# PhishDestroy domain threat record: bastionfundava.net

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/bastionfundava.net/
Machine-readable companion: https://phishdestroy.io/domain/bastionfundava.net/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-22 20:48:40 UTC
- Last availability or vendor check: 2026-10-22 22:00:21 UTC
- Stored record updated: 2026-10-22 22:10:08 UTC
- VirusTotal detections in the stored snapshot: 18/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored infrastructure

- Observed IP address: 158.94.210.119
- Registrar in stored WHOIS data: Dynadot Inc
- Last stored HTTP status: 200
- Registration date in stored WHOIS data: 2026-07-28 16:00:01 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a03ca1-8f67-712a-8ca2-21a9c67bdcd0/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/bastionfundava.net
- Certificate Transparency search: https://crt.sh/?q=%25.bastionfundava.net
- Web Archive lookup: https://web.archive.org/web/*/https://bastionfundava.net/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
PhishDestroy added bastionfundava.net to its internal blocklist on 2026-10-22. The recorded page title was “Reliable Platforma Inwestycyjna AI. Bastion Fundava.” and the site returned HTTP 200 on the same check date. The intake flagged the domain because VirusTotal reported 14 malicious vendor detections. No external blocklists listed the domain at the time of checking.

How the scam works
The page advertises an AI‑driven investment platform, a pattern commonly used to lure visitors into providing financial details or credentials. Such schemes typically promise high returns and may request deposits, account logins, or personal data. No specific malicious code or credential‑harvesting forms were observed on the captured page, so the listing reflects the general risk of a fraudulent investment front.

Evidence
VirusTotal scanned the domain on 2026-10-21 and returned 14 malicious and 4 suspicious detections from 92 engines (18 total detections). Google Safe Browsing checked on 2026-10-22 and did not flag the site. urlscan.io captured the page on 2026-08-26; its engine analysis gave a malicious score of 99, while the overall verdict was clean. OTX recorded one pulse referencing the domain on 2026-10-22, and PhishDestroy’s internal blocklist marked it as malicious on 2026-10-22; no external blocklists reported it.

Infrastructure
The recorded IP was 158.94.210.119, associated with Omegatech LTD in the Netherlands, and the certificate observed was a Let’s Encrypt TLS 1.3 certificate valid from 2026-09-12 to 2026-12-11. The domain was registered with Dynadot Inc on 2026-07-28 and carried a clientTransferProhibited status. Web checks on 2026-10-22 noted open ports 22, 80 and 443 and a single Cloudflare Family block entry for the IP.

What to do
Visitors should avoid entering personal, financial or login information on the site; if any credentials were submitted, change the associated passwords and monitor accounts for unauthorized activity. Defenders should block the exact domain name bastionfundava.net in network filters and review logs for connections to that host. Continue to monitor threat feeds such as VirusTotal and OTX for updates on this domain.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a03ca1-8f67-712a-8ca2-21a9c67bdcd0/
Stored capture screenshot: https://urlscan.io/screenshots/01a03ca1-8f67-712a-8ca2-21a9c67bdcd0.png
URLScan screenshot (2026-08-25T01:31:25Z): https://screenshots.phishdestroy.io/us/01a0368b-0c11-7669-8208-464dd9af8643.png
URLScan capture report: https://urlscan.io/result/01a0368b-0c11-7669-8208-464dd9af8643/
URLScan screenshot (2026-08-25T05:52:51Z): https://screenshots.phishdestroy.io/us/01a0377a-6a16-7760-8b06-9ce6a6c5477b.png
URLScan capture report: https://urlscan.io/result/01a0377a-6a16-7760-8b06-9ce6a6c5477b/
VirusTotal report: https://www.virustotal.com/gui/domain/bastionfundava.net
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=bastionfundava.net
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-22 20:52:43 UTC

