# PhishDestroy domain threat record: bayancapital.digital

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/bayancapital.digital/
Machine-readable companion: https://phishdestroy.io/domain/bayancapital.digital/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-22 20:48:51 UTC
- Last availability or vendor check: 2026-10-22 22:54:26 UTC
- Stored record updated: 2026-10-22 22:54:26 UTC
- VirusTotal detections in the stored snapshot: 16/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored infrastructure

- Observed IP address: 104.21.25.41
- Registrar in stored WHOIS data: Spaceship, Inc.
- Last stored HTTP status: 200
- Registration date in stored WHOIS data: 2026-09-15 13:17:13 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a165d0-cca0-743f-af22-811449ba6393/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/bayancapital.digital
- Certificate Transparency search: https://crt.sh/?q=%25.bayancapital.digital
- Web Archive lookup: https://web.archive.org/web/*/https://bayancapital.digital/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
PhishDestroy listed bayancapital.digital on 2026-10-22 after an intake review flagged it for a high number of malicious detections. The recorded page title was "Bayan Capital | Premium AI Trading Platform | Official App" and the HTTP response code was 200 on 2026-10-22. No direct malicious behavior was observed on the page, but the classification reflects the aggregated security signals.

How the scam works
The listing does not confirm a specific fraud technique; instead, it indicates that the domain matches patterns commonly used for phishing, credential harvesting, or malware distribution. Such suspicious domains typically lure users with attractive offers—here an AI trading platform—and may attempt to capture login details or deliver malicious payloads if interacted with.

Evidence
VirusTotal recorded 13 malicious and 3 suspicious detections from 92 engines on 2026-10-18, totaling 16 detections. Google Safe Browsing checked the domain on 2026-10-22 and reported no flag. urlscan captured the site on 2026-09-29, marking the overall verdict clean but its engine analysis scored it 99 with a malicious tag. OTX listed one pulse referencing the domain on 2026-10-22. PhishDestroy’s internal blocklist marked the domain as malicious on 2026-10-22, while external blocklists showed no entries at that time.

Infrastructure
The domain was registered on 2026-09-15 through Spaceship, Inc., giving it an age of 13 days at the time of capture. It was hosted behind Cloudflare, with recorded A records 172.67.222.171 and 104.21.25.41 and AAAA records in the Cloudflare network. The TLS certificate, issued by Google Trust Services, is valid until 2026-12-15 and covers only the domain itself.

What to do
Visitors should avoid entering any credentials, personal data, or downloading files from the site and should change passwords if they suspect they may have been entered. Organizations can block the exact domain in firewalls or DNS filters and monitor for any related traffic. Security teams should log the observation, note the high malicious detection counts, and treat the domain as a potential phishing or malware source pending further investigation.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a0eceb-f94e-7376-9f74-09d8313e0d4c/
Cloudflare Radar report: https://radar.cloudflare.com/scan/93a67c57-90c2-4de4-b2fa-3e2511c9a0e4
Stored capture screenshot: https://urlscan.io/screenshots/01a0eceb-f94e-7376-9f74-09d8313e0d4c.png
Cloudflare Radar screenshot (2026-10-22T20:59:49Z): https://screenshots.phishdestroy.io/cf/93a67c57-90c2-4de4-b2fa-3e2511c9a0e4.png
VirusTotal report: https://www.virustotal.com/gui/domain/bayancapital.digital
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=bayancapital.digital
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-22 21:03:11 UTC

