# PhishDestroy domain threat record: algofairvests.click Content language: English Canonical HTML report: https://phishdestroy.io/domain/algofairvests.click/ Machine-readable companion: https://phishdestroy.io/domain/algofairvests.click/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-10-22 02:01:03 UTC - Last availability or vendor check: 2026-10-22 10:49:49 UTC - Stored record updated: 2026-10-22 16:07:29 UTC - VirusTotal detections in the stored snapshot: 13/92 - Independent public blocklist matches in the stored snapshot: 2 - Matching public blocklists: MetaMask, SEAL - Google Safe Browsing stored result: flagged ## Stored classification - Targeted brand: binance ## Stored infrastructure - Observed IP address: 192.142.10.129 - Registrar in stored WHOIS data: Global Domain Group LLC - Registrar country in stored WHOIS data: US - Registration date (registry RDAP, algofairvests.click): 2026-09-12 22:05:44 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a16157-330c-7131-9fde-78ebfc6922f1/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/algofairvests.click - Certificate Transparency search: https://crt.sh/?q=%25.algofairvests.click - Web Archive lookup: https://web.archive.org/web/*/https://algofairvests.click/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview PhishDestroy’s automated assessment classifies algofairvests.click as an impersonation phishing page. The recorded page title was “ALGO FAIR‑VEST” and the page advertised a bogus investment service. The domain was first seen by PhishDestroy on 2026-10-22 and returned HTTP 200 at that time. How the scam works Impersonation phishing pages copy the look and wording of legitimate brands to trick visitors into entering credentials, personal data, or cryptocurrency wallet details. Collected information can be used for account takeover, unauthorized transfers, or resale on underground markets. Evidence VirusTotal scanned the domain on 2026-10-22 and reported 13 detections across 92 engines (12 malicious, 1 suspicious). Google Safe Browsing flagged the site as SOCIAL_ENGINEERING on the same date. urlscan.io recorded a malicious verdict with a score of 100 on 2026-10-22 (and an earlier capture on 2026-10-01). External blocklists MetaMask and SEAL list the domain, Spamhaus DBL marks it as spam, and OTX references it in four pulses. Infrastructure The domain was registered with Global Domain Group LLC on 2026-09-12, giving it a recorded age of 38 days at capture. The recorded IP was 192.142.10.129 and the hosting organization was listed as Ultahost, Inc. in the Netherlands. TLS was provided by a Let’s Encrypt certificate valid from 2026-09-13 to 2026-12-12 for *.algofairvests.click; nameservers were pro1.ecositespace.com and pro2.ecositespace.com, DNSSEC was not enabled, and ports such as 22, 25, 53, 80, 443, and 3306 were observed as open. What to do Do not submit any credentials, payment information, or wallet details on the site; if you have already done so, change passwords immediately and monitor related accounts for unauthorized activity. Report the domain to your email and web security providers and add it to relevant blocklists. Security teams should block the domain, review access logs for connections, and enforce filtering based on the external blocklists that listed it. