termoting[.]si

PhishDestroy first observed termoting.si on Jun 11, 2026. The captured page title is “Ogrevalni sistemi, inštalacije, kopalnice | Termoting.si”. Stored page analysis classifies the content as credential phishing. Current evidence score: 80/100 (critical).

Positive findings are stored from 2 sources: VirusTotal and DNS security resolvers. VirusTotal recorded 6 detections among 91 engines: alphaMountain.ai, CRDF, Forcepoint ThreatSeeker, Gridinsoft, Netcraft, SOCRadar on Jul 28, 2026 at 02:42 UTC. DNS security checks returned 2 blocking results across 13 tested policies: Control D Family, Control D Malware; no observation timestamp was retained. Non-positive and contextual checks: The separate external-blocklist snapshot contained no matches on Aug 8, 2026 at 10:20 UTC. Google Safe Browsing returned no flag on Jun 25, 2026 at 21:36 UTC. URLScan completed without a malicious verdict (score 0) on Jul 29, 2026 at 02:34 UTC.

HTTP 301 was recorded on Aug 8, 2026 at 10:41 UTC. Registration records for the domain list T-2 d.o.o. as the registrar and Jun 11, 2026 as the creation date. Registration and first observation occurred on the same UTC date. At collection time, the hostname resolved to 89.212.89.3 on AS34779 (T-2, d.o.o.). The recorded endpoint location is Ljubljana, SI. The stored server header is Apache. The evidence archive retains 1 visual capture from PhishDestroy. TLS metadata lists Let's Encrypt as the certificate issuer with validity through Jul 21, 2026; checked Jun 11, 2026 at 19:00 UTC.

The content indicators and 2 positive source findings support the current credential phishing classification.