# PhishDestroy domain threat record: bohatintrade.com

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/bohatintrade.com/
Machine-readable companion: https://phishdestroy.io/domain/bohatintrade.com/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-23 08:56:27 UTC
- Last availability or vendor check: 2026-10-23 11:24:26 UTC
- Stored record updated: 2026-10-23 14:20:47 UTC
- VirusTotal detections in the stored snapshot: 17/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored infrastructure

- Observed IP address: 158.94.210.119
- Registrar in stored WHOIS data: Dynadot Inc
- Last stored HTTP status: 200
- Registration date (registry RDAP, bohatintrade.com): 2026-08-10 08:27:42 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a167f7-f799-767e-b8b7-f0c188cd016a/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/bohatintrade.com
- Certificate Transparency search: https://crt.sh/?q=%25.bohatintrade.com
- Web Archive lookup: https://web.archive.org/web/*/https://bohatintrade.com/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
PhishDestroy added bohatintrade.com to its internal blocklist on 2026-10-23 because VirusTotal reported fourteen malicious detections. The recorded page title reads “Bohatín — AI platforma pro prediktivní rozhodování”. The site returned HTTP 200 on the same date, and the first sighting by PhishDestroy was also 2026-10-23.

How the scam works
No specific malicious behavior was observed on the page, so the listing reflects a general risk that such domains can be used for phishing, credential harvesting, or malware distribution. Attackers typically present a legitimate‑sounding service to lure visitors into providing personal data or downloading harmful content. Without concrete evidence of a particular payload or credential capture, the risk remains classified as generic suspicious activity.

Evidence
VirusTotal (analysis 2026-10-15, retrieved 2026-10-23) flagged the domain as malicious by 14 vendors and suspicious by 3 of 92 engines, including BitDefender, Kaspersky and Forcepoint ThreatSeeker. Google Safe Browsing checked on 2026-10-23 reported no flag. OTX listed four pulses as of 2026-10-23. urlscan.io (captured 2026-10-23) showed an engine‑based malicious score of 99, though its overall verdict was non‑malicious. Cloudflare Radar (2026-10-23) marked the domain malicious with a malware category. No external blocklists reported the domain, but PhishDestroy’s internal list marks it as blocked.

Infrastructure
The domain was registered with Dynadot Inc on 2026-08-10, making it 74 days old at first sighting. The recorded IP address was 158.94.210.119, listed in the network record as belonging to Omegatech LTD in the Netherlands. The recorded TLS certificate was issued by Let’s Encrypt, valid from 2026-08-28 to 2026-11-26. DNS records at the time included an A record for that IP, an MX record pointing to parkmail.dynadot.com, and NS records ns1.dyna-ns.net and ns2.dyna-ns.net; DNSSEC was not enabled. Observed open ports were 22, 80 and 443.

What to do
Visitors should avoid entering credentials or downloading files from this site; if any credentials were submitted, change them immediately. Security teams should block bohatintrade.com, monitor outbound connections for signs of compromise, and review logs for any interactions with the domain. Continue to watch VirusTotal, OTX and Cloudflare Radar for updated verdicts.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a167f7-f799-767e-b8b7-f0c188cd016a/
Cloudflare Radar report: https://radar.cloudflare.com/scan/585a640d-0222-4e2b-8f85-8bbb1f44ee77
URLQuery report: https://urlquery.net/report/e23e7edf-1a0b-4a91-8460-5eaa82d97470
Stored capture screenshot: https://urlscan.io/screenshots/01a167f7-f799-767e-b8b7-f0c188cd016a.png
Cloudflare Radar screenshot (2026-10-23T08:57:35Z): https://screenshots.phishdestroy.io/cf/585a640d-0222-4e2b-8f85-8bbb1f44ee77.png
URLQuery screenshot: https://screenshots.phishdestroy.io/uq/e23e7edf-1a0b-4a91-8460-5eaa82d97470.png
URLScan screenshot (2026-09-15T10:11:35Z): https://screenshots.phishdestroy.io/us/01a0a48c-d6e1-70ae-80c4-cfb666cb2511.png
URLScan capture report: https://urlscan.io/result/01a0a48c-d6e1-70ae-80c4-cfb666cb2511/
URLScan screenshot (2026-09-16T10:03:43Z): https://screenshots.phishdestroy.io/us/01a0a9ab-fffe-76ce-b0b9-71ccf4237887.png
URLScan capture report: https://urlscan.io/result/01a0a9ab-fffe-76ce-b0b9-71ccf4237887/
URLScan screenshot (2026-10-23T08:57:21Z): https://screenshots.phishdestroy.io/us/01a167fa-8872-7289-971e-bcb13cf17f11.png
URLScan capture report: https://urlscan.io/result/01a167fa-8872-7289-971e-bcb13cf17f11/
VirusTotal report: https://www.virustotal.com/gui/domain/bohatintrade.com
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=bohatintrade.com
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-23 09:30:40 UTC