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a16157-330c-7131-9fde-78ebfc6922f1/ Cloudflare Radar report: https://radar.cloudflare.com/scan/d836d092-3f59-482d-a83a-7dbd920e47cc URLQuery report: https://urlquery.net/report/84693a2c-1370-4460-a15f-9cff4b5695f9 Stored capture screenshot: https://i.ibb.co/jk4v5XBK/ad7b8e232b1f.png Cloudflare Radar screenshot (2026-10-22T02:01:25Z): https://screenshots.phishdestroy.io/cf/d836d092-3f59-482d-a83a-7dbd920e47cc.png URLQuery screenshot: https://screenshots.phishdestroy.io/uq/84693a2c-1370-4460-a15f-9cff4b5695f9.png URLScan screenshot (2026-10-01T14:53:20Z): https://screenshots.phishdestroy.io/us/01a0f7f4-84f0-71fd-9149-4b8169244f86.png URLScan capture report: https://urlscan.io/result/01a0f7f4-84f0-71fd-9149-4b8169244f86/ URLScan screenshot (2026-10-22T02:06:33Z): https://screenshots.phishdestroy.io/us/01a1615c-1120-7048-82d0-fcc039149958.png URLScan capture report: https://urlscan.io/result/01a1615c-1120-7048-82d0-fcc039149958/ VirusTotal report: https://www.virustotal.com/gui/domain/algofairvests.click Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=algofairvests.click Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-22 04:32:36 UTC ## Stored page captures - Primary capture: https://i.ibb.co/jk4v5XBK/ad7b8e232b1f.png Captured: 2026-10-22 02:02:27 UTC - URLScan capture 1: https://screenshots.phishdestroy.io/01a16157-330c-7131-9fde-78ebfc6922f1.png Captured: 2026-10-22 02:02:27 UTC Source report: https://urlscan.io/result/01a16157-330c-7131-9fde-78ebfc6922f1/ - URLScan capture 2: https://urlscan.io/screenshots/01a0f7f4-84f0-71fd-9149-4b8169244f86.png Captured: 2026-10-22 02:01:03 UTC Source report: https://urlscan.io/result/01a16157-330c-7131-9fde-78ebfc6922f1/ - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/d836d092-3f59-482d-a83a-7dbd920e47cc.png Captured: 2026-10-22 02:01:25 UTC Source report: https://radar.cloudflare.com/scan/d836d092-3f59-482d-a83a-7dbd920e47cc SHA-256: 4e3520a6d0e7ace65e824cd820f9195babe619037d03c3066797ee0599955005 - URLQuery: https://screenshots.phishdestroy.io/uq/84693a2c-1370-4460-a15f-9cff4b5695f9.png Source report: https://urlquery.net/report/84693a2c-1370-4460-a15f-9cff4b5695f9 SHA-256: baeaeac5bb2faa0bcdac260fac87767c738afe17558211454b9c059e25554d7d - URLScan · 2026-10-01: https://screenshots.phishdestroy.io/us/01a0f7f4-84f0-71fd-9149-4b8169244f86.png Captured: 2026-10-01 14:53:20 UTC Source report: https://urlscan.io/result/01a0f7f4-84f0-71fd-9149-4b8169244f86/ SHA-256: ee61dd9165222903fc8eb8bb8acd2a490c310b9ab7c82afa6046c80ad5a0d9ae - URLScan · 2026-10-22: https://screenshots.phishdestroy.io/us/01a1615c-1120-7048-82d0-fcc039149958.png Captured: 2026-10-22 02:06:33 UTC Source report: https://urlscan.io/result/01a1615c-1120-7048-82d0-fcc039149958/ SHA-256: 233639d9584f53062c15536f69c829c1bd07169d488d15223189d56dcefdbda8 ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-22T02:31:42Z", "uuid": "01a16157-330c-7131-9fde-78ebfc6922f1", "scanned_at": "2026-10-22T02:01:17Z", "final_url": "https://algofairvests.click/", "status": 200, "redirected": "https-only", "redirects": [ { "to": "https://algofairvests.click/", "from": "http://algofairvests.click/", "status": 307 } ], "ip": "192.142.10.129", "ptr": "server1.ecositespace.com", "domains": [ "www.youtube.com", "app.chaport.com", "assets.chaport.com", "coin-images.coingecko.com", "fonts.gstatic.com", "jnn-pa.googleapis.com", "googleads.g.doubleclick.net", "www.cryptocompare.com", "use.fontawesome.com", "i.ytimg.com", "www.google.com", "static.doubleclick.net", "widgets.cryptocompare.com", "api.coingecko.com", "fonts.googleapis.com", "widgets.coingecko.com", "translate.yandex.net", "code.tidio.co", "translate.google.com" ], "ips": [ "2001:4860:4844:400::", "2a00:1450:4001:c0f::77", "142.251.156.119", "142.251.151.4", "2a00:1450:4001:c21::94", "192.178.183.157", "104.18.30.136", "2606:4700:20::681a:e2d", "172.67.142.173", "2001:4860:4826:400::", "20.126.215.223", "172.66.172.219", "142.251.127.94", "2a00:1450:4001:c25::5f", "104.18.5.118" ], "asns": [ "15169", "13335", "8075", "13238", "214036" ], "countries": [ "US", "DE", "NL", "RU" ], "link_domains": [ "www.blockchain.com", "www.cryptocompare.com", "www.chaport.com" ], "doc_hash": "ed56e57d2fd03640fbefc88bb3bc54b09daeeb840c7bf87c826c02bf9a9718da", "script_hashes": [ "160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef", "587c080125b135d29a931ed371e50ffc1a9641831c1087de2cd74532815f4560", "eb795deda8983fa5310627c9584cf3f3b95d272567113500059018b3941cb267", "23fc25133ed072cdf7dae575213067b1da3c6843b2a0e489c8b7fc984c60ce6b", "1fd8c0cfffd02e40cecbf9f313d1b86988a342d90bb7d16f1a67544f0064ea0b", "f2beb92898142c10e2661c03c9d7d6ac4931df2c95fe0ac6b06cda7a4a1b9e02", "96abf166b3cbb5f7df525d86fdeeeccea4af3c120b19bc26b0613530a94e8b44", "186e4c2c470e3c1c76997b7a4dfd0f618b38311582e0578db05ccada6fd43c6c", "f5118c2117300dcd406002417f201608dc046ee26b0680d4c1c93ecd01d7cc2d" ], "globals": [ "$", "jQuery", "Popper", "bootstrap", "moment", "EvEmitter", "imagesLoaded", "__core-js_shared__", "core", "nav", "functionConfirm", "scripts", "embedder", "baseUrl", "googleTranslateElementInit", "changeLanguageByButtonClick", "changeLanguageByButtonClick2", "chaportConfig", "chaport", "fabric", "saveAs", "XLSX", "XLS", "cccCurrentTheme", "cccCreateCSSSelector", "cccglobal_data", "cccupdating", "cccloading_counter", "cccfsym", "ccctsym", "cccscale", "ccclimit", "cccperiod", "cccaggregate", "cccminPeriod", "cccforceAll", "cccchart_type", "chartBTC", "colors", "validateCheckboxes" ], "cookies": [ "bh", "XSRF-TOKEN", "trademartpro_session", "_yasc", "__Secure-YNID", "YSC", "__Secure-ROLLOUT_TOKEN", "VISITOR_INFO1_LIVE", "VISITOR_PRIVACY_METADATA", "__cf_bm", "chaport-6aa69bdda318a94e44ab2311" ], "storage_keys": [ "cp_test", "wsc_session_started_at", "wsc_visitor-data", "wsc_page_views", "wsc_pages" ], "tls": { "san": [ "*.algofairvests.click", "algofairvests.click" ], "cipher": "AES_128_GCM", "issuer": "YR1", "subject": "*.algofairvests.click", "protocol": "TLS 1.3", "valid_to": "2026-12-12T11:09:24Z", "valid_from": "2026-09-13T11:09:25Z" }, "domain_age_days": 38, "apex_age_days": 38, "tls_age_days": 38, "tls_valid_days": 89, "requests": 98, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 99, "malicious": true }, "overall": { "tags": [ "phishing" ], "score": 100, "brands": [ "genericscam" ], "malicious": true, "categories": [ "phishing" ] }, "urlscan": { "tags": [ "phishing" ], "score": 100, "brands": [ "Generic Scam" ], "malicious": true, "categories": [ "phishing" ] } }, "headers": { "server": "Apache", "content-type": "text/html; charset=UTF-8" } }, "cf": { "v": 1, "fetched_at": "2026-10-22T02:01:56Z", "uuid": "d836d092-3f59-482d-a83a-7dbd920e47cc", "scanned_at": "2026-10-22T02:01:25Z", "final_url": "https://algofairvests.click/", "status": 200, "history": [ { "url": "https://algofairvests.click/", "status": 200 } ], "dom_hash": "b2368ef3be55efa5c091530acdad7c4a23b38eff44599cf5a67e44e4e300b24d", "doc_hash": "ed56e57d2fd03640fbefc88bb3bc54b09daeeb840c7bf87c826c02bf9a9718da", "phishing_v2": [ "phishing" ], "url_risks": [ "Scam" ], "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "algofairvests.click", "type": "A", "value": "192.142.10.129" } ], "dnssec_valid": false, "ip": "192.142.10.129", "whois": { "registrar": "Global Domain Group LLC", "created": "2026-09-12T22:05:44Z", "updated": "2026-09-22T20:06:40Z", "expires": "2027-09-12T22:05:44Z", "nameservers": [ "pro1.ecositespace.com", "pro2.ecositespace.com" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-22T04:32:06Z", "analysis_at": "2026-10-22T03:18:48Z", "stats": { "timeout": 0, "harmless": 44, "malicious": 12, "suspicious": 1, "undetected": 35 }, "detections": { "CRDF": "malicious", "ESET": "phishing", "VIPRE": "phishing", "G-Data": "phishing", "Lionic": "phishing", "Sophos": "phishing", "Fortinet": "spam", "Netcraft": "malicious", "Kaspersky": "phishing", "BitDefender": "phishing", "alphaMountain.ai": "phishing", "Google Safe Browsing": "phishing", "Forcepoint ThreatSeeker": "phishing" }, "reputation": 0, "registrar": "Global Domain Group LLC", "created": "2026-09-12T22:05:44Z", "expires": "2027-09-12T22:05:44Z", "updated": "2026-09-22T20:06:40Z", "first_seen": "2026-09-13T12:36:36Z", "dns": [ { "ttl": 14400, "type": "MX", "value": "algofairvests.click", "priority": 0 }, { "ttl": 14400, "type": "A", "value": "192.142.10.129" }, { "ttl": 14400, "type": "TXT", "value": "v=spf1 ip4:192.142.10.129 +a +mx ~all" }, { "ttl": 21600, "type": "NS", "value": "pro2.ecositewebhost.com" }, { "ttl": 21600, "type": "SOA", "rname": "system.arotas.com", "value": "pro1.ecositewebhost.com" }, { "ttl": 21600, "type": "NS", "value": "pro1.ecositewebhost.com" } ], "dns_at": "2026-10-22T03:24:08Z", "jarm": "15d3fd16d29d29d00042d43d0000001ae0802418786940cae38f1d9eed5b9b", "cert": { "san": [ "*.algofairvests.click", "algofairvests.click" ], "issuer": "Let's Encrypt / YR1", "serial": "6eda5408b7db8cd6a105f00fca0e9e8d393", "sha256": "63ecbadfc8647907c02d0a5f188533e25ef3a0ceca08505377b1a056c0911fc9", "subject": "*.algofairvests.click", "valid_to": "2026-12-12T11:09:24Z", "valid_from": "2026-09-13T11:09:25Z" }, "whois": { "registrar": "Global Domain Group LLC", "registrar_iana_id": "3956", "registrar_url": "www.dynadot.com", "created": "2026-09-12T22:05:44Z", "updated": "2026-09-22T20:06:40Z", "expires": "2027-09-12T22:05:44Z", "status": [ "clientTransferProhibited" ], "nameservers": [ "pro1.ecositespace.com", "pro2.ecositespace.com" ], "dnssec": "unsigned" }, "rdap": { "status": [ "transfer