# PhishDestroy domain threat record: bitcoinaverageai.app

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/bitcoinaverageai.app/
Machine-readable companion: https://phishdestroy.io/domain/bitcoinaverageai.app/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-23 05:18:05 UTC
- Last availability or vendor check: 2026-10-23 05:34:17 UTC
- Stored record updated: 2026-10-23 10:51:50 UTC
- VirusTotal detections in the stored snapshot: 15/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: Bitcoin

## Stored infrastructure

- Observed IP address: 185.98.60.138
- Registrar in stored WHOIS data: TLD Registrar Solutions Ltd
- Last stored HTTP status: 200
- Registration date (registry RDAP, bitcoinaverageai.app): 2023-11-20 11:13:21 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a1673e-e214-7443-9c21-ec725a80e19c/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/bitcoinaverageai.app
- Certificate Transparency search: https://crt.sh/?q=%25.bitcoinaverageai.app
- Web Archive lookup: https://web.archive.org/web/*/https://bitcoinaverageai.app/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
PhishDestroy added bitcoinaverageai.app to its internal blocklist on 2026-10-23 after an intake review noted 14 malicious detections on VirusTotal. The recorded page title reads "Paragonix PrimeX ™ | The Official & Updated Website 2025 🥇" and the site returned HTTP 200 on the same date. No external blocklists reported the domain at that time.

How the scam works
The detections suggest the site may be used for phishing or malware distribution, a common pattern where attackers mimic legitimate trading services to lure users into revealing credentials or downloading malicious content. No specific malicious payload or credential‑harvesting form was observed on the captured page, so the exact mechanism remains unconfirmed.

Evidence
VirusTotal (2026-10-23) reported 15 detections across 92 engines, classifying 14 as malicious and 1 as suspicious. Google Safe Browsing (2026-10-23) did not flag the domain. urlscan.io captured the site twice: on 2026-07-31 the verdict was clean, while on 2026-10-23 machine‑learning engines gave a high malicious score (95) but the overall verdict remained non‑malicious. OTX listed four pulses referencing the domain as of 2026-10-23. PhishDestroy’s internal list marks the domain as blocked, and no external blocklists reported it.

Infrastructure
The domain was registered on 2023-11-20 through TLD Registrar Solutions Ltd. The recorded DNS A record pointed to 185.98.60.138, and the hosting organization was listed as Ideal Hosting Teknoloji A.S. in Turkey. The TLS certificate from Let’s Encrypt was valid until 2026-12-17, and the authoritative nameservers were ns1.cryptodns.co and ns2.cryptodns.co.

What to do
Visitors should avoid entering any credentials or personal information on the site; if they have already done so, they should change passwords on affected accounts and monitor for unauthorized activity. Defenders should block the domain at the network perimeter, review logs for any connections to 185.98.60.138, and keep the domain on threat‑intel feeds.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a1673e-e214-7443-9c21-ec725a80e19c/
Cloudflare Radar report: https://radar.cloudflare.com/scan/724af914-e31e-4097-9c36-5493372cfa2b
Stored capture screenshot: https://urlscan.io/screenshots/01a1673e-e214-7443-9c21-ec725a80e19c.png
Cloudflare Radar screenshot (2026-10-23T05:19:41Z): https://screenshots.phishdestroy.io/cf/724af914-e31e-4097-9c36-5493372cfa2b.png
URLScan screenshot (2026-07-30T07:30:23Z): https://screenshots.phishdestroy.io/us/019fb1ee-4b58-71ac-8679-8853a698cbd3.png
URLScan capture report: https://urlscan.io/result/019fb1ee-4b58-71ac-8679-8853a698cbd3/
URLScan screenshot (2026-07-30T07:46:34Z): https://screenshots.phishdestroy.io/us/019fb1fd-2bfa-7384-b945-8b2e9e109865.png
URLScan capture report: https://urlscan.io/result/019fb1fd-2bfa-7384-b945-8b2e9e109865/
VirusTotal report: https://www.virustotal.com/gui/domain/bitcoinaverageai.app
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=bitcoinaverageai.app
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-23 05:51:49 UTC