## Stored page captures

- Primary capture: https://urlscan.io/screenshots/01a167f7-f799-767e-b8b7-f0c188cd016a.png
  Captured: 2026-10-23 08:56:27 UTC
- URLScan capture: https://screenshots.phishdestroy.io/01a167f7-f799-767e-b8b7-f0c188cd016a.png
  Captured: 2026-10-23 08:56:27 UTC
  Source report: https://urlscan.io/result/01a167f7-f799-767e-b8b7-f0c188cd016a/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/585a640d-0222-4e2b-8f85-8bbb1f44ee77.png
  Captured: 2026-10-23 08:57:35 UTC
  Source report: https://radar.cloudflare.com/scan/585a640d-0222-4e2b-8f85-8bbb1f44ee77
  SHA-256: e350988eaaedf326364c674b83e2569aa8a3b37426f85857162c7a2f6083fe1a
- URLQuery: https://screenshots.phishdestroy.io/uq/e23e7edf-1a0b-4a91-8460-5eaa82d97470.png
  Source report: https://urlquery.net/report/e23e7edf-1a0b-4a91-8460-5eaa82d97470
  SHA-256: bcef43b0e903eaf1f1fc29e694b7fe59061da2aa51a84aadf83c6cb965f42d2a
- URLScan · 2026-09-15: https://screenshots.phishdestroy.io/us/01a0a48c-d6e1-70ae-80c4-cfb666cb2511.png
  Captured: 2026-09-15 10:11:35 UTC
  Source report: https://urlscan.io/result/01a0a48c-d6e1-70ae-80c4-cfb666cb2511/
  SHA-256: 52cd228a2f0cf7b603aedf0cd41077836ea199fbe44f1f20ed248a4611a10deb
- URLScan · 2026-09-16: https://screenshots.phishdestroy.io/us/01a0a9ab-fffe-76ce-b0b9-71ccf4237887.png
  Captured: 2026-09-16 10:03:43 UTC
  Source report: https://urlscan.io/result/01a0a9ab-fffe-76ce-b0b9-71ccf4237887/
  SHA-256: 90d130ac833c66f893a717a3e77b14dc82e8ea29351d21d2d9a9fe56dc492d9b
- URLScan · 2026-10-23: https://screenshots.phishdestroy.io/us/01a167fa-8872-7289-971e-bcb13cf17f11.png
  Captured: 2026-10-23 08:57:21 UTC
  Source report: https://urlscan.io/result/01a167fa-8872-7289-971e-bcb13cf17f11/
  SHA-256: 07ddecbe31d9a4b7623c0a6b7ddb10f5750fa0ace6f24ba9c721634815673f15