## Stored page captures

- Primary capture: https://urlscan.io/screenshots/01a03ca1-8f67-712a-8ca2-21a9c67bdcd0.png
  Captured: 2026-10-22 20:48:40 UTC
- URLScan capture: https://screenshots.phishdestroy.io/01a03ca1-8f67-712a-8ca2-21a9c67bdcd0.png
  Source report: https://urlscan.io/result/01a03ca1-8f67-712a-8ca2-21a9c67bdcd0/
- URLScan · 2026-08-25: https://screenshots.phishdestroy.io/us/01a0368b-0c11-7669-8208-464dd9af8643.png
  Captured: 2026-08-25 01:31:25 UTC
  Source report: https://urlscan.io/result/01a0368b-0c11-7669-8208-464dd9af8643/
  SHA-256: 8186a41496a5104dbc2a06a28c95ca1ca351d2f475ef04612624bd7f3d886bcc
- URLScan · 2026-08-25: https://screenshots.phishdestroy.io/us/01a0377a-6a16-7760-8b06-9ce6a6c5477b.png
  Captured: 2026-08-25 05:52:51 UTC
  Source report: https://urlscan.io/result/01a0377a-6a16-7760-8b06-9ce6a6c5477b/
  SHA-256: 8186a41496a5104dbc2a06a28c95ca1ca351d2f475ef04612624bd7f3d886bcc

