# PhishDestroy domain threat record: baykar-investment-program.com Content language: English Canonical HTML report: https://phishdestroy.io/domain/baykar-investment-program.com/ Machine-readable companion: https://phishdestroy.io/domain/baykar-investment-program.com/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-10-22 20:48:54 UTC - Last availability or vendor check: 2026-10-22 22:00:20 UTC - Stored record updated: 2026-10-22 22:45:02 UTC - VirusTotal detections in the stored snapshot: 16/92 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: no stored flag ## Stored infrastructure - Observed IP address: 172.67.201.172 - Registrar in stored WHOIS data: MainReg Inc. - Last stored HTTP status: 200 - Registration date (registry RDAP, baykar-investment-program.com): 2026-02-22 10:23:02 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a1432d-c2f1-741a-b022-9662dad9aa8c/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/baykar-investment-program.com - Certificate Transparency search: https://crt.sh/?q=%25.baykar-investment-program.com - Web Archive lookup: https://web.archive.org/web/*/https://baykar-investment-program.com/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview PhishDestroy added baykar-investment-program.com to its internal blocklist on 2026-10-22 because VirusTotal reported numerous malicious detections. The recorded page title advertises a "BAYKAR Investment Program" and the site returned HTTP 200 on the same date. The classification is based on threat‑engine scores, not on observed malicious behavior on the page. How the scam works The high number of malicious and phishing labels from security engines suggests the site could be used to lure visitors into providing credentials or downloading unwanted software, a pattern common to suspicious investment‑related pages. No concrete phishing form, malware payload, or wallet request was observed, so the exact mechanism remains uncertain. Evidence VirusTotal analysis on 2026-10-21 recorded 13 malicious and 3 suspicious detections out of 92 engines (16 total). Google Safe Browsing checked on 2026-10-23 reported no flag. urlscan.io captured the site on 2026-10-16; its overall verdict was clean but its engine scoring marked the URL as malicious with a 98‑point score. OTX listed three pulses mentioning the domain as of 2026-10-23. No external blocklists flagged the domain, while PhishDestroy’s internal list marked it as suspicious on 2026-10-22. Infrastructure The domain was registered on 2026-02-22 through MainReg Inc. and was hosted behind Cloudflare (recorded IP 172.67.201.172, recorded country CA). TLS was issued by Google Trust Services, valid until 2026-12-08, and DNS records showed A, AAAA, MX, NS and TXT entries without DNSSEC. The recorded page loaded scripts from Cloudflare Turnstile, jsDelivr and Google Fonts, as captured in the scan. What to do Visitors should avoid entering any credentials or downloading files from this site; if they have already submitted information, change related passwords and monitor accounts for unusual activity. Security teams should block the exact FQDN, log any DNS or HTTP requests to it, and treat traffic as potentially malicious. No wallet‑related actions are required because wallet recommendations are disabled for this domain. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a1432d-c2f1-741a-b022-9662dad9aa8c/ Cloudflare Radar report: https://radar.cloudflare.com/scan/3770c9b8-e813-4b43-8865-7d1bed84d9f4 Stored capture screenshot: https://urlscan.io/screenshots/01a1432d-c2f1-741a-b022-9662dad9aa8c.png Cloudflare Radar screenshot (2026-10-22T20:59:39Z): https://screenshots.phishdestroy.io/cf/3770c9b8-e813-4b43-8865-7d1bed84d9f4.png URLScan screenshot (2026-07-31T05:00:08Z): https://screenshots.phishdestroy.io/us/019fb68b-2d61-738f-996d-7ad7ea90f5e2.png URLScan capture report: https://urlscan.io/result/019fb68b-2d61-738f-996d-7ad7ea90f5e2/ URLScan screenshot (2026-08-05T06:01:04Z): https://screenshots.phishdestroy.io/us/019fd082-c373-7108-bdc8-bbbcb99ace82.png URLScan capture report: https://urlscan.io/result/019fd082-c373-7108-bdc8-bbbcb99ace82/ URLScan screenshot (2026-08-27T14:13:26Z): https://screenshots.phishdestroy.io/us/01a04391-6b5e-7038-b865-3a33ec8dd8b6.png URLScan capture report: https://urlscan.io/result/01a04391-6b5e-7038-b865-3a33ec8dd8b6/ URLScan screenshot (2026-09-11T01:51:19Z): https://screenshots.phishdestroy.io/us/01a08e29-6a38-719f-826c-c9cc28f24dea.png URLScan capture report: https://urlscan.io/result/01a08e29-6a38-719f-826c-c9cc28f24dea/ URLScan screenshot (2026-09-13T06:30:07Z): https://screenshots.phishdestroy.io/us/01a09975-6133-7178-a629-6f21fbf2e3bd.png URLScan capture report: https://urlscan.io/result/01a09975-6133-7178-a629-6f21fbf2e3bd/ URLScan screenshot (2026-09-24T03:12:53Z): https://screenshots.phishdestroy.io/us/01a0d166-c012-745a-8675-8880671fa54a.png URLScan capture report: https://urlscan.io/result/01a0d166-c012-745a-8675-8880671fa54a/ VirusTotal report: https://www.virustotal.com/gui/domain/baykar-investment-program.com Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=baykar-investment-program.com Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-22 22:03:12 UTC ## Stored page captures - Primary capture: https://urlscan.io/screenshots/01a1432d-c2f1-741a-b022-9662dad9aa8c.png Captured: 2026-10-22 20:48:54 UTC - URLScan capture: https://screenshots.phishdestroy.io/01a1432d-c2f1-741a-b022-9662dad9aa8c.png Source report: https://urlscan.io/result/01a1432d-c2f1-741a-b022-9662dad9aa8c/ - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/3770c9b8-e813-4b43-8865-7d1bed84d9f4.png Captured: 2026-10-22 20:59:39 UTC Source report: https://radar.cloudflare.com/scan/3770c9b8-e813-4b43-8865-7d1bed84d9f4 SHA-256: d1288604fde902f11d42abd8957d3dbe6a1ea80df80792ebfd7871c5ddb07b50 - URLScan · 2026-07-31: https://screenshots.phishdestroy.io/us/019fb68b-2d61-738f-996d-7ad7ea90f5e2.png Captured: 2026-07-31 05:00:08 UTC Source report: https://urlscan.io/result/019fb68b-2d61-738f-996d-7ad7ea90f5e2/ SHA-256: 5f142e0fa276202da2d1e40770355299ff01714bb531f576200318ba2c6a7eb9 - URLScan · 2026-08-05: https://screenshots.phishdestroy.io/us/019fd082-c373-7108-bdc8-bbbcb99ace82.png Captured: 2026-08-05 06:01:04 UTC Source report: https://urlscan.io/result/019fd082-c373-7108-bdc8-bbbcb99ace82/ SHA-256: 0321972aa2ab00b8c3b2d325ca01ae215a29a343cbaa3786130a44714f09c2f2 - URLScan · 2026-08-27: https://screenshots.phishdestroy.io/us/01a04391-6b5e-7038-b865-3a33ec8dd8b6.png Captured: 2026-08-27 14:13:26 UTC Source report: https://urlscan.io/result/01a04391-6b5e-7038-b865-3a33ec8dd8b6/ SHA-256: 7342f9cfc22a9ffd9fee1e4038e93a41444a8493461670e27fd7707e0e321a86 - URLScan · 2026-09-11: https://screenshots.phishdestroy.io/us/01a08e29-6a38-719f-826c-c9cc28f24dea.png Captured: 2026-09-11 01:51:19 UTC Source report: https://urlscan.io/result/01a08e29-6a38-719f-826c-c9cc28f24dea/ SHA-256: 33c45e208c754da1ea71f502b900433a58df427796aa404c2e010fa066c33598 - URLScan · 2026-09-13: https://screenshots.phishdestroy.io/us/01a09975-6133-7178-a629-6f21fbf2e3bd.png Captured: 2026-09-13 06:30:07 UTC Source report: https://urlscan.io/result/01a09975-6133-7178-a629-6f21fbf2e3bd/ SHA-256: 0c64f98554e033e3f40dd9a15de145aad71bab9d4070d7fa01d56612a41a41c6 - URLScan · 2026-09-24: https://screenshots.phishdestroy.io/us/01a0d166-c012-745a-8675-8880671fa54a.png Captured: 2026-09-24 03:12:53 UTC Source report: https://urlscan.io/result/01a0d166-c012-745a-8675-8880671fa54a/ SHA-256: e1e498b60b7885ed976d578aa23d78cbe29a2d670656695f05267981b349698b ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-22T21:01:35Z", "uuid": "01a1432d-c2f1-741a-b022-9662dad9aa8c", "scanned_at": "2026-10-16T05:27:23Z", "final_url": "https://baykar-investment-program.com/", "status": 200, "redirected": "https-only", "redirects": [ { "to": "https://baykar-investment-program.com/", "from": "http://baykar-investment-program.com/", "status": 307 } ], "ip": "2606:4700:3031::ac43:c9ac", "domains": [ "cdnjs.cloudflare.com", "cdn.jsdelivr.net", "fonts.googleapis.com", "static.cloudflareinsights.com", "static.cloudflare.com" ], "ips": [ "2a04:4e42::485", "2607:f8b0:400d:c04::5f", "2606:4700::6811:180e", "2606:4700:3031::ac43:c9ac" ], "asns": [ "54113", "15169", "13335" ], "countries": [ "US" ], "doc_hash": "b2297944610210da9ad8c306c82bebb602269d140cf15cddf1d3fdba2477b4e3", "script_hashes": [ "ccf00d1923b0131a10e0c6d26f95e5dee6ebf8621a27e83c5a2f68a2e0093142" ], "globals": [ "LANG_MSGS", "ClientJS", "_rcro4j", "toggleTermsPopup", "__cfQR", "__cfRLUnblockHandlers", "__lgT0" ], "cookies": [ "entry_url" ], "tls": { "san": [ "baykar-investment-program.com" ], "cipher": "AES_128_GCM", "issuer": "WE1", "subject": "baykar-investment-program.com", "protocol": "TLS 1.3", "valid_to": "2026-12-08T23:45:59Z", "valid_from": "2026-09-09T22:46:02Z" }, "domain_age_days": 235, "apex_age_days": 235, "tls_age_days": 36, "tls_valid_days": 90, "requests": 19, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 98, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "cloudflare", "content-type": "text/html; charset=utf-8", "strict-transport-security": "max-age=15552000; includeSubDomains; preload", "content-security-policy": "img-src 'self' data: blob:; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://cdnjs.cloudflare.com; font-src 'self' https://fonts.gstatic.com https://cdnjs.cloudflare.com; default-", "x-frame-options": "SAMEORIGIN", "x-content-type-options": "nosniff", "referrer-policy": "no-referrer-when-downgrade", "permissions-policy": "camera=(), microphone=(), geolocation=()", "cross-origin-opener-policy": "same-origin" } }, "cf": { "v": 1, "fetched_at": "2026-10-22T21:01:37Z", "uuid": "3770c9b8-e813-4b43-8865-7d1bed84d9f4", "scanned_at": "2026-10-22T20:59:39Z", "final_url": "https://baykar-investment-program.com/", "status": 200, "history": [ { "url": "https://baykar-investment-program.com/", "status": 200 } ], "dom_hash": "b2e57e7287a89da79acf840956c54f3381af862b3a6cbe9367e5f40890a6a8f1", "doc_hash": "736ecc800d9d81e4a787a18d110e848e2798d4f0a045cba1bcce532679c441b7", "phishing_v2": [ "phishing" ], "domain_risks": [ "Malware", "Security threats", "CIPA Filter", "CIPA" ], "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "baykar-investment-program.com", "type": "A", "value": "172.67.201.172" }, { "name": "baykar-investment-program.com", "type": "A", "value": "104.21.22.4" }, { "name": "baykar-investment-program.com", "type": "AAAA", "value": "2606:4700:3031::ac43:c9ac" }, { "name": "baykar-investment-program.com", "type": "AAAA", "value": "2606:4700:3031::6815:1604" } ], "dnssec_valid": false, "ip": "172.67.201.172", "verdict": { "tags": [ "malware" ], "malicious": true, "categories": [ "malware" ] }, "whois": { "registrar": "MainReg Inc.", "created": "2026-02-22T10:23:02Z", "updated": "2026-02-22T14:24:03Z", "expires": "2027-02-22T10:23:02Z", "nameservers": [ "alexa.ns.cloudflare.com", "mcgrory.ns.cloudflare.com" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-22T22:02:15Z", "analysis_at": "2026-10-21T13:56:47Z", "stats": { "timeout": 0, "harmless": 45, "malicious": 13, "suspicious": 3, "undetected": 31 }, "detections": { "DNS8": "suspicious", "ESET": "suspicious", "VIPRE": "phishing", "G-Data": "phishing", "Lionic": "phishing", "Sophos": "phishing", "CyRadar": "phishing", "Webroot": "malicious", "Fortinet": "phishing", "SOCRadar": "phishing", "Seclookup": "malicious", "Gridinsoft": "suspicious", "BitDefender": "phishing", "Chong