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-23T08:57:55Z",
        "uuid": "01a167f7-f799-767e-b8b7-f0c188cd016a",
        "scanned_at": "2026-10-23T08:54:35Z",
        "final_url": "https://bohatintrade.com/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://bohatintrade.com/",
                "from": "http://bohatintrade.com/",
                "status": 307
            }
        ],
        "ip": "158.94.210.119",
        "ips": [
            "158.94.210.119"
        ],
        "asns": [
            "202412"
        ],
        "countries": [
            "NL"
        ],
        "doc_hash": "c45f7467d167bd1ce74cf0273f81deeaec6aa06d3182414488d22e21ce77ab7d",
        "script_hashes": [
            "8aa5f8f647356dcd4fc5dbbe0efd5bc0e8da74026bc61e24636e2e1f5749b0ce"
        ],
        "globals": [
            "__dclq",
            "__dclOrig",
            "__dclFlush",
            "__smsCheckBeforeSubmit",
            "__isSmsEnabled",
            "__isSmsVerified",
            "intlTelInput"
        ],
        "cookies": [
            "connect.sid"
        ],
        "tls": {
            "san": [
                "bohatintrade.com"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "YE2",
            "subject": "bohatintrade.com",
            "protocol": "TLS 1.3",
            "valid_to": "2026-11-26T12:46:41Z",
            "valid_from": "2026-08-28T12:46:42Z"
        },
        "domain_age_days": 74,
        "apex_age_days": 74,
        "tls_age_days": 55,
        "tls_valid_days": 89,
        "requests": 10,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 99,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "content-type": "text/html; charset=utf-8",
            "x-content-type-options": "nosniff",
            "referrer-policy": "same-origin"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-23T08:57:57Z",
        "uuid": "585a640d-0222-4e2b-8f85-8bbb1f44ee77",
        "scanned_at": "2026-10-23T08:57:35Z",
        "final_url": "https://bohatintrade.com/",
        "status": 200,
        "history": [
            {
                "url": "https://bohatintrade.com/",
                "status": 200
            }
        ],
        "dom_hash": "0899c693a4f1c722a01132270bc820e61bb66fba83ed4f93b24d4cc14d6bc59e",
        "doc_hash": "9b8326e1aa4210126b7d85e2d92d61e417f7ff3b3755a417b86f7622f1aaa93a",
        "phishing_v2": [
            "phishing"
        ],
        "url_risks": [
            "Scam"
        ],
        "domain_risks": [
            "Scam",
            "Security threats",
            "Malware",
            "CIPA Filter",
            "CIPA"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "bohatintrade.com",
                "type": "A",
                "value": "158.94.210.119"
            }
        ],
        "dnssec_valid": false,
        "ip": "158.94.210.119",
        "verdict": {
            "tags": [
                "malware"
            ],
            "malicious": true,
            "categories": [
                "malware"
            ]
        },
        "whois": {
            "registrar": "Dynadot Inc",
            "created": "2026-08-10T08:27:42Z",
            "updated": "2026-08-13T12:28:21Z",
            "expires": "2027-08-10T08:27:42Z",
            "nameservers": [
                "ns1.dyna-ns.net",
                "ns2.dyna-ns.net"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-23T09:27:34Z",
        "analysis_at": "2026-10-15T15:42:59Z",
        "stats": {
            "timeout": 0,
            "harmless": 44,
            "malicious": 14,
            "suspicious": 3,
            "undetected": 31
        },
        "detections": {
            "CRDF": "malicious",
            "DNS8": "suspicious",
            "ESET": "suspicious",
            "VIPRE": "phishing",
            "G-Data": "phishing",
            "Lionic": "phishing",
            "Sophos": "phishing",
            "CyRadar": "phishing",
            "Fortinet": "spam",
            "Netcraft": "malicious",
            "SOCRadar": "phishing",
            "Kaspersky": "phishing",
            "Seclookup": "malicious",
            "Gridinsoft": "phishing",
            "BitDefender": "phishing",
            "alphaMountain.ai": "phishing",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "registrar": "Dynadot Inc",
        "created": "2026-08-10T08:27:42Z",
        "expires": "2027-08-10T08:27:42Z",
        "updated": "2026-08-13T12:28:21Z",
        "first_seen": "2026-08-10T09:18:19Z",
        "dns": [
            {
                "ttl": 300,
                "type": "SOA",
                "rname": "hostmaster.bohatintrade.com",
                "value": "ns1.dyna-ns.net"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "158.94.210.119"
            },
            {
                "ttl": 300,
                "type": "NS",
                "value": "ns1.dyna-ns.net"
            },
            {
                "ttl": 300,
                "type": "MX",
                "value": "parkmail.dynadot.com",
                "priority": 0
            },
            {
                "ttl": 300,
                "type": "NS",
                "value": "ns2.dyna-ns.net"
            }
        ],
        "dns_at": "2026-10-15T16:04:46Z",
        "jarm": "40d40d40d00000000043d43d00043d6aff5ab0f4fc31897186312c9e639319",
        "cert": {
            "san": [
                "bohatintrade.com"
            ],
            "issuer": "Let's Encrypt / YE2",
            "serial": "52a3b6372bdbaaf6bce42ed9a13a15ef07b",
            "sha256": "5dae6086c489292603309bfb58f9434508eebd0a80de9d9ffde1e5744e847e0e",
            "subject": "bohatintrade.com",
