# PhishDestroy domain threat record: aramcogpt.net

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/aramcogpt.net/
Machine-readable companion: https://phishdestroy.io/domain/aramcogpt.net/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-25 23:44:01 UTC
- Last availability or vendor check: 2026-10-25 23:44:01 UTC
- Stored record updated: 2026-10-26 01:00:12 UTC
- VirusTotal detections in the stored snapshot: 0/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored infrastructure

- Observed IP address: 158.94.210.119
- Registrar in stored WHOIS data: Dynadot Inc
- Last stored HTTP status: 200
- Registration date in stored WHOIS data: 2026-03-09 13:09:05 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a17572-4178-7339-b8d3-b2aad32f9401/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/aramcogpt.net
- Certificate Transparency search: https://crt.sh/?q=%25.aramcogpt.net
- Web Archive lookup: https://web.archive.org/web/*/https://aramcogpt.net/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
PhishDestroy’s intake AI marked the site as malicious because it advertises “One‑Click Crypto Mirror Trading” under the name “Aramco GPT”, impersonating the Aramco brand. The page was first observed by PhishDestroy on 2026-10-26 and returned an HTTP 200 response at that time.

How the scam works
Brand‑impersonation crypto investment scams borrow a well‑known company’s reputation to lure victims into a purported AI‑driven trading service. Victims are typically asked to deposit cryptocurrency or share wallet credentials, after which the promised returns never materialize.

Evidence
VirusTotal scanned the domain on 2026-10-25 and reported 0 detections from 92 engines, indicating no known malware signatures. Google Safe Browsing checked the URL on 2026-10-26 and did not flag it, while OTX listed four pulses referencing the domain on the same day. PhishDestroy’s internal blocklist marked aramcogpt.net as malicious, Cloudflare Radar labeled it as phishing and a DGA‑related threat, and URLScan’s machine‑learning engine assigned a malicious score of 88 on 2026-10-25 despite an overall non‑malicious verdict.

Infrastructure
The domain was registered on 2026-03-09 through Dynadot Inc and was 230 days old at the time of observation. The recorded A record pointed to 158.94.210.119, which the scan identified as belonging to ASN 202412 (Omegatech LTD, Netherlands). The TLS certificate observed was issued by Let’s Encrypt, valid from 2026-08-27 to 2026-11-25, and no DNSSEC signatures were present.

What to do
Anyone who entered credentials or transferred cryptocurrency on the site should change the affected passwords immediately and monitor associated wallets for unauthorized activity. Defenders should add aramcogpt.net to block lists and threat‑intelligence feeds, and review logs for connections to the recorded IP address to confirm whether internal accounts were accessed.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a17572-4178-7339-b8d3-b2aad32f9401/
Cloudflare Radar report: https://radar.cloudflare.com/scan/acaff0fa-2f84-49ab-b45f-83c0d50ae000
URLQuery report: https://urlquery.net/report/85b3ca37-a630-49d8-a48e-06006ac29220
Stored capture screenshot: https://i.ibb.co/TMLCxV55/de0672861eae.png
Cloudflare Radar screenshot (2026-10-26T00:18:16Z): https://screenshots.phishdestroy.io/cf/acaff0fa-2f84-49ab-b45f-83c0d50ae000.png
URLQuery screenshot: https://screenshots.phishdestroy.io/uq/85b3ca37-a630-49d8-a48e-06006ac29220.png
URLScan screenshot (2026-10-25T23:37:32Z): https://screenshots.phishdestroy.io/us/01a1756d-0e40-724d-9918-2124abd8e715.png
URLScan capture report: https://urlscan.io/result/01a1756d-0e40-724d-9918-2124abd8e715/
VirusTotal report: https://www.virustotal.com/gui/domain/aramcogpt.net
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=aramcogpt.net
Archived copy: https://web.archive.org/web/20261025234419/https://aramcogpt.net/
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-26 00:20:49 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/TMLCxV55/de0672861eae.png
  Captured: 2026-10-25 23:44:01 UTC
- URLScan capture: https://screenshots.phishdestroy.io/01a17572-4178-7339-b8d3-b2aad32f9401.png
  Captured: 2026-10-25 23:44:01 UTC
  Source report: https://urlscan.io/result/01a17572-4178-7339-b8d3-b2aad32f9401/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/acaff0fa-2f84-49ab-b45f-83c0d50ae000.png
  Captured: 2026-10-26 00:18:16 UTC
  Source report: https://radar.cloudflare.com/scan/acaff0fa-2f84-49ab-b45f-83c0d50ae000
  SHA-256: d8711a68095051787c952c1d77c999cd0597b25a61fa6f13d03526a86b4c5412
- URLQuery: https://screenshots.phishdestroy.io/uq/85b3ca37-a630-49d8-a48e-06006ac29220.png
  Source report: https://urlquery.net/report/85b3ca37-a630-49d8-a48e-06006ac29220
  SHA-256: 4a4f2f3735cd29c5f1ee2d8688c76ac2c7c3158676a066fe703d75b05f61063d
- URLScan · 2026-10-25: https://screenshots.phishdestroy.io/us/01a1756d-0e40-724d-9918-2124abd8e715.png
  Captured: 2026-10-25 23:37:32 UTC
  Source report: https://urlscan.io/result/01a1756d-0e40-724d-9918-2124abd8e715/
  SHA-256: 7d95c31edd7e339fcb17a08808b35d01d099ee9ef0140392453d83a5c6fb360c