## Stored page captures

- Primary capture: https://urlscan.io/screenshots/01a1673e-e214-7443-9c21-ec725a80e19c.png
  Captured: 2026-10-23 05:34:17 UTC
- URLScan capture: https://screenshots.phishdestroy.io/019fb73b-601e-7553-b021-0c095ca5a21c.png
  Captured: 2026-10-23 05:18:05 UTC
  Source report: https://urlscan.io/result/01a1673e-e214-7443-9c21-ec725a80e19c/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/724af914-e31e-4097-9c36-5493372cfa2b.png
  Captured: 2026-10-23 05:19:41 UTC
  Source report: https://radar.cloudflare.com/scan/724af914-e31e-4097-9c36-5493372cfa2b
  SHA-256: 65fe67b2ebf9250560c0335447c31d113d65e67127d5b09fc733f90afb201b62
- URLQuery: https://screenshots.phishdestroy.io/uq/4215a154-fc48-4be1-8187-9b47691d939a.png
  Source report: https://urlquery.net/report/4215a154-fc48-4be1-8187-9b47691d939a
  SHA-256: 8d96b6a51ad637288e0a8cc291e048917e90fe02dcf50e5cec41a2fac6fc43c8
- URLScan · 2026-07-30: https://screenshots.phishdestroy.io/us/019fb1ee-4b58-71ac-8679-8853a698cbd3.png
  Captured: 2026-07-30 07:30:23 UTC
  Source report: https://urlscan.io/result/019fb1ee-4b58-71ac-8679-8853a698cbd3/
  SHA-256: f7f94f00ae07ab55beafc7215124d136c7a048ca6f701d4945f43030548191ac
- URLScan · 2026-07-30: https://screenshots.phishdestroy.io/us/019fb1fd-2bfa-7384-b945-8b2e9e109865.png
  Captured: 2026-07-30 07:46:34 UTC
  Source report: https://urlscan.io/result/019fb1fd-2bfa-7384-b945-8b2e9e109865/
  SHA-256: f7f94f00ae07ab55beafc7215124d136c7a048ca6f701d4945f43030548191ac
- URLScan · 2026-07-31: https://screenshots.phishdestroy.io/us/019fb73b-601e-7553-b021-0c095ca5a21c.png
  Captured: 2026-07-31 08:12:37 UTC
  Source report: https://urlscan.io/result/019fb73b-601e-7553-b021-0c095ca5a21c/
  SHA-256: f7f94f00ae07ab55beafc7215124d136c7a048ca6f701d4945f43030548191ac
- URLScan · 2026-10-23: https://screenshots.phishdestroy.io/us/01a16746-a837-72e8-916e-4b163f1feec4.png
  Captured: 2026-10-23 05:40:54 UTC
  Source report: https://urlscan.io/result/01a16746-a837-72e8-916e-4b163f1feec4/
  SHA-256: f7f94f00ae07ab55beafc7215124d136c7a048ca6f701d4945f43030548191ac