            "valid_to": "2026-11-26T12:46:41Z",
            "valid_from": "2026-08-28T12:46:42Z"
        },
        "whois": {
            "registrar": "Dynadot Inc",
            "registrar_iana_id": "472",
            "registrar_url": "http://www.dynadot.com",
            "created": "2026-08-10T08:27:42Z",
            "updated": "2026-08-13T12:28:21Z",
            "expires": "2027-08-10T08:27:42Z",
            "status": [
                "clientTransferProhibited"
            ],
            "nameservers": [
                "ns1.dyna-ns.net",
                "ns2.dyna-ns.net"
            ],
            "dnssec": "unsigned"
        },
        "rdap": {
            "status": [
                "transfer prohibited"
            ],
            "events": {
                "expiration": "2027-08-10T08:27:42Z",
                "last changed": "2026-08-28T10:21:24Z",
                "registration": "2026-08-10T08:27:42Z",
                "registrar expiration": "2027-08-10T08:27:42Z",
                "last update of RDAP database": "2026-10-15T08:14:41Z"
            }
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-23T08:58:11Z",
        "mail_config": {
            "mx": [
                "parkmail.dynadot.com"
            ],
            "spf_lookups": 0
        },
        "caa_records": {
            "domain": "bohatintrade.com"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_by": [
                "CloudFlare Family"
            ],
            "blocked_count": 1
        },
        "robots_txt": {
            "agents": [
                "*"
            ],
            "present": true,
            "sitemaps": [
                "https://bohatintrade.com/sitemap.xml"
            ]
        },
        "sitemap": {
            "present": true,
            "url_count": 5
        },
        "social_tags": {
            "title": "Bohatín — AI platforma pro prediktivní rozhodování",
            "robots": "index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1",
            "description": "Bohatín zpracovává firemní, finanční a tržní data v reálném čase a předkládá doporučení podložená prediktivními modely. Vyžádejte si demo na reálném vzorku dat.",
            "canonicalUrl": "https://bohatintrade.com/"
        },
        "mixed_content": {
            "third_party_scripts": 0
        },
        "status": {
            "up": true,
            "code": 200,
            "timings": {
                "dns": 402,
                "tls": 80,
                "wait": 81,
                "connect": 68,
                "download": 134
            },
            "response_ms": 765
        },
        "tls_connection": {
            "alpn": "h2",
            "cipher": "TLS_AES_128_GCM_SHA256",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                22,
                80,
                443
            ]
        },
        "carbon": {
            "bytes": 73359,
            "co2_grams": 0.0027,
            "cleaner_than": 29
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "162.159.26.92",
                    "host": "ns1.dyna-ns.net"
                },
                {
                    "ip": "162.159.25.5",
                    "host": "ns2.dyna-ns.net"
                }
            ],
            "zone": "bohatintrade.com"
        },
        "location": {
            "ip": "158.94.210.119",
            "asn": "202412",
            "org": "Omegatech LTD",
            "city": "Amsterdam",
            "country": "NL"
        },
        "ssl": {
            "issuer": "Let's Encrypt / YE2",
            "subject": "bohatintrade.com"
        },
        "dns": {
            "A": [
                "158.94.210.119"
            ],
            "MX": [
                "{\"exchange\": \"parkmail.dynadot.com\", \"priority\": 0}"
            ],
            "NS": [
                "ns1.dyna-ns.net",
                "ns2.dyna-ns.net"
            ],
            "SOA": "{\"nsname\": \"ns1.dyna-ns.net\", \"hostmaster\": \"hostmaster.bohatintrade.com\", \"serial\": 2026092801, \"refresh\": 16384, \"retry\": 2048, \"expire\": 1209600, \"minttl\": 300}"
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "hsts": {
            "message": "Site does not serve any HSTS headers."
        },
        "http_security": {
            "xFrameOptions": false,
            "referrerPolicy": "same-origin",
            "xXSSProtection": false,
            "permissionsPolicy": false,
            "xContentTypeOptions": "nosniff",
            "contentSecurityPolicy": false,
            "strictTransportPolicy": false,
            "crossOriginOpenerPolicy": false,
            "crossOriginEmbedderPolicy": false,
            "crossOriginResourcePolicy": false
        },
        "get_ip": {
            "ip": "158.94.210.119",
            "family": 4
        },
        "redirects": {
            "chain": [
                "https://bohatintrade.com"
            ]
        },
        "linked_pages": {
            "internal_count": 8
        },
        "whois": {
            "registrar": "Dynadot Inc",
            "created": "2026-08-10T08:27:42Z",
            "updated": "2026-08-13T12:28:21Z",
            "expires": "2027-08-10T08:27:42Z",
            "status": [
                "clientTransferProhibited https://icann.org/epp"
            ],
            "nameservers": [
                "ns1.dyna-ns.net",
                "ns2.dyna-ns.net"
            ]
        },
        "headers": {
            "headers": {
                "content-type": "text/html; charset=utf-8",
                "x-content-type-options": "nosniff",
                "referrer-policy": "same-origin"
            }
        }
    }
}
```