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-25T23:54:06Z",
        "uuid": "01a17572-4178-7339-b8d3-b2aad32f9401",
        "scanned_at": "2026-10-25T23:43:10Z",
        "final_url": "https://aramcogpt.net/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://aramcogpt.net/",
                "from": "http://aramcogpt.net/",
                "status": 307
            }
        ],
        "ip": "158.94.210.119",
        "ips": [
            "158.94.210.119"
        ],
        "asns": [
            "202412"
        ],
        "countries": [
            "NL"
        ],
        "doc_hash": "04d05978fdb111358073ab0524e5c1fafc0826615c206987618416b8bd8a4747",
        "script_hashes": [
            "8aa5f8f647356dcd4fc5dbbe0efd5bc0e8da74026bc61e24636e2e1f5749b0ce"
        ],
        "globals": [
            "__dclq",
            "__dclOrig",
            "__dclFlush",
            "__smsCheckBeforeSubmit",
            "__isSmsEnabled",
            "__isSmsVerified",
            "intlTelInput",
            "navToggle",
            "mobileNav",
            "langSwitcher",
            "langBtn"
        ],
        "cookies": [
            "connect.sid"
        ],
        "domain_age_days": 230,
        "apex_age_days": 230,
        "tls_age_days": 59,
        "tls_valid_days": 89,
        "requests": 7,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 88,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "content-type": "image/png"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-26T00:20:08Z",
        "uuid": "acaff0fa-2f84-49ab-b45f-83c0d50ae000",
        "scanned_at": "2026-10-26T00:18:16Z",
        "final_url": "https://aramcogpt.net/",
        "status": 200,
        "history": [
            {
                "url": "https://aramcogpt.net/",
                "status": 200
            }
        ],
        "dom_hash": "0b373fb2870514a3d81eb5e21dde9d2aa069facccbc0e41492e41003410ccedf",
        "doc_hash": "e6c92f0969a83e79c48416e7b4c52ade8fb9fe604f5faa1efeb8bfc73e706c18",
        "phishing_v2": [
            "phishing"
        ],
        "domain_risks": [
            "DGA Domains",
            "Security threats",
            "CIPA Filter",
            "CIPA"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "aramcogpt.net",
                "type": "A",
                "value": "158.94.210.119"
            }
        ],
        "dnssec_valid": false,
        "ip": "158.94.210.119",
        "verdict": {
            "tags": [
                "dga domains"
            ],
            "malicious": true,
            "categories": [
                "dga domains"
            ]
        },
        "whois": {
            "registrar": "Dynadot Inc",
            "created": "2026-03-09T14:09:05Z",
            "updated": "2026-08-13T12:24:58Z",
            "expires": "2027-03-09T14:09:05Z",
            "nameservers": [
                "ns1.dyna-ns.net",
                "ns2.dyna-ns.net"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-26T00:17:24Z",
        "analysis_at": "2026-10-25T03:56:31Z",
        "stats": {
            "timeout": 0,
            "harmless": 56,
            "malicious": 0,
            "suspicious": 0,
            "undetected": 36
        },
        "reputation": 0,
        "tags": [
            "dga"
        ],
        "created": "2026-03-09T00:00:00Z",
        "updated": "2026-03-09T00:00:00Z",
        "first_seen": "2026-03-09T18:12:25Z",
        "dns": [
            {
                "ttl": 300,
                "type": "NS",
                "value": "ns1.dyna-ns.net"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "158.94.210.119"
            },
            {
                "ttl": 300,
                "type": "SOA",
                "rname": "hostmaster.aramcogpt.net",
                "value": "ns1.dyna-ns.net"
            },
            {
                "ttl": 300,
                "type": "NS",
                "value": "ns2.dyna-ns.net"
            }
        ],
        "dns_at": "2026-10-25T03:58:37Z",
        "jarm": "40d40d40d00000000043d43d00043d6aff5ab0f4fc31897186312c9e639319",
        "cert": {
            "san": [
                "aramcogpt.net"
            ],
            "issuer": "Let's Encrypt / YE1",
            "serial": "5dc43770ea644dbfed6cba3f3a2ea5eb9f2",
            "sha256": "6d3d4982cba23ca282ab60e9ede2f80fdb1b774aa04f7952db0823789aef8192",
            "subject": "aramcogpt.net",
            "valid_to": "2026-11-25T15:03:26Z",
            "valid_from": "2026-08-27T15:03:27Z"
        },
        "whois": [],
        "rdap": {
            "status": [
                "transfer prohibited"
            ],
            "events": {
                "expiration": "2027-03-09T14:09:05Z",
                "last changed": "2026-08-31T13:26:10Z",
                "registration": "2026-03-09T14:09:05Z",
                "registrar expiration": "2027-03-09T14:09:05Z",
                "last update of RDAP database": "2026-10-23T10:21:52Z"
            },
            "registrar": "DYNADOT LLC",
            "registrar_iana_id": "472"
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-26T00:13:32Z",
        "mail_config": {
            "spf_lookups": 0
        },
        "caa_records": {
            "domain": "aramcogpt.net"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_count": 0
        },
        "archives": {