## Stored page captures

- Primary capture: https://urlscan.io/screenshots/01a165d0-cca0-743f-af22-811449ba6393.png
  Captured: 2026-10-22 22:54:26 UTC
- URLScan capture: https://screenshots.phishdestroy.io/01a0eceb-f94e-7376-9f74-09d8313e0d4c.png
  Captured: 2026-10-22 20:48:51 UTC
  Source report: https://urlscan.io/result/01a165d0-cca0-743f-af22-811449ba6393/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/93a67c57-90c2-4de4-b2fa-3e2511c9a0e4.png
  Captured: 2026-10-22 20:59:49 UTC
  Source report: https://radar.cloudflare.com/scan/93a67c57-90c2-4de4-b2fa-3e2511c9a0e4
  SHA-256: dfe4cbb7da5d63e30cbcb73e7a8abbde3c0c3e720287e6c4b744dda1c0877be9
- URLScan · 2026-09-16: https://screenshots.phishdestroy.io/us/01a0a98d-1b45-70cc-a7be-468801001bc3.png
  Captured: 2026-09-16 09:29:58 UTC
  Source report: https://urlscan.io/result/01a0a98d-1b45-70cc-a7be-468801001bc3/
  SHA-256: f222e3450ece962b6e2baed969e7822c871cca35def2b7669c1277a3425a4951
- URLScan · 2026-09-28: https://screenshots.phishdestroy.io/us/01a0e7ac-59da-7218-a4cc-82dfee53cfdb.png
  Captured: 2026-09-28 11:00:34 UTC
  Source report: https://urlscan.io/result/01a0e7ac-59da-7218-a4cc-82dfee53cfdb/
  SHA-256: cb3f5c4f391626dce77b3b1c1328873431fa6b4b69de2d118a5ad1968908e1ae
- URLScan · 2026-09-28: https://screenshots.phishdestroy.io/us/01a0e7d7-c45d-7586-a69f-bafad6320656.png
  Captured: 2026-09-28 11:47:58 UTC
  Source report: https://urlscan.io/result/01a0e7d7-c45d-7586-a69f-bafad6320656/
  SHA-256: 31b5cfa1bece5a6ca9534dec83c6f40166ab85591f7a54df5be8e8311e2e3fa9

