# PhishDestroy domain threat record: xt.jspfqe.com

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/xt.jspfqe.com/
Machine-readable companion: https://phishdestroy.io/domain/xt.jspfqe.com/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-23 12:39:57 UTC
- Last availability or vendor check: 2026-10-27 23:00:53 UTC
- Stored record updated: 2026-10-27 23:26:09 UTC
- VirusTotal detections in the stored snapshot: 21/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: flagged

## Stored classification

- Targeted brand: bancodevenezuela

## Stored infrastructure

- Observed IP address: 84.247.152.62
- Registrar in stored WHOIS data: IONOS SE
- Registrar country in stored WHOIS data: DE
- Registration date (registry RDAP, jspfqe.com): 2026-08-10 13:11:35 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a168c9-9623-7461-acbb-d3a58f1d34b9/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/xt.jspfqe.com
- Certificate Transparency search: https://crt.sh/?q=%25.xt.jspfqe.com
- Web Archive lookup: https://web.archive.org/web/*/https://xt.jspfqe.com/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
The captured screenshot dated 2026-10-23 shows a Spanish-language page titled Acceso al Sistema, dressed in Banco de Venezuela colours with its logo, navigation and a BDVEn linea personas service panel. PhishDestroy first saw and listed the domain on 2026-10-23 after intake, triggered by a Google Safe Browsing SOCIAL_ENGINEERING flag.

How the scam works
The captured page enabled a credential-harvesting funnel: a visitor selects a tramite from the dropdown, clicks Comenzar solicitud, and is led through a staged banking request that collects account details while posing as the official channel. Stated requirements of an open BDV account with at least two months of history reinforce the social-engineering pretext.

Evidence
The captured screenshot shows the Banco de Venezuela logo, navigation entries SomosBDV, Para ti and Para tu empresa, a BDVEn linea personas panel, a Seccione el tramite dropdown and a Comenzar solicitud button. urlscan returned a malicious verdict with an ML score of 97 and an overall phishing score of 100 on 2026-10-23, Cloudflare Radar returned a phishing verdict on 2026-10-23, and Google Safe Browsing flagged SOCIAL_ENGINEERING on 2026-10-26. VirusTotal flagged the domain as malicious, with CRDF applying a malicious label. Spamhaus DBL showed no listing, OTX recorded 0 pulses, external blocklists counted 0 while the PhishDestroy internal blocklist flagged it, and 1 of 12 resolvers blocked it on 2026-10-26; the capture followed a 307 redirect from HTTP to HTTPS, returned 200 with no cross-site redirect, and inspection recorded 2 distinct script SHA256 hashes (first 954ffb13fa0e), obfuscated globals including validateAndProcess, and 6 tracker requests.

Infrastructure
Notable weaknesses: CSP, HSTS strict-transport, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, COOP, COEP and CORP all absent, and DNSSEC unsigned. Hosting was recorded as CAPL-AS-AP, Contabo Asia Private Limited, with no WAF or CDN shown in the capture, on a 30-day-old domain. Connections used TLS 1.3 with TLS_AES_256_GCM_SHA384, forward secrecy and ALPN http/1.1; SPF, DKIM and DMARC were configured and a CAA record was present.