            "last": "2026-10-25T23:44:19Z",
            "first": "2026-10-25T23:44:19Z",
            "changes": 0,
            "days_archived": 1,
            "avg_page_bytes": 22300
        },
        "robots_txt": {
            "agents": [
                "*"
            ],
            "present": true,
            "sitemaps": [
                "https://aramcogpt.net/sitemap.xml"
            ]
        },
        "sitemap": {
            "present": true,
            "url_count": 4
        },
        "social_tags": {
            "title": "Aramco GPT - One-Click Crypto Mirror Trading for Small Business Owners",
            "robots": "index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1",
            "description": "Aramco GPT empowers small business owners to put idle cash to work with one-click AI-driven crypto mirror trading. Copy institutional, low-risk strategies automatically and unlock elite performance for your capital.",
            "canonicalUrl": "https://aramcogpt.net/"
        },
        "trackers": {
            "requests": 29,
            "trackers": [
                {
                    "name": "Cloudflare",
                    "company": "Cloudflare",
                    "country": "US",
                    "category": "Hosting",
                    "requests": 1
                },
                {
                    "name": "jsDelivr",
                    "company": "jsDelivr",
                    "category": "Hosting",
                    "requests": 2
                }
            ]
        },
        "mixed_content": {
            "third_party_scripts": 0
        },
        "status": {
            "up": true,
            "code": 200,
            "timings": {
                "dns": 294,
                "tls": 116,
                "wait": 82,
                "connect": 66,
                "download": 257
            },
            "response_ms": 815
        },
        "tls_connection": {
            "alpn": "h2",
            "cipher": "TLS_AES_128_GCM_SHA256",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                22,
                80,
                443
            ]
        },
        "carbon": {
            "bytes": 84279,
            "co2_grams": 0.0031,
            "cleaner_than": 26
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "162.159.25.5",
                    "host": "ns2.dyna-ns.net"
                },
                {
                    "ip": "162.159.26.92",
                    "host": "ns1.dyna-ns.net"
                }
            ],
            "zone": "aramcogpt.net"
        },
        "cookies": {
            "cookies": [
                {
                    "name": "cf-c",
                    "http_only": true,
                    "same_site": "Lax"
                },
                {
                    "name": "__cf_clicked"
                },
                {
                    "name": "ph_phc_t6w4wzJE2sbz4ro8LmZZTssm5go3KD6mP7QsqcDQRSp6_posthog",
                    "secure": true,
                    "same_site": "Lax"
                }
            ]
        },
        "location": {
            "ip": "158.94.210.119",
            "asn": "202412",
            "org": "Omegatech LTD",
            "city": "Amsterdam",
            "country": "NL"
        },
        "ssl": {
            "issuer": "Let's Encrypt / YE1",
            "subject": "aramcogpt.net"
        },
        "dns": {
            "A": [
                "158.94.210.119"
            ],
            "NS": [
                "ns2.dyna-ns.net",
                "ns1.dyna-ns.net"
            ],
            "SOA": "{\"nsname\": \"ns1.dyna-ns.net\", \"hostmaster\": \"hostmaster.aramcogpt.net\", \"serial\": 2026083101, \"refresh\": 16384, \"retry\": 2048, \"expire\": 1209600, \"minttl\": 300}"
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "hsts": {
            "message": "Site does not serve any HSTS headers."
        },
        "http_security": {
            "xFrameOptions": false,
            "referrerPolicy": "same-origin",
            "xXSSProtection": false,
            "permissionsPolicy": false,
            "xContentTypeOptions": "nosniff",
            "contentSecurityPolicy": false,
            "strictTransportPolicy": false,
            "crossOriginOpenerPolicy": false,
            "crossOriginEmbedderPolicy": false,
            "crossOriginResourcePolicy": false
        },
        "get_ip": {
            "ip": "158.94.210.119",
            "family": 4
        },
        "redirects": {
            "chain": [
                "https://aramcogpt.net"
            ]
        },
        "linked_pages": {
            "internal_count": 27
        },
        "whois": {
            "registrar": "Dynadot Inc",
            "created": "2026-03-09T14:09:05Z",
            "updated": "2026-08-13T12:24:58Z",
            "expires": "2027-03-09T14:09:05Z",
            "status": [
                "clientTransferProhibited https://icann.org/epp"
            ],
            "nameservers": [
                "ns1.dyna-ns.net",
                "ns2.dyna-ns.net"
            ]
        },
        "headers": {
            "headers": {
                "content-type": "text/html; charset=utf-8",
                "x-content-type-options": "nosniff",
                "referrer-policy": "same-origin"
            }
        }
    }
}
```