2026-09-19 11:02:41 UTC
- URLScan capture 1: https://screenshots.phishdestroy.io/01a0b953-b0ea-751e-a508-07aee6c8ffc1.png
  Captured: 2026-09-19 11:02:41 UTC
  Source report: https://urlscan.io/result/01a0b953-b0ea-751e-a508-07aee6c8ffc1/
- URLScan capture 2: https://urlscan.io/screenshots/01a03cbc-fc05-7229-88be-58d4cedc0709.png
  Captured: 2026-09-19 10:57:42 UTC
  Source report: https://urlscan.io/result/01a0b953-b0ea-751e-a508-07aee6c8ffc1/
- URLQuery: https://screenshots.phishdestroy.io/uq/6b1d7c37-7e9e-48e1-95e1-fbf6985d3037.png
  Captured: 2026-09-19 11:05:41 UTC
  Source report: https://urlquery.net/report/6b1d7c37-7e9e-48e1-95e1-fbf6985d3037
  SHA-256: 814cb64f045725cbbca94dc9987a270ee80e339f0c1fd6a4479053de2d7a70e4
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/8414695a-7f38-4dfb-b5d9-779b79d4f7c6.png
  Captured: 2026-09-19 11:36:18 UTC
  Source report: https://radar.cloudflare.com/scan/8414695a-7f38-4dfb-b5d9-779b79d4f7c6
  SHA-256: e6849ecb90c5fc6e2782ee4db769981de0a046e03bd8e86ecf0419cc39b34c3c
- URLScan · 2026-07-30: https://screenshots.phishdestroy.io/us/019fb221-93fd-730d-b2ab-f22bff2f71e1.png
  Captured: 2026-07-30 08:26:19 UTC
  Source report: https://urlscan.io/result/019fb221-93fd-730d-b2ab-f22bff2f71e1/
  SHA-256: a31672da1469a3de9c6fc7dab17f6593e6bc77130302af70d77bf11785050b9c
- URLScan · 2026-08-04: https://screenshots.phishdestroy.io/us/019fcb70-735b-713c-9b2f-9370e00169b6.png
  Captured: 2026-08-04 06:22:58 UTC
  Source report: https://urlscan.io/result/019fcb70-735b-713c-9b2f-9370e00169b6/
  SHA-256: 0bafc18ba983850760592c79bec64e34eb2d32931541015629934373b78d0a59
- URLScan · 2026-08-26: https://screenshots.phishdestroy.io/us/01a03cbc-f083-700c-b6d9-3fdf837f78f5.png
  Captured: 2026-08-26 06:23:38 UTC
  Source report: https://urlscan.io/result/01a03cbc-f083-700c-b6d9-3fdf837f78f5/
  SHA-256: 8dba1727b04bf7f4707142763d8c05c5cd36ba980c83c49ff1b202315183101b
- URLScan · 2026-08-26: https://screenshots.phishdestroy.io/us/01a03cbc-f705-726e-8aec-398a2883afa1.png
  Captured: 2026-08-26 06:23:43 UTC
  Source report: https://urlscan.io/result/01a03cbc-f705-726e-8aec-398a2883afa1/
  SHA-256: 8dba1727b04bf7f4707142763d8c05c5cd36ba980c83c49ff1b202315183101b
- URLScan · 2026-08-26: https://screenshots.phishdestroy.io/us/01a03cbc-fc05-7229-88be-58d4cedc0709.png
  Captured: 2026-08-26 06:23:51 UTC
  Source report: https://urlscan.io/result/01a03cbc-fc05-7229-88be-58d4cedc0709/
  SHA-256: 8dba1727b04bf7f4707142763d8c05c5cd36ba980c83c49ff1b202315183101b
- URLScan · 2026-09-19: https://screenshots.phishdestroy.io/us/01a0b955-3d73-7564-9ff6-428b06fa2aea.png
  Captured: 2026-09-19 11:02:53 UTC
  Source report: https://urlscan.io/result/01a0b955-3d73-7564-9ff6-428b06fa2aea/
  SHA-256: 5052983b5178c18876526d03136d62f18a381b81654bee5c12370f86d7e51ec3

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-20T22:25:58Z",
        "uuid": "01a0b953-b0ea-751e-a508-07aee6c8ffc1",
        "scanned_at": "2026-09-19T11:01:15Z",
        "final_url": "https://tictel.pt/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://tictel.pt/",
                "from": "http://tictel.pt/",
                "status": 307
            }
        ],
        "ip": "185.113.141.250",
        "ptr": "cp4.maskcloud.net",
        "domains": [
            "fonts.gstatic.com",
            "fonts.googleapis.com"
        ],
        "ips": [
            "142.251.16.94",
            "172.253.62.95",
            "185.113.141.250"
        ],
        "asns": [
            "15169",
            "204094"
        ],
        "countries": [
            "US",
            "PT"
        ],
        "doc_hash": "cab8302f1d92fd58c41c32c1720f4d2f6ab2a28f8e0cbfd14553add58af39d58",
        "script_hashes": [
            "1c81ddb5a4ad794db10e0dcf3a531b1ceca86c9e75a72ef1545e8d9a5489ee02"
        ],
        "globals": [
            "setLang",
            "toggleMenu",
            "closeMenu",
            "checkHam",
            "submitForm",
            "T",
            "lang",
            "cur",
            "cdot",
            "obs"
        ],
        "tls": {
            "san": [
                "*.tictel.pt",
                "tictel.pt"
            ],
            "cipher": "AES_256_GCM",
            "issuer": "YR1",
            "subject": "tictel.pt",
            "protocol": "TLS 1.3",
            "valid_to": "2026-12-10T08:07:34Z",
            "valid_from": "2026-09-11T08:07:35Z"
        },
        "domain_age_days": 3560,
        "apex_age_days": 3560,
        "tls_age_days": 8,
        "tls_valid_days": 89,
        "requests": 21,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": -61,