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-23T05:51:26Z",
        "uuid": "01a1673e-e214-7443-9c21-ec725a80e19c",
        "scanned_at": "2026-10-23T05:32:23Z",
        "final_url": "https://bitcoinaverageai.app/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://bitcoinaverageai.app/",
                "from": "http://bitcoinaverageai.app/",
                "status": 307
            }
        ],
        "ip": "185.98.60.138",
        "domains": [
            "fonts.gstatic.com",
            "fonts.googleapis.com"
        ],
        "ips": [
            "142.251.14.94",
            "142.251.20.95",
            "185.98.60.138"
        ],
        "asns": [
            "15169",
            "201064"
        ],
        "countries": [
            "US",
            "TR"
        ],
        "doc_hash": "b8dcbe140fc0b547b68cdb30036a69497587881227c103f4135c8e7958efea28",
        "script_hashes": [
            "b1dc3a468eb8949e17762628c68205ee4ffad52ec1cdbe48e3456bf96c1c9603",
            "81a17cfaf5731292df919a903727b86550d2a57e1ad29893dc693ef9c2013113"
        ],
        "globals": [
            "__VUE__",
            "switcher",
            "switcherButton",
            "modal",
            "btn"
        ],
        "cookies": [
            "lang_fx"
        ],
        "tls": {
            "san": [
                "*.bitcoinaverageai.app",
                "bitcoinaverageai.app"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "YE1",
            "subject": "bitcoinaverageai.app",
            "protocol": "TLS 1.3",
            "valid_to": "2026-12-17T16:00:36Z",
            "valid_from": "2026-09-18T16:00:37Z"
        },
        "domain_age_days": 1067,
        "apex_age_days": 1067,
        "tls_age_days": 34,
        "tls_valid_days": 89,
        "requests": 54,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 95,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "nginx/1.30.1",
            "content-type": "text/html"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-23T05:22:46Z",
        "uuid": "724af914-e31e-4097-9c36-5493372cfa2b",
        "scanned_at": "2026-10-23T05:19:41Z",
        "final_url": "https://bitcoinaverageai.app/",
        "status": 200,
        "history": [
            {
                "url": "https://bitcoinaverageai.app/",
                "status": 200
            }
        ],
        "dom_hash": "a0b3fbb00eb1ab440b80ac0fba4b53c66b66fa1e3cd39ac272b3e219a5c70002",
        "doc_hash": "b8dcbe140fc0b547b68cdb30036a69497587881227c103f4135c8e7958efea28",
        "phishing_v2": [
            "phishing"
        ],
        "domain_risks": [
            "Malware",
            "Security threats",
            "CIPA Filter",
            "CIPA"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "bitcoinaverageai.app",
                "type": "A",
                "value": "185.98.60.138"
            }
        ],
        "dnssec_valid": false,
        "ip": "185.98.60.138",
        "verdict": {
            "tags": [
                "malware"
            ],
            "malicious": true,
            "categories": [
                "malware"
            ]
        },
        "whois": {
            "registrar": "TLD Registrar Solutions Ltd",
            "created": "2023-11-20T11:13:21Z",
            "updated": "2026-05-20T14:03:05Z",
            "expires": "2027-11-20T11:13:21Z",
            "nameservers": [
                "ns1.cryptodns.co",
                "ns2.cryptodns.co"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-23T05:49:21Z",
        "analysis_at": "2026-10-22T23:34:49Z",
        "stats": {
            "timeout": 0,
            "harmless": 45,
            "malicious": 14,
            "suspicious": 1,
            "undetected": 32
        },
        "detections": {
            "ESET": "phishing",
            "VIPRE": "malware",
            "G-Data": "phishing",
            "Lionic": "phishing",
            "Sophos": "phishing",
            "CyRadar": "phishing",
            "Webroot": "malicious",
            "Emsisoft": "malware",
            "SOCRadar": "phishing",
            "Seclookup": "malicious",
            "Gridinsoft": "suspicious",
            "BitDefender": "phishing",
            "Chong Lua Dao": "malicious",
            "alphaMountain.ai": "phishing",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "categories": {
            "Dr.Web": "not recommended site",
            "Sophos": "phishing and fraud",
            "Webroot": "Phishing and Other Frauds",
            "alphaMountain.ai": "Phishing (alphaMountain.ai)",
            "Forcepoint ThreatSeeker": "phishing and other frauds. cryptocurrency"
        },
        "created": "2023-11-20T00:00:00Z",
        "updated": "2023-11-20T00:00:00Z",
        "first_seen": "2023-11-22T08:06:33Z",
        "dns": [
            {
                "ttl": 300,
                "type": "A",
                "value": "185.98.60.138"
            },
            {
                "ttl": 300,
                "type": "SOA",
                "rname": "admin.cryptodns.co",
                "value": "ns1.cryptodns.co"
            },
            {
                "ttl": 300,
                "type": "NS",
                "value": "ns2.cryptodns.co"
            },
            {
                "ttl": 300,
                "type": "NS",
                "value": "ns1.cryptodns.co"
            }
        ],
        "dns_at": "2026-10-22T23:35:06Z",
        "jarm": "1dd40d40d00040d00042d43d000000831b6af40378e2dd35eeac4e9311926e",
        "cert": {
            "san": [
                "*.bitcoinaverageai.app",
                "bitcoinaverageai.app"
            ],
            "issuer": "Let's Encrypt / YE1",
            "serial": "6f0b85738a9725261fee54c4aff51740cfc",
            "sha256": "d2b244f6704094c0602ae6fbd5a4b3b8d7afae94892fa21781600a0e2084d306",