prohibited" ], "events": { "expiration": "2027-09-12T22:05:44Z", "last changed": "2026-09-22T20:06:41Z", "registration": "2026-09-12T22:05:44Z", "registrar expiration": "2027-09-12T22:05:44Z", "last update of RDAP database": "2026-10-21T17:52:25Z" } } }, "webcheck": { "v": 1, "fetched_at": "2026-10-22T02:02:18Z", "mail_config": { "mx": [ "algofairvests.click" ], "spf": "v=spf1 ip4:192.142.10.129 +a +mx ~all", "dkim": [ "default" ], "dmarc": true, "dkim_bits": 2048, "spf_lookups": 2 }, "caa_records": { "domain": "algofairvests.click" }, "block_lists": { "resolvers": 12, "blocked_count": 0 }, "archives": { "last": "2026-09-14T06:38:08Z", "first": "2026-09-13T18:55:38Z", "changes": 1, "days_archived": 2, "scans_per_day": 2.05, "avg_page_bytes": 5747 }, "robots_txt": { "agents": [ "*" ], "present": true }, "social_tags": { "title": "ALGO FAIR-VEST", "ogType": "website", "ogImage": "https://algofairvests.click/storage/app/public/photos/lKzMXztnL52e5FDYKu9NfumoJ6rUPOZqyjKyoRRR.jpg", "ogTitle": "Trading With ALGO FAIR-VEST", "keywords": "ALGO FAIR-VEST", "ogSiteName": "ALGO FAIR-VEST", "themeColor": "#4D7DE6", "description": "ALGO FAIR-VEST LIMITED???\nINVEST IN A LEADING\nTRADE AND INVESTMENT\nCOMPANY, OPERATING IN\nTHE UK. \nSERVICES INCLUDE: FOREX TRADING\nCRYPTOCURRENCIES, STOCKS & COMMODITIES INVESTMENTS. OIL & GAS, REAL ESTATE INVESTMENTS, MARKET\nRESEARCH AND ANALYSIS:\nASSISTING BOTH INDIVIDUALS & COMPANIES INVEST IN THE", "ogDescription": "ALGO FAIR-VEST LIMITED???\nINVEST IN A LEADING\nTRADE AND INVESTMENT\nCOMPANY, OPERATING IN\nTHE UK. \nSERVICES INCLUDE: FOREX TRADING\nCRYPTOCURRENCIES, STOCKS & COMMODITIES INVESTMENTS. OIL & GAS, REAL ESTATE INVESTMENTS, MARKET\nRESEARCH AND ANALYSIS:\nASSISTING BOTH INDIVIDUALS & COMPANIES INVEST IN THE" }, "trackers": { "requests": 71, "trackers": [ { "name": "Google", "company": "Google", "country": "US", "category": "Advertising", "requests": 1 }, { "name": "Google Marketing Platform", "company": "Google", "country": "US", "category": "Advertising", "requests": 3 }, { "name": "Yandex", "company": "Yandex", "country": "RU", "category": "Advertising", "requests": 1 }, { "name": "YouTube", "company": "Google", "country": "US", "category": "Audio/Video Player", "requests": 7 }, { "name": "Google Translate", "company": "Google", "country": "US", "category": "Customer Interaction", "requests": 1 }, { "name": "Tidio", "company": "Tidio Chat", "country": "US", "category": "Customer Interaction", "requests": 1 }, { "name": "fontawesome.com", "company": "fontawesome.com", "category": "Hosting", "requests": 2 }, { "name": "Google Fonts", "company": "Google", "country": "US", "category": "Hosting", "requests": 1 }, { "name": "Google Static", "company": "Google", "country": "US", "category": "Hosting", "requests": 3 } ] }, "mixed_content": { "no_sri": [ "https://translate.yandex.net/website-widget/v1/widget.js", "https://widgets.coingecko.com/coingecko-coin-price-marquee-widget.js", "https://translate.google.com/translate_a/elementa0d8.js", "https://code.tidio.co/ggsggsgggg" ], "third_party_scripts": 4 }, "status": { "up": true, "code": 200, "timings": { "dns": 14, "tls": 17, "wait": 889, "connect": 14, "download": 12 }, "response_ms": 946 }, "tls_connection": { "alpn": "http/1.1", "cipher": "TLS_AES_256_GCM_SHA384", "protocol": "TLSv1.3", "versions": [ "TLSv1.2", "TLSv1.3" ], "authorized": true, "forward_secrecy": true }, "ports": { "open": [ 22, 25, 53, 80, 110, 143, 443, 587, 993, 995, 3306 ] }, "carbon": { "bytes": 37737, "co2_grams": 0.0014, "cleaner_than": 43 }, "dns_server": { "ns": [ { "ip": "103.224.182.249", "host": "pro1.ecositewebhost.com" }, { "ip": "103.224.182.249", "host": "pro2.ecositewebhost.com" } ], "zone": "algofairvests.click" }, "cookies": { "cookies": [ { "name": "bh", "secure": true, "same_site": "None" }, { "name": "XSRF-TOKEN", "same_site": "Lax" }, { "name": "trademartpro_session", "http_only": true, "same_site": "Lax" }, { "name": "_yasc", "secure": true, "same_site": "None" }, { "name": "__Secure-YNID", "secure": true, "http_only": true, "same_site": "None" }, { "name": "YSC", "secure": true, "session": true, "http_only": true, "same_site": "None" }, { "name": "__Secure-ROLLOUT_TOKEN", "secure": true, "http_only": true, "same_site": "None" }, { "name": "VISITOR_INFO1_LIVE", "secure": true, "http_only": true, "same_site": "None" }, { "name": "VISITOR_PRIVACY_METADATA", "secure": true, "http_only": true, "same_site": "None" }, { "name": "__cf_bm", "secure": true, "http_only": true, "same_site": "None" }, { "name": "chaport-6aa69bdda318a94e44ab2311" } ] }, "location": { "ip": "192.142.10.129", "asn": "214036", "org": "Ultahost, Inc.", "city": "Amsterdam", "country": "NL" }, "ssl": { "issuer": "Let's Encrypt / YR1", "subject": "*.algofairvests.click" }, "dns": { "A": [ "192.142.10.129" ], "MX": [ "{\"exchange\": \"algofairvests.click\", \"priority\": 0}" ], "NS": [ "pro1.ecositewebhost.com", "pro2.ecositewebhost.com" ], "SOA": "{\"nsname\": \"pro1.ecositewebhost.com\", \"hostmaster\": \"system.arotas.com\", \"serial\": 2026091307, \"refresh\": 3600, \"retry\": 1800, \"expire\": 1209600, \"minttl\": 86400}", "TXT": [ "v=spf1 ip4:192.142.10.129 +a +mx ~all" ] }, "dnssec": { "ds": false, "rrsig": false, "dnskey": false }, "hsts": { "message": "Site does not serve any HSTS headers." }, "http_security": { "xFrameOptions": false, "referrerPolicy": false, "xXSSProtection": false, "permissionsPolicy": false, "xContentTypeOptions": false, "contentSecurityPolicy": false, "strictTransportPolicy": false, "crossOriginOpenerPolicy": false, "crossOriginEmbedderPolicy": false, "crossOriginResourcePolicy": false }, "get_ip": { "ip": "192.142.10.129", "family": 4 }, "redirects": { "chain": [ "https://algofairvests.click" ] }, "tech_stack": { "technologies": [ "amCharts", "YouTube", "Bootstrap", "Apache HTTP Server", "Tidio", "Slick", "Moment.js", "jQuery", "core-js", "Chaport", "Popper", "PWA", "Open Graph" ] }, "linked_pages": { "external": [ "https://www.blockchain.com/" ], "external_count": 1, "internal_count": 13 }, "whois": { "registrar": "Global Domain Group LLC", "created": "2026-09-12T22:05:44Z", "updated": "2026-09-22T20:06:40Z", "expires": "2027-09-12T22:05:44Z", "status": [ "clientTransferProhibited https://icann.org/epp" ], "nameservers": [ "pro1.ecositespace.com", "pro2.ecositespace.com" ] }, "headers": { "headers": { "server": "Apache", "content-type": "text/html; charset=UTF-8" } } } } ```