                "malicious": false
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "nginx",
            "content-type": "text/html",
            "x-frame-options": "SAMEORIGIN",
            "x-content-type-options": "nosniff",
            "referrer-policy": "strict-origin-when-cross-origin"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-20T22:33:00Z",
        "uuid": "8414695a-7f38-4dfb-b5d9-779b79d4f7c6",
        "scanned_at": "2026-09-19T11:36:18Z",
        "final_url": "https://tictel.pt/",
        "status": 200,
        "history": [
            {
                "url": "https://tictel.pt/",
                "status": 200
            }
        ],
        "dom_hash": "f7838dab18d2e1075a02b8e88185bd82569378eee6486de8d6e1f931bf024118",
        "doc_hash": "cab8302f1d92fd58c41c32c1720f4d2f6ab2a28f8e0cbfd14553add58af39d58",
        "domain_risks": [
            "Fashion",
            "Society & Lifestyle"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "tictel.pt",
                "type": "A",
                "value": "185.113.141.250"
            },
            {
                "name": "tictel.pt",
                "type": "AAAA",
                "value": "2a03:0:141::250"
            }
        ],
        "dnssec_valid": false,
        "ip": "185.113.141.250",
        "whois": {
            "created": "2004-05-03T00:00:00Z",
            "expires": "2026-11-02T23:59:00Z",
            "nameservers": [
                "ns1.topdns.pt",
                "ns2.topdns.pt",
                "ns3.topdns.pt"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-22T03:25:43Z",
        "analysis_at": "2026-10-15T20:14:05Z",
        "stats": {
            "timeout": 0,
            "harmless": 46,
            "malicious": 15,
            "suspicious": 0,
            "undetected": 31
        },
        "detections": {
            "DNS8": "phishing",
            "ESET": "phishing",
            "VIPRE": "phishing",
            "G-Data": "phishing",
            "Lionic": "phishing",
            "Sophos": "phishing",
            "CyRadar": "phishing",
            "Fortinet": "phishing",
            "SOCRadar": "phishing",
            "Seclookup": "malicious",
            "Gridinsoft": "phishing",
            "BitDefender": "phishing",
            "Chong Lua Dao": "malicious",
            "alphaMountain.ai": "phishing",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "categories": {
            "Sophos": "phishing and fraud",
            "alphaMountain.ai": "Business/Economy, Phishing (alphaMountain.ai)",
            "Forcepoint ThreatSeeker": "phishing and other frauds. business and economy"
        },
        "popularity": {
            "Cisco Umbrella": 942150
        },
        "dns": [
            {
                "ttl": 21600,
                "type": "NS",
                "value": "ns3.topdns.pt"
            },
            {
                "ttl": 21600,
                "type": "SOA",
                "rname": "cpanel.innov4web.pt",
                "value": "ns1.topdns.pt"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "ns1.topdns.pt"
            },
            {
                "ttl": 14400,
                "type": "MX",
                "value": "tictel.pt",
                "priority": 0
            },
            {
                "ttl": 14400,
                "type": "AAAA",
                "value": "2a03:0:141::250"
            },
            {
                "ttl": 14400,
                "type": "A",
                "value": "185.113.141.250"
            },
            {
                "ttl": 14400,
                "type": "TXT",
                "value": "v=spf1 +a +mx +ip4:185.113.141.250 include:spf.pro.innov4web.pt +include:spf.mailbox.pt -all"
            },
            {
                "ttl": 14400,
                "type": "TXT",
                "value": "google-site-verification=2KMlN5dVGmw0IipCSpEKByX1TQHL4KB6amK8TOXqspM"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "ns2.topdns.pt"
            }
        ],
        "dns_at": "2026-10-15T20:58:33Z",
        "jarm": "29d29d15d29d29d00042d42d000000df133019600a83abfb096ff3e86cd79d",
        "cert": {
            "san": [
                "*.tictel.pt",
                "tictel.pt"
            ],
            "issuer": "Let's Encrypt / YR1",
            "serial": "6f41b48339e06c8db76589879b051bd544d",
            "sha256": "cf02c2f8ac7cafbcf59a8786f70ddb2a46a1e0818e279c2b72d346f1d2054050",
            "subject": "tictel.pt",
            "valid_to": "2026-12-10T08:07:34Z",
            "valid_from": "2026-09-11T08:07:35Z"
        }
    }
}
```