What to do
If you submitted data through this captured page, change your password on the genuine Banco de Venezuela service, enable 2FA, and review recent account activity for anything unfamiliar. Defenders should block xt.jspfqe.com at proxy, DNS and mail gateways, search logs for the recorded script hashes, and report the domain to PhishDestroy.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a168c9-9623-7461-acbb-d3a58f1d34b9/
Cloudflare Radar report: https://radar.cloudflare.com/scan/b803c998-fe9a-475c-a286-3f95d6ba258d
URLQuery report: https://urlquery.net/report/2b09507c-9d6e-4e9d-b962-e3a5ce20e9bb
Stored capture screenshot: https://urlscan.io/screenshots/01a168c9-9623-7461-acbb-d3a58f1d34b9.png
Cloudflare Radar screenshot (2026-10-23T12:41:50Z): https://screenshots.phishdestroy.io/cf/b803c998-fe9a-475c-a286-3f95d6ba258d.png
URLQuery screenshot: https://screenshots.phishdestroy.io/uq/2b09507c-9d6e-4e9d-b962-e3a5ce20e9bb.png
URLScan screenshot (2026-10-22T20:47:37Z): https://screenshots.phishdestroy.io/us/01a1655e-7252-757f-8e91-e991e72e9b86.png
URLScan capture report: https://urlscan.io/result/01a1655e-7252-757f-8e91-e991e72e9b86/
URLScan screenshot (2026-10-22T21:04:31Z): https://screenshots.phishdestroy.io/us/01a1656d-eb3e-711d-aa2b-d9cf3ff5dee9.png
URLScan capture report: https://urlscan.io/result/01a1656d-eb3e-711d-aa2b-d9cf3ff5dee9/
URLScan screenshot (2026-10-23T12:46:01Z): https://screenshots.phishdestroy.io/us/01a168cb-e55b-7740-a60b-423657e4ab4b.png
URLScan capture report: https://urlscan.io/result/01a168cb-e55b-7740-a60b-423657e4ab4b/
URLScan screenshot (2026-10-23T13:05:25Z): https://screenshots.phishdestroy.io/us/01a168dd-a68c-7674-a5c2-c0aab4ee6293.png
URLScan capture report: https://urlscan.io/result/01a168dd-a68c-7674-a5c2-c0aab4ee6293/
URLScan screenshot (2026-10-23T13:06:20Z): https://screenshots.phishdestroy.io/us/01a168de-7b17-716c-b945-f9011bc27cae.png
URLScan capture report: https://urlscan.io/result/01a168de-7b17-716c-b945-f9011bc27cae/
VirusTotal report: https://www.virustotal.com/gui/domain/xt.jspfqe.com
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=xt.jspfqe.com
Archived copy: https://web.archive.org/web/20261023124129/https://xt.jspfqe.com/
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-26 22:15:49 UTC

## Stored page captures

- Primary capture: https://urlscan.io/screenshots/01a168c9-9623-7461-acbb-d3a58f1d34b9.png
  Captured: 2026-10-23 12:45:25 UTC
- URLScan capture 1: https://screenshots.phishdestroy.io/01a1656d-eb3e-711d-aa2b-d9cf3ff5dee9.png
  Captured: 2026-10-23 12:39:57 UTC
  Source report: https://urlscan.io/result/01a168c9-9623-7461-acbb-d3a58f1d34b9/
- URLScan · 2026-10-22: https://screenshots.phishdestroy.io/us/01a1655e-7252-757f-8e91-e991e72e9b86.png
  Captured: 2026-10-22 20:47:37 UTC
  Source report: https://urlscan.io/result/01a1655e-7252-757f-8e91-e991e72e9b86/
  SHA-256: d81a6dd07a25f930ec1cd39bc348566175cc89f95579755035db7dab6d2101f1
- URLScan · 2026-10-23: https://screenshots.phishdestroy.io/us/01a168cb-e55b-7740-a60b-423657e4ab4b.png
  Captured: 2026-10-23 12:46:01 UTC
  Source report: https://urlscan.io/result/01a168cb-e55b-7740-a60b-423657e4ab4b/
  SHA-256: d81a6dd07a25f930ec1cd39bc348566175cc89f95579755035db7dab6d2101f1
- URLScan · 2026-10-23: https://screenshots.phishdestroy.io/us/01a168dd-a68c-7674-a5c2-c0aab4ee6293.png
  Captured: 2026-10-23 13:05:25 UTC
  Source report: https://urlscan.io/result/01a168dd-a68c-7674-a5c2-c0aab4ee6293/
  SHA-256: d81a6dd07a25f930ec1cd39bc348566175cc89f95579755035db7dab6d2101f1
- URLScan · 2026-10-23: https://screenshots.phishdestroy.io/us/01a168de-7b17-716c-b945-f9011bc27cae.png
  Captured: 2026-10-23 13:06:20 UTC
  Source report: https://urlscan.io/result/01a168de-7b17-716c-b945-f9011bc27cae/
  SHA-256: d81a6dd07a25f930ec1cd39bc348566175cc89f95579755035db7dab6d2101f1
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/b803c998-fe9a-475c-a286-3f95d6ba258d.png
  Captured: 2026-10-23 12:41:50 UTC
  Source report: https://radar.cloudflare.com/scan/b803c998-fe9a-475c-a286-3f95d6ba258d
  SHA-256: a2b427cc6b036c3fb890f0119bba8d5a6b90c2395e9a741cd3bad2158615ff7b
- URLQuery: https://screenshots.phishdestroy.io/uq/2b09507c-9d6e-4e9d-b962-e3a5ce20e9bb.png
  Source report: https://urlquery.net/report/2b09507c-9d6e-4e9d-b962-e3a5ce20e9bb
  SHA-256: 9a613628230aeea1bfca25239122b195baee95d5ad445c9d8a7274e98b7a1ec0
- URLScan · 2026-10-22: https://screenshots.phishdestroy.io/us/01a1656d-eb3e-711d-aa2b-d9cf3ff5dee9.png
  Captured: 2026-10-22 21:04:31 UTC
  Source report: https://urlscan.io/result/01a1656d-eb3e-711d-aa2b-d9cf3ff5dee9/
  SHA-256: d81a6dd07a25f930ec1cd39bc348566175cc89f95579755035db7dab6d2101f1