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-22T21:02:21Z",
        "uuid": "93a67c57-90c2-4de4-b2fa-3e2511c9a0e4",
        "scanned_at": "2026-10-22T20:59:49Z",
        "final_url": "https://bayancapital.digital/",
        "status": 200,
        "history": [
            {
                "url": "https://bayancapital.digital/",
                "status": 200
            }
        ],
        "dom_hash": "6ebe64a9e536a7057c3e3dab6be1bafd69bc82f47213dddfbd1b6132f833f180",
        "doc_hash": "1cca8b72827c091d665efd3f8f5fc5e1b4ddbb9590d490337ce6c01afb52078f",
        "phishing_v2": [
            "phishing"
        ],
        "domain_risks": [
            "Malware",
            "Security threats",
            "CIPA Filter",
            "CIPA"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "bayancapital.digital",
                "type": "A",
                "value": "104.21.25.41"
            },
            {
                "name": "bayancapital.digital",
                "type": "A",
                "value": "172.67.222.171"
            },
            {
                "name": "bayancapital.digital",
                "type": "AAAA",
                "value": "2606:4700:3035::ac43:deab"
            },
            {
                "name": "bayancapital.digital",
                "type": "AAAA",
                "value": "2606:4700:3031::6815:1929"
            }
        ],
        "dnssec_valid": false,
        "ip": "104.21.25.41",
        "verdict": {
            "tags": [
                "malware"
            ],
            "malicious": true,
            "categories": [
                "malware"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-22T20:59:08Z",
        "analysis_at": "2026-10-18T15:41:41Z",
        "stats": {
            "timeout": 0,
            "harmless": 44,
            "malicious": 13,
            "suspicious": 3,
            "undetected": 32
        },
        "detections": {
            "CRDF": "malicious",
            "DNS8": "suspicious",
            "ESET": "suspicious",
            "VIPRE": "phishing",
            "G-Data": "phishing",
            "Lionic": "phishing",
            "Sophos": "phishing",
            "CyRadar": "phishing",
            "Fortinet": "phishing",
            "SOCRadar": "phishing",
            "Kaspersky": "phishing",
            "Seclookup": "malicious",
            "Gridinsoft": "suspicious",
            "BitDefender": "phishing",
            "alphaMountain.ai": "phishing",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "first_seen": "2026-09-16T09:56:10Z",
        "dns": [
            {
                "ttl": 300,
                "type": "A",
                "value": "172.67.222.171"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "violet.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3035::ac43:deab"
            },
            {
                "ttl": 1800,
                "type": "SOA",
                "rname": "dns.cloudflare.com",
                "value": "rory.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3031::6815:1929"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "rory.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "104.21.25.41"
            }
        ],
        "dns_at": "2026-10-18T15:47:11Z",
        "jarm": "27d40d40d00040d00042d43d00041df04c41293ba84f6efe3a613b22f983e6",
        "cert": {
            "san": [
                "bayancapital.digital"
            ],
            "issuer": "Google Trust Services / WE1",
            "serial": "5e6226a6d18dbfb131a3f95fdd2f6c6",
            "sha256": "84bfcdbe7ae7012878e1f70741471508781fcd3b9a037921fec396ae11fdb0f6",
            "subject": "bayancapital.digital",
            "valid_to": "2026-12-15T09:28:46Z",
            "valid_from": "2026-09-16T08:28:50Z"
        },
        "rdap": {
            "status": [
                "client transfer prohibited",
                "add period"
            ],
            "events": {
                "last changed": "2026-09-16T09:04:36Z",
                "registration": "2026-09-15T15:17:13Z",
                "registrar expiration": "2027-09-15T15:17:13Z",
                "last update of RDAP database": "2026-10-18T15:47:10Z"
            },
            "registrar": "Spaceship, Inc.",
            "registrar_iana_id": "3862"
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-22T21:02:36Z",
        "mail_config": {
            "spf_lookups": 0
        },
        "caa_records": {
            "domain": "bayancapital.digital"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_by": [
                "CloudFlare Family"
            ],
            "blocked_count": 1
        },
        "archives": {
            "last": "2026-10-22T20:53:07Z",
            "first": "2026-09-16T04:33:39Z",
            "changes": 2,
            "days_archived": 3,
            "scans_per_day": 0.05,
            "avg_page_bytes": 27425
        },
        "robots_txt": {
            "agents": [
                "*"
            ],
            "present": true,
            "sitemaps": [
                "https://bayancapital.digital/sitemap.xml"
            ]
        },
        "sitemap": {
            "present": true,
            "url_count": 140
        },
        "social_tags": {
            "ogUrl": "https://bayancapital.digital/",
            "title": "Bayan Capital | Premium AI Trading Platform | Official App",
            "ogType": "website",
            "robots": "index, follow",
            "ogTitle": "Bayan Capital | Advanced AI Trading Suite",
            "ogSiteName": "Bayan Capital",
            "themeColor": "#0E0E0E",
            "description": "Bayan Capital delivers AI-driven trading insights, autonomous bots, portfolio analytics, and streamlined market workflows for today’s digital asset participants.",
            "twitterCard": "summary",
            "canonicalUrl": "https://bayancapital.digital/",