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-22T20:51:53Z",
        "uuid": "01a03ca1-8f67-712a-8ca2-21a9c67bdcd0",
        "scanned_at": "2026-08-26T05:53:46Z",
        "final_url": "https://bastionfundava.net/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://bastionfundava.net/",
                "from": "http://bastionfundava.net/",
                "status": 307
            }
        ],
        "ip": "91.238.104.127",
        "ips": [
            "91.238.104.127"
        ],
        "asns": [
            "50321"
        ],
        "countries": [
            "UA"
        ],
        "link_domains": [
            "www.cftc.gov",
            "www.fca.org.uk",
            "www.sec.gov"
        ],
        "doc_hash": "762221e0e1ecd1ac62bdd27050ff52a875f328d8340f49bf1eb5140d0096b1ae",
        "script_hashes": [
            "8aa5f8f647356dcd4fc5dbbe0efd5bc0e8da74026bc61e24636e2e1f5749b0ce",
            "05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e",
            "294dada4e00c2a2ff8fcb217ebdc695e5d9a786e70a56bc3561cecb405f91bb4",
            "6194f015040375c84108b81a0f67994796438909731f95845a41468b2cc7bda7",
            "92d8e6f62c4b40bc0732fdbdd07ee4369e115c7f68e81ca9c0828f26ed12f2f5",
            "e79a99543a0af4ea61fa00f8d5d6718501e334693a96e0ed8bf192f30ee62942",
            "a4000409a897003b1c5a8e1f9f32e18a11b022452151cc47c17ecdcb76d5223b"
        ],
        "globals": [
            "__dclq",
            "__dclOrig",
            "__dclFlush",
            "__CURRENCY",
            "__CURRENCY_POS",
            "__smsCheckBeforeSubmit",
            "__isSmsEnabled",
            "__isSmsVerified",
            "intlTelInput",
            "$",
            "jQuery",
            "faqItems",
            "count",
            "countElement"
        ],
        "tls": {
            "san": [
                "bastionfundava.net"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "YE2",
            "subject": "bastionfundava.net",
            "protocol": "TLS 1.3",
            "valid_to": "2026-11-22T19:11:34Z",
            "valid_from": "2026-08-24T19:11:35Z"
        },
        "domain_age_days": 28,
        "apex_age_days": 28,
        "tls_age_days": 1,
        "tls_valid_days": 89,
        "requests": 31,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 99,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "content-type": "text/html; charset=utf-8",
            "x-content-type-options": "nosniff"
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-22T20:49:27Z",
        "analysis_at": "2026-10-21T14:27:36Z",
        "stats": {
            "timeout": 0,
            "harmless": 42,
            "malicious": 14,
            "suspicious": 4,
            "undetected": 32
        },
        "detections": {
            "CRDF": "malicious",
            "DNS8": "suspicious",
            "ESET": "suspicious",
            "VIPRE": "phishing",
            "G-Data": "phishing",
            "Lionic": "phishing",
            "Sophos": "phishing",
            "CyRadar": "phishing",
            "Fortinet": "spam",
            "Netcraft": "malicious",
            "SOCRadar": "phishing",
            "Kaspersky": "phishing",
            "Seclookup": "malicious",
            "Gridinsoft": "suspicious",
            "BitDefender": "phishing",
            "Chong Lua Dao": "malicious",
            "alphaMountain.ai": "phishing",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "registrar": "Dynadot Inc",
        "created": "2026-07-28T18:00:01Z",
        "expires": "2027-07-28T18:00:01Z",
        "updated": "2026-08-13T12:40:40Z",
        "first_seen": "2026-07-28T18:46:34Z",
        "dns": [
            {
                "ttl": 300,
                "type": "A",
                "value": "158.94.210.119"
            },
            {
                "ttl": 300,
                "type": "SOA",
                "rname": "hostmaster.bastionfundava.net",
                "value": "ns1.dyna-ns.net"
            },
            {
                "ttl": 300,
                "type": "NS",
                "value": "ns2.dyna-ns.net"
            },
            {
                "ttl": 300,
                "type": "NS",
                "value": "ns1.dyna-ns.net"
            }
        ],
        "dns_at": "2026-10-21T14:28:40Z",
        "jarm": "40d40d40d00000000043d43d00043d6aff5ab0f4fc31897186312c9e639319",
        "cert": {
            "san": [
                "*.bastionfundava.net",
                "bastionfundava.net"
            ],
            "issuer": "Let's Encrypt / YE2",
            "serial": "62df927c62b8abb37d85ce0a73b509b1b22",
            "sha256": "8382248172c55e1c9dfb775fd29d1a38a4eda9f1caa4d76b573d26719da1a616",
            "subject": "bastionfundava.net",
            "valid_to": "2026-12-11T19:31:23Z",
            "valid_from": "2026-09-12T19:31:24Z"
        },
        "whois": {
            "registrar": "Dynadot Inc",
            "registrar_iana_id": "472",
            "registrar_url": "http://www.dynadot.com",
            "created": "2026-07-28T18:00:01Z",
            "updated": "2026-08-13T12:40:40Z",
            "expires": "2027-07-28T18:00:01Z",
            "status": [
                "clientTransferProhibited"
            ],
            "nameservers": [
                "ns1.dyna-ns.net",
                "ns2.dyna-ns.net"
            ],
            "dnssec": "unsigned"
        },
        "rdap": {
            "status": [
                "transfer prohibited"
            ],
            "events": {
                "expiration": "2027-07-28T18:00:01Z",
                "last changed": "2026-09-12T20:29:58Z",
                "registration": "2026-07-28T18:00:01Z",
                "registrar expiration": "2027-07-28T18:00:01Z",
                "last update of RDAP database": "2026-10-21T09:50:31Z"
            }