            "subject": "bitcoinaverageai.app",
            "valid_to": "2026-12-17T16:00:36Z",
            "valid_from": "2026-09-18T16:00:37Z"
        },
        "whois": [],
        "rdap": {
            "status": [
                "client transfer prohibited"
            ],
            "events": {
                "expiration": "2027-11-20T11:13:21Z",
                "last changed": "2026-05-20T14:03:05Z",
                "registration": "2023-11-20T11:13:21Z",
                "registrar expiration": "2027-11-20T11:13:21Z",
                "last update of RDAP database": "2026-10-19T08:48:38Z"
            },
            "registrar": "TLD Registrar Solutions Ltd.",
            "registrar_iana_id": "1564"
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-23T05:23:02Z",
        "mail_config": {
            "spf_lookups": 0
        },
        "caa_records": {
            "domain": "bitcoinaverageai.app"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_by": [
                "CloudFlare Family"
            ],
            "blocked_count": 1
        },
        "archives": {
            "last": "2026-10-17T09:58:03Z",
            "first": "2024-02-10T16:16:38Z",
            "changes": 18,
            "days_archived": 20,
            "scans_per_day": 0.02,
            "avg_page_bytes": 12269
        },
        "robots_txt": {
            "agents": [
                "*"
            ],
            "present": true,
            "sitemaps": [
                "https://bitcoinaverageai.app/sitemap.xml"
            ]
        },
        "sitemap": {
            "present": true,
            "url_count": 128
        },
        "social_tags": {
            "title": "Paragonix PrimeX ™ | The Official & Updated Website 2025 🥇",
            "robots": "index, follow, max-image-preview:large, max-snippet:-1, max-video-preview:-1",
            "description": "A smooth trading experience on Paragonix PrimeX might help traders to become more professional and may be able to improve their abilities.",
            "twitterCard": "summary",
            "canonicalUrl": "https://bitcoinaverageai.app/"
        },
        "trackers": {
            "requests": 48,
            "trackers": [
                {
                    "name": "Google Fonts",
                    "company": "Google",
                    "country": "US",
                    "category": "Hosting",
                    "requests": 1
                },
                {
                    "name": "Google Static",
                    "company": "Google",
                    "country": "US",
                    "category": "Hosting",
                    "requests": 2
                }
            ]
        },
        "mixed_content": {
            "third_party_scripts": 0
        },
        "status": {
            "up": true,
            "code": 200,
            "timings": {
                "dns": 31,
                "tls": 30,
                "wait": 36,
                "connect": 77,
                "download": 42
            },
            "response_ms": 216
        },
        "tls_connection": {
            "alpn": "http/1.1",
            "cipher": "TLS_AES_256_GCM_SHA384",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                22,
                53,
                80,
                443
            ]
        },
        "carbon": {
            "bytes": 68571,
            "co2_grams": 0.0025,
            "cleaner_than": 30
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "185.98.60.138",
                    "host": "ns2.cryptodns.co"
                },
                {
                    "ip": "185.98.60.138",
                    "host": "ns1.cryptodns.co"
                }
            ],
            "zone": "bitcoinaverageai.app"
        },
        "cookies": {
            "cookies": [
                {
                    "name": "lang_fx"
                }
            ]
        },
        "location": {
            "ip": "185.98.60.138",
            "asn": "201064",
            "org": "Ideal Hosting Teknoloji A.S.",
            "city": "Mahmutbey",
            "country": "TR"
        },
        "ssl": {
            "issuer": "Let's Encrypt / YE1",
            "subject": "bitcoinaverageai.app"
        },
        "dns": {
            "A": [
                "185.98.60.138"
            ],
            "NS": [
                "ns1.cryptodns.co",
                "ns2.cryptodns.co"
            ],
            "SOA": "{\"nsname\": \"ns1.cryptodns.co\", \"hostmaster\": \"admin.cryptodns.co\", \"serial\": 2026052113, \"refresh\": 3600, \"retry\": 1800, \"expire\": 604800, \"minttl\": 300}"
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "hsts": {
            "message": "Site does not serve any HSTS headers."
        },
        "http_security": {
            "xFrameOptions": false,
            "referrerPolicy": false,
            "xXSSProtection": false,
            "permissionsPolicy": false,
            "xContentTypeOptions": false,
            "contentSecurityPolicy": false,
            "strictTransportPolicy": false,
            "crossOriginOpenerPolicy": false,
            "crossOriginEmbedderPolicy": false,
            "crossOriginResourcePolicy": false
        },
        "get_ip": {
            "ip": "185.98.60.138",
            "family": 4
        },
        "redirects": {
            "chain": [
                "https://bitcoinaverageai.app"
            ]
        },
        "tech_stack": {
            "technologies": [
                "Vue.js",
                "Nginx",
                "Google Font API"
            ]
        },
        "linked_pages": {
            "internal_count": 37
        },
        "headers": {
            "headers": {
                "server": "nginx/1.30.1",
                "content-type": "text/html"
            }
        }
    }
}
```