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-23T12:56:13Z",
        "uuid": "01a168c9-9623-7461-acbb-d3a58f1d34b9",
        "scanned_at": "2026-10-23T12:43:31Z",
        "final_url": "https://xt.jspfqe.com/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://xt.jspfqe.com/",
                "from": "http://xt.jspfqe.com/",
                "status": 307
            }
        ],
        "ip": "84.247.152.62",
        "ptr": "vmi3644217.contaboserver.net",
        "ips": [
            "84.247.152.62"
        ],
        "asns": [
            "141995"
        ],
        "countries": [
            "JP"
        ],
        "doc_hash": "345b30055d1441cb6eaa12b1c2fc8dde582fa146bdd726b6cf1d256719be0868",
        "script_hashes": [
            "954ffb13fa0ee86b9816dee4594169061bf6aabcb10816e52362b699272a875d",
            "17dfebb7b8dbedef3e028141a045216c8315821eeefcd96a4144ed8169688766"
        ],
        "globals": [
            "_0x4eb74f",
            "_0x13aa",
            "_0x3a76",
            "validateAndProcess"
        ],
        "tls": {
            "san": [
                "*.xt.jspfqe.com",
                "xt.jspfqe.com"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "YR2",
            "subject": "xt.jspfqe.com",
            "protocol": "TLS 1.3",
            "valid_to": "2026-12-22T05:12:40Z",
            "valid_from": "2026-09-23T05:12:41Z"
        },
        "domain_age_days": 30,
        "apex_age_days": 72,
        "tls_age_days": 30,
        "tls_valid_days": 89,
        "requests": 11,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 97,
                "malicious": true
            },
            "overall": {
                "tags": [
                    "phishing"
                ],
                "score": 100,
                "brands": [
                    "bancodevenezuela"
                ],
                "malicious": true,
                "categories": [
                    "phishing"
                ]
            },
            "urlscan": {
                "tags": [
                    "phishing"
                ],
                "score": 100,
                "brands": [
                    "Banco de Venezuela"
                ],
                "malicious": true,
                "categories": [
                    "phishing"
                ]
            }
        },
        "headers": {
            "server": "Apache",
            "content-type": "text/html"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-23T12:42:32Z",
        "uuid": "b803c998-fe9a-475c-a286-3f95d6ba258d",
        "scanned_at": "2026-10-23T12:41:50Z",
        "final_url": "https://xt.jspfqe.com/",
        "status": 200,
        "history": [
            {
                "url": "https://xt.jspfqe.com/",
                "status": 200
            }
        ],
        "dom_hash": "aa821308a260ba21ff01ae3a1d3cb2a53d26417333e852e576b4f590b287902a",
        "doc_hash": "345b30055d1441cb6eaa12b1c2fc8dde582fa146bdd726b6cf1d256719be0868",
        "phishing_v2": [
            "phishing"
        ],
        "url_risks": [
            "Phishing"
        ],
        "domain_risks": [
            "Phishing",
            "Security threats",
            "CIPA Filter",
            "CIPA"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "xt.jspfqe.com",
                "type": "A",
                "value": "84.247.152.62"
            }
        ],
        "dnssec_valid": false,
        "ip": "84.247.152.62",
        "verdict": {
            "tags": [
                "phishing"
            ],
            "malicious": true,
            "categories": [
                "phishing"
            ]
        },
        "whois": {
            "registrar": "IONOS SE",
            "created": "2026-08-10T13:11:35Z",
            "updated": "2026-08-30T14:09:07Z",