            "ogDescription": "Bayan Capital delivers AI-driven trading insights, autonomous bots, portfolio analytics, and streamlined market workflows for today’s digital asset participants."
        },
        "trackers": {
            "requests": 18,
            "trackers": [
                {
                    "name": "Cloudflare",
                    "company": "Cloudflare",
                    "country": "US",
                    "category": "Hosting",
                    "requests": 8
                },
                {
                    "name": "Google Fonts",
                    "company": "Google",
                    "country": "US",
                    "category": "Hosting",
                    "requests": 1
                },
                {
                    "name": "jsDelivr",
                    "company": "jsDelivr",
                    "category": "Hosting",
                    "requests": 1
                }
            ]
        },
        "mixed_content": {
            "no_sri": [
                "https://static.cloudflare.com/beacon.min.js",
                "https://challenges.cloudflare.com/turnstile/v0/api.js",
                "https://cdn.jsdelivr.net/npm/clientjs@0.2.1/dist/client.min.js"
            ],
            "third_party_scripts": 3
        },
        "status": {
            "up": true,
            "code": 200,
            "timings": {
                "dns": 1,
                "tls": 23,
                "wait": 173,
                "connect": 7,
                "download": 12
            },
            "response_ms": 216
        },
        "tls_connection": {
            "alpn": "h2",
            "cipher": "TLS_AES_256_GCM_SHA384",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                80,
                443,
                8080
            ]
        },
        "carbon": {
            "bytes": 135303,
            "co2_grams": 0.0049,
            "cleaner_than": 15
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "172.64.32.237",
                    "host": "violet.ns.cloudflare.com"
                },
                {
                    "ip": "108.162.195.166",
                    "host": "rory.ns.cloudflare.com"
                }
            ],
            "zone": "bayancapital.digital"
        },
        "cookies": {
            "cookies": [
                {
                    "name": "entry_url",
                    "secure": true,
                    "same_site": "Lax"
                }
            ]
        },
        "location": {
            "ip": "2606:4700:3031::6815:1929",
            "asn": "13335",
            "org": "Cloudflare, Inc.",
            "city": "San Francisco",
            "country": "US"
        },
        "ssl": {
            "issuer": "Google Trust Services / WE1",
            "subject": "bayancapital.digital"
        },
        "dns": {
            "A": [
                "172.67.222.171",
                "104.21.25.41"
            ],
            "NS": [
                "rory.ns.cloudflare.com",
                "violet.ns.cloudflare.com"
            ],
            "SOA": "{\"nsname\": \"rory.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2418086699, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}",
            "AAAA": [
                "2606:4700:3031::6815:1929",
                "2606:4700:3035::ac43:deab"
            ]
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "hsts": {
            "header": "max-age=15552000; includeSubDomains; preload",
            "message": "HSTS max-age is 15552000, below the 31536000 minimum."
        },
        "http_security": {
            "xFrameOptions": "SAMEORIGIN",
            "referrerPolicy": "strict-origin-when-cross-origin",
            "xXSSProtection": false,
            "permissionsPolicy": "camera=(), microphone=(), geolocation=()",
            "xContentTypeOptions": "nosniff",
            "contentSecurityPolicy": "style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://cdnjs.cloudflare.com; frame-src https://challenges",
            "strictTransportPolicy": "max-age=15552000; includeSubDomains; preload",
            "crossOriginOpenerPolicy": "same-origin",
            "crossOriginEmbedderPolicy": false,
            "crossOriginResourcePolicy": false
        },
        "firewall": {
            "waf": "Cloudflare",
            "has_waf": true
        },
        "get_ip": {
            "ip": "2606:4700:3031::6815:1929",
            "family": 6
        },
        "redirects": {
            "chain": [
                "https://bayancapital.digital"
            ]
        },
        "tech_stack": {
            "technologies": [
                "jsDelivr",
                "Cloudflare Turnstile",
                "Cloudflare Rocket Loader",
                "ClientJS",
                "Priority Hints",
                "Google Font API",
                "Font Awesome",
                "cdnjs",
                "HSTS",
                "Cloudflare",
                "Open Graph",
                "HTTP/3"
            ]
        },
        "linked_pages": {
            "internal_count": 38
        },
        "headers": {
            "headers": {
                "server": "cloudflare",
                "content-type": "text/html; charset=utf-8",
                "strict-transport-security": "max-age=15552000; includeSubDomains; preload",
                "content-security-policy": "style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://cdnjs.cloudflare.com; frame-src https://challenges.cloudflare.com; img-src 'self' data: blob:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://static.cloudflare.com https://cdn.jsdelivr.net https://challenges.cloudflare.co",
                "x-frame-options": "SAMEORIGIN",
                "x-content-type-options": "nosniff",
                "referrer-policy": "strict-origin-when-cross-origin",
                "permissions-policy": "camera=(), microphone=(), geolocation=()",
                "cross-origin-opener-policy": "same-origin"
            }
        }
    }
}
```