Lua Dao": "malicious", "alphaMountain.ai": "phishing", "Forcepoint ThreatSeeker": "phishing" }, "reputation": 0, "created": "2026-02-22T00:00:00Z", "updated": "2026-02-22T00:00:00Z", "first_seen": "2026-02-22T14:42:00Z", "dns": [ { "ttl": 1800, "type": "SOA", "rname": "dns.cloudflare.com", "value": "alexa.ns.cloudflare.com" }, { "ttl": 21600, "type": "NS", "value": "mcgrory.ns.cloudflare.com" }, { "ttl": 21600, "type": "NS", "value": "alexa.ns.cloudflare.com" }, { "ttl": 300, "type": "MX", "value": "mail.baykar-investment-program.com", "priority": 10 }, { "ttl": 300, "type": "AAAA", "value": "2606:4700:3031::6815:1604" }, { "ttl": 300, "type": "A", "value": "104.21.22.4" }, { "ttl": 300, "type": "TXT", "value": "v=spf1 ip4:46.166.131.92 ~all" }, { "ttl": 300, "type": "TXT", "value": "google-site-verification=bVyha4pbdw2ulUQTNkGYWadXwzS98E3uFs1tCQS73I8" }, { "ttl": 300, "type": "AAAA", "value": "2606:4700:3031::ac43:c9ac" }, { "ttl": 300, "type": "A", "value": "172.67.201.172" } ], "dns_at": "2026-10-21T14:02:38Z", "jarm": "27d40d40d00040d00042d43d00041df04c41293ba84f6efe3a613b22f983e6", "cert": { "san": [ "baykar-investment-program.com" ], "issuer": "Google Trust Services / WE1", "serial": "4c5a9c780dd3bbca130a03987b8bb2ce", "sha256": "5c68ad342673c8b11a37714eb515c3d93c6b38b4ab01d9e64ad44e0238441c1c", "subject": "baykar-investment-program.com", "valid_to": "2026-12-08T23:45:59Z", "valid_from": "2026-09-09T22:46:02Z" }, "whois": [], "rdap": { "status": [ "active" ], "events": { "last changed": "2026-02-22T00:00:00Z", "registration": "2026-02-22T00:00:00Z", "registrar expiration": "2027-02-22T00:00:00Z", "last update of RDAP database": "2026-10-18T13:47:00Z" }, "registrar": "MainReg Inc.", "registrar_iana_id": "1917" } }, "webcheck": { "v": 1, "fetched_at": "2026-10-22T21:01:57Z", "mail_config": { "mx": [ "mail.baykar-investment-program.com" ], "spf": "v=spf1 ip4:46.166.131.92 ~all", "spf_lookups": 0 }, "caa_records": { "domain": "baykar-investment-program.com" }, "block_lists": { "resolvers": 12, "blocked_by": [ "CloudFlare Family" ], "blocked_count": 1 }, "archives": { "last": "2026-10-22T20:53:35Z", "first": "2026-10-22T20:53:35Z", "changes": 0, "days_archived": 1, "avg_page_bytes": 43814 }, "robots_txt": { "agents": [ "*", "Amazonbot", "Applebot-Extended", "Bytespider", "CCBot" ], "present": true, "sitemaps": [ "https://baykar-investment-program.com/sitemap.xml" ] }, "sitemap": { "present": true, "url_count": 175 }, "social_tags": { "ogUrl": "https://baykar-investment-program.com/", "title": "BAYKAR yatırım programı | a premium | Official Main Page", "ogType": "website", "robots": "index, follow", "ogTitle": "BAYKAR Investment Program | AI-Driven Trading Bots & Educational Guidance", "ogSiteName": "BAYKAR Investment Program", "themeColor": "#1a0028", "description": "BAYKAR Investment Program delivers AI-powered educational tooling for automated trading, with structured workflows, monitoring capabilities, and risk-aware guidance to support learning and skill-building.", "twitterCard": "summary", "canonicalUrl": "https://baykar-investment-program.com/", "ogDescription": "BAYKAR Investment Program delivers AI-powered educational tools for automated trading, including structured workflows, monitoring interfaces, and risk-aware guidance to support learning and skill development." }, "trackers": { "requests": 18, "trackers": [ { "name": "Cloudflare", "company": "Cloudflare", "country": "US", "category": "Hosting", "requests": 8 }, { "name": "Google Fonts", "company": "Google", "country": "US", "category": "Hosting", "requests": 1 }, { "name": "jsDelivr", "company": "jsDelivr", "category": "Hosting", "requests": 1 } ] }, "mixed_content": { "no_sri": [ "https://static.cloudflare.com/beacon.min.js", "https://challenges.cloudflare.com/turnstile/v0/api.js", "https://cdn.jsdelivr.net/npm/clientjs@0.2.1/dist/client.min.js" ], "third_party_scripts": 3 }, "status": { "up": true, "code": 200, "timings": { "dns": 25, "tls": 27, "wait": 189, "connect": 7, "download": 14 }, "response_ms": 262 }, "tls_connection": { "alpn": "h2", "cipher": "TLS_AES_256_GCM_SHA384", "protocol": "TLSv1.3", "versions": [ "TLSv1.2", "TLSv1.3" ], "authorized": true, "forward_secrecy": true }, "ports": { "open": [ 80, 443, 8080 ] }, "carbon": { "bytes": 151343, "co2_grams": 0.0055, "cleaner_than": 13 }, "dns_server": { "ns": [ { "ip": "108.162.195.170", "host": "mcgrory.ns.cloudflare.com" }, { "ip": "108.162.194.215", "host": "alexa.ns.cloudflare.com" } ], "zone": "baykar-investment-program.com" }, "cookies": { "cookies": [ { "name": "entry_url", "secure": true, "same_site": "Lax" } ] }, "location": { "ip": "2606:4700:3031::6815:1604", "asn": "13335", "org": "Cloudflare, Inc.", "city": "Toronto", "country": "CA" }, "ssl": { "issuer": "Google Trust Services / WE1", "subject": "baykar-investment-program.com" }, "dns": { "A": [ "172.67.201.172", "104.21.22.4" ], "MX": [ "{\"exchange\": \"mail.baykar-investment-program.com\", \"priority\": 10}" ], "NS": [ "mcgrory.ns.cloudflare.com", "alexa.ns.cloudflare.com" ], "SOA": "{\"nsname\": \"alexa.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2418083517, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}", "TXT": [ "v=spf1 ip4:46.166.131.92 ~all", "google-site-verification=bVyha4pbdw2ulUQTNkGYWadXwzS98E3uFs1tCQS73I8" ], "AAAA": [ "2606:4700:3031::ac43:c9ac", "2606:4700:3031::6815:1604" ] }, "dnssec": { "ds": false, "rrsig": false, "dnskey": false }, "hsts": { "header": "max-age=63072000; includeSubDomains; preload", "message": "Site is compatible with the HSTS preload list!", "compatible": true }, "http_security": { "xFrameOptions": "SAMEORIGIN", "referrerPolicy": "strict-origin", "xXSSProtection": false, "permissionsPolicy": "camera=(), microphone=(), geolocation=()", "xContentTypeOptions": "nosniff", "contentSecurityPolicy": "connect-src 'self' https://cloudflareinsights.com https://challenges.cloudflare.com; style-src 'self' 'unsafe-inline' ht", "strictTransportPolicy": "max-age=63072000; includeSubDomains; preload", "crossOriginOpenerPolicy": "same-origin", "crossOriginEmbedderPolicy": false, "crossOriginResourcePolicy": false }, "firewall": { "waf": "Cloudflare", "has_waf": true }, "get_ip": { "ip": "2606:4700:3031::ac43:c9ac", "family": 6 }, "redirects": { "chain": [ "https://baykar-investment-program.com" ] }, "tech_stack": { "technologies": [ "jsDelivr", "Cloudflare Turnstile", "Cloudflare Rocket Loader", "ClientJS", "Priority Hints", "Google Font API", "Font Awesome", "cdnjs", "HSTS", "Cloudflare", "Open Graph", "HTTP/3" ] }, "linked_pages": { "internal_count": 12 }, "whois": { "registrar": "MainReg Inc.", "created": "2026-02-22T10:23:02Z", "updated": "2026-02-22T14:24:03Z", "expires": "2027-02-22T10:23:02Z", "status": [ "ok https://icann.org/epp" ], "nameservers": [ "alexa.ns.cloudflare.com", "mcgrory.ns.cloudflare.com" ] }, "headers": { "headers": { "server": "cloudflare", "content-type": "text/html; charset=utf-8", "strict-transport-security": "max-age=63072000; includeSubDomains; preload", "content-security-policy": "connect-src 'self' https://cloudflareinsights.com https://challenges.cloudflare.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://cdnjs.cloudflare.com; font-src 'self' https://fonts.gstatic.com https://cdnjs.cloudflare.com; img-src 'self' data: blob:; default-src 'self'; fra", "x-frame-options": "SAMEORIGIN", "x-content-type-options": "nosniff", "referrer-policy": "strict-origin", "permissions-policy": "camera=(), microphone=(), geolocation=()", "cross-origin-opener-policy": "same-origin" } } } } ```