            "expires": "2027-08-10T13:11:35Z",
            "nameservers": [
                "ns1.gilbertt.shop",
                "ns2.gilbertt.shop"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-23T12:41:38Z",
        "analysis_at": "2026-10-23T01:05:16Z",
        "stats": {
            "timeout": 0,
            "harmless": 0,
            "malicious": 2,
            "suspicious": 0,
            "undetected": 90
        },
        "detections": {
            "CRDF": "malicious",
            "alphaMountain.ai": "phishing"
        },
        "reputation": 0,
        "tags": [
            "dga"
        ],
        "categories": {
            "alphaMountain.ai": "Phishing (alphaMountain.ai)"
        },
        "registrar": "IONOS SE",
        "created": "2026-08-10T13:11:35Z",
        "expires": "2027-08-10T13:11:35Z",
        "updated": "2026-08-30T14:09:07Z",
        "first_seen": "2026-09-23T06:37:35Z",
        "dns": [
            {
                "ttl": 21568,
                "type": "NS",
                "value": "ns1.gilbertt.shop"
            },
            {
                "ttl": 14400,
                "type": "A",
                "value": "84.247.152.62"
            },
            {
                "ttl": 14400,
                "type": "TXT",
                "value": "v=spf1 ip4:84.247.152.62 +a +mx +ip4:84.247.156.74 ~all"
            },
            {
                "ttl": 21600,
                "type": "SOA",
                "rname": "root.vmi3644217.contaboserver.net",
                "value": "ns1.gilbertt.shop"
            },
            {
                "ttl": 14400,
                "type": "MX",
                "value": "xt.jspfqe.com",
                "priority": 0
            },
            {
                "ttl": 21568,
                "type": "NS",
                "value": "ns2.gilbertt.shop"
            }
        ],
        "dns_at": "2026-10-23T01:30:34Z",
        "jarm": "15d3fd16d29d29d00042d43d0000001ae0802418786940cae38f1d9eed5b9b",
        "cert": {
            "san": [
                "*.xt.jspfqe.com",
                "xt.jspfqe.com"
            ],
            "issuer": "Let's Encrypt / YR2",
            "serial": "6f8632a3a8449a3e58ab8cac79eb823bd59",
            "sha256": "378b75b3b86d2350b9013d068fa0b883a55225e29eacc13815fdce373f9b8a65",
            "subject": "xt.jspfqe.com",
            "valid_to": "2026-12-22T05:12:40Z",
            "valid_from": "2026-09-23T05:12:41Z"
        },
        "whois": {
            "registrar": "IONOS SE",
            "registrar_iana_id": "83",
            "registrar_url": "http://www.ionos.com",
            "created": "2026-08-10T13:11:35Z",
            "updated": "2026-08-30T14:09:07Z",
            "expires": "2027-08-10T13:11:35Z",
            "status": [
                "clientTransferProhibited"
            ],
            "nameservers": [
                "ns1.gilbertt.shop",
                "ns2.gilbertt.shop"
            ],
            "dnssec": "unsigned"
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-23T12:42:49Z",
        "mail_config": {
            "mx": [
                "xt.jspfqe.com"
            ],
            "spf": "v=spf1 ip4:84.247.152.62 +a +mx +ip4:84.247.156.74 ~all",
            "dkim": [
                "default"
            ],
            "dmarc": true,
            "dkim_bits": 2048,
            "spf_lookups": 2
        },
        "caa_records": {
            "domain": "xt.jspfqe.com"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_by": [
                "CloudFlare Family"
            ],
            "blocked_count": 1
        },
        "archives": {
            "last": "2026-10-23T12:41:29Z",
            "first": "2026-10-23T12:41:29Z",
            "changes": 0,
            "days_archived": 1,
            "avg_page_bytes": 1441