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-22T20:52:10Z",
        "mail_config": {
            "spf_lookups": 0
        },
        "caa_records": {
            "domain": "bastionfundava.net"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_by": [
                "CloudFlare Family"
            ],
            "blocked_count": 1
        },
        "robots_txt": {
            "agents": [
                "*"
            ],
            "present": true,
            "sitemaps": [
                "https://bastionfundava.net/sitemap.xml"
            ]
        },
        "sitemap": {
            "present": true,
            "url_count": 5
        },
        "social_tags": {
            "title": "Reliable Platforma Inwestycyjna AI. Bastion Fundava.",
            "robots": "index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1",
            "description": "Predyktywna inteligencja & ultraszybka responsywność — Bastion Fundava wspiera liderów enterprise w skalowaniu globalnych operacji z precyzją algorytmiczną.",
            "canonicalUrl": "https://bastionfundava.net/"
        },
        "trackers": {
            "requests": 54,
            "trackers": [
                {
                    "name": "Cloudflare",
                    "company": "Cloudflare",
                    "country": "US",
                    "category": "Hosting",
                    "requests": 1
                },
                {
                    "name": "jsDelivr",
                    "company": "jsDelivr",
                    "category": "Hosting",
                    "requests": 4
                }
            ]
        },
        "mixed_content": {
            "third_party_scripts": 0
        },
        "status": {
            "up": true,
            "code": 200,
            "timings": {
                "dns": 358,
                "tls": 82,
                "wait": 96,
                "connect": 65,
                "download": 167
            },
            "response_ms": 768
        },
        "tls_connection": {
            "alpn": "h2",
            "cipher": "TLS_AES_128_GCM_SHA256",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                22,
                80,
                443
            ]
        },
        "carbon": {
            "bytes": 93703,
            "co2_grams": 0.0034,
            "cleaner_than": 23
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "162.159.26.92",
                    "host": "ns1.dyna-ns.net"
                },
                {
                    "ip": "162.159.24.5",
                    "host": "ns2.dyna-ns.net"
                }
            ],
            "zone": "bastionfundava.net"
        },
        "cookies": {
            "cookies": [
                {
                    "name": "cf-c",
                    "http_only": true,
                    "same_site": "Lax"
                },
                {
                    "name": "__cf_clicked"
                },
                {
                    "name": "ph_phc_t6w4wzJE2sbz4ro8LmZZTssm5go3KD6mP7QsqcDQRSp6_posthog",
                    "secure": true,
                    "same_site": "Lax"
                }
            ]
        },
        "location": {
            "ip": "158.94.210.119",
            "asn": "202412",
            "org": "Omegatech LTD",
            "city": "Amsterdam",
            "country": "NL"
        },
        "ssl": {
            "issuer": "Let's Encrypt / YE2",
            "subject": "bastionfundava.net"
        },
        "dns": {
            "A": [
                "158.94.210.119"
            ],
            "NS": [
                "ns1.dyna-ns.net",
                "ns2.dyna-ns.net"
            ],
            "SOA": "{\"nsname\": \"ns1.dyna-ns.net\", \"hostmaster\": \"hostmaster.bastionfundava.net\", \"serial\": 2026091202, \"refresh\": 16384, \"retry\": 2048, \"expire\": 1209600, \"minttl\": 300}"
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "hsts": {
            "message": "Site does not serve any HSTS headers."
        },
        "http_security": {
            "xFrameOptions": false,
            "referrerPolicy": "same-origin",
            "xXSSProtection": false,
            "permissionsPolicy": false,
            "xContentTypeOptions": "nosniff",
            "contentSecurityPolicy": false,
            "strictTransportPolicy": false,
            "crossOriginOpenerPolicy": false,
            "crossOriginEmbedderPolicy": false,
            "crossOriginResourcePolicy": false
        },
        "get_ip": {
            "ip": "158.94.210.119",
            "family": 4
        },
        "redirects": {
            "chain": [
                "https://bastionfundava.net"
            ]
        },
        "subdomains": {
            "count": 1,
            "subdomains": [
                "www.bastionfundava.net"
            ]
        },
        "tech_stack": {
            "technologies": [
                "Node.js",
                "Express",
                "lit-html",
                "lit-element",
                "HTTP/3"
            ]
        },
        "linked_pages": {
            "internal_count": 28
        },
        "whois": {
            "registrar": "Dynadot Inc",
            "created": "2026-07-28T18:00:01Z",
            "updated": "2026-08-13T12:40:40Z",
            "expires": "2027-07-28T18:00:01Z",
            "status": [
                "clientTransferProhibited https://icann.org/epp"
            ],
            "nameservers": [
                "ns1.dyna-ns.net",
                "ns2.dyna-ns.net"
            ]
        },
        "headers": {
            "headers": {
                "content-type": "text/html; charset=utf-8",
                "x-content-type-options": "nosniff",
                "referrer-policy": "same-origin"
            }
        }
    }
}
```