        },
        "social_tags": {
            "title": "Acceso al Sistema"
        },
        "trackers": {
            "requests": 6
        },
        "mixed_content": {
            "third_party_scripts": 0
        },
        "status": {
            "up": true,
            "code": 200,
            "timings": {
                "dns": 2,
                "tls": 233,
                "wait": 260,
                "connect": 226,
                "download": 0
            },
            "response_ms": 721
        },
        "tls_connection": {
            "alpn": "http/1.1",
            "cipher": "TLS_AES_256_GCM_SHA384",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                22,
                25,
                53,
                80,
                110,
                143,
                443,
                587,
                993,
                995,
                3306
            ]
        },
        "carbon": {
            "bytes": 2720,
            "co2_grams": 0.0001,
            "cleaner_than": 95
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "84.247.152.62",
                    "host": "ns1.gilbertt.shop"
                },
                {
                    "ip": "84.247.152.62",
                    "host": "ns2.gilbertt.shop"
                }
            ],
            "zone": "xt.jspfqe.com"
        },
        "location": {
            "ip": "84.247.152.62",
            "asn": "141995",
            "org": "Contabo GmbH",
            "city": "Tokyo",
            "country": "JP"
        },
        "ssl": {
            "issuer": "Let's Encrypt / YR2",
            "subject": "xt.jspfqe.com"
        },
        "dns": {
            "A": [
                "84.247.152.62"
            ],
            "MX": [
                "{\"exchange\": \"xt.jspfqe.com\", \"priority\": 0}"
            ],
            "NS": [
                "ns2.gilbertt.shop",
                "ns1.gilbertt.shop"
            ],
            "SOA": "{\"nsname\": \"ns1.gilbertt.shop\", \"hostmaster\": \"root.vmi3644217.contaboserver.net\", \"serial\": 2026100704, \"refresh\": 3600, \"retry\": 1800, \"expire\": 1209600, \"minttl\": 86400}",
            "TXT": [
                "v=spf1 ip4:84.247.152.62 +a +mx +ip4:84.247.156.74 ~all"
            ]
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "hsts": {
            "message": "Site does not serve any HSTS headers."
        },
        "http_security": {
            "xFrameOptions": false,
            "referrerPolicy": false,
            "xXSSProtection": false,
            "permissionsPolicy": false,
            "xContentTypeOptions": false,
            "contentSecurityPolicy": false,
            "strictTransportPolicy": false,
            "crossOriginOpenerPolicy": false,
            "crossOriginEmbedderPolicy": false,
            "crossOriginResourcePolicy": false
        },
        "get_ip": {
            "ip": "84.247.152.62",
            "family": 4
        },
        "redirects": {
            "chain": [
                "https://xt.jspfqe.com"
            ]
        },
        "tech_stack": {
            "technologies": [
                "Apache HTTP Server"
            ]
        },
        "whois": {
            "registrar": "IONOS SE",
            "created": "2026-08-10T13:11:35Z",
            "updated": "2026-08-30T14:09:07Z",
            "expires": "2027-08-10T13:11:35Z",
            "status": [
                "clientTransferProhibited https://icann.org/epp"
            ],
            "nameservers": [
                "ns1.gilbertt.shop",
                "ns2.gilbertt.shop"
            ]
        },
        "headers": {
            "headers": {
                "server": "Apache",
                "content-type": "text/html"
            }
        }
    }
}
```