# PhishDestroy domain threat record: bovirentix-fin.pro Content language: English Canonical HTML report: https://phishdestroy.io/domain/bovirentix-fin.pro/ Machine-readable companion: https://phishdestroy.io/domain/bovirentix-fin.pro/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-10-23 12:02:23 UTC - Last availability or vendor check: 2026-10-23 12:19:01 UTC - Stored record updated: 2026-10-23 18:20:51 UTC - VirusTotal detections in the stored snapshot: 16/92 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: no stored flag ## Stored infrastructure - Observed IP address: 188.114.97.3 - Registrar in stored WHOIS data: NICENIC INTERNATIONAL GROUP CO., LIMITED - Last stored HTTP status: 200 - Registration date (registry RDAP, bovirentix-fin.pro): 2026-03-17 10:46:05 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a168b1-6e09-7218-ac4d-e619525f4c7b/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/bovirentix-fin.pro - Certificate Transparency search: https://crt.sh/?q=%25.bovirentix-fin.pro - Web Archive lookup: https://web.archive.org/web/*/https://bovirentix-fin.pro/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview PhishDestroy added bovirentix-fin.pro to its internal blocklist on 2026-10-23 after a trusted‑auto intake rule flagged the domain as risky. The site presented a page titled “BovirentixFin | AI Trading Platform | Official Website” and returned HTTP 200 on the same date. The domain was first seen by PhishDestroy on 2026-10-23, 220 days after its registration on 2026-03-17. How the scam works The listed detections suggest the domain may be used for phishing or malware distribution, but no specific credential‑stealing form, wallet request, or malicious payload was observed on the captured page. Generic fake‑exchange or phishing kits often mimic legitimate trading services to lure users into providing personal data or downloading harmful files; however, the current evidence does not confirm any particular technique for this site. Evidence VirusTotal scanned the domain on 2026-10-18 and recorded 16 detections from 92 engines, including 11 malicious and 5 suspicious labels from vendors such as BitDefender, ESET and Forcepoint. Google Safe Browsing checked on 2026-10-23 reported no flag. urlscan.io captured the site on 2026-10-23; its engine score was 99 (malicious) but the overall verdict was non‑malicious. Cloudflare Radar on the same day marked the domain as malicious under the malware category. OTX listed three pulses referencing the domain as of 2026-10-23. PhishDestroy’s internal blocklist contains the domain, while external blocklists showed zero hits on the check date. Infrastructure The domain was registered on 2026-03-17 through NICENIC INTERNATIONAL GROUP CO., LIMITED. DNS records resolve to Cloudflare IPs in the UK and US, and the site uses a Google‑issued TLS certificate valid until 2026-12-10. The hosting network is identified as CloudFLARENET‑EU. No DNSSEC signatures were present. The site’s MX record points to mail.bovirentix-fin.pro and an SPF record allows a single IP address. What to do Visitors should avoid entering any credentials, personal information or downloading files from bovirentix-fin.pro. Organizations should block the domain at the firewall or proxy level and monitor outbound traffic for connections to its IP addresses. If any credentials were submitted, change them immediately and consider enabling multi‑factor authentication. Security teams should log any access attempts and treat the domain as potentially malicious in threat‑intel feeds. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a168b1-6e09-7218-ac4d-e619525f4c7b/ Cloudflare Radar report: https://radar.cloudflare.com/scan/b1d0b40d-0444-43ae-a494-90e512441f49 URLQuery report: https://urlquery.net/report/7b990066-5115-41a3-9b3f-7f4bbd90ef7a Stored capture screenshot: https://urlscan.io/screenshots/01a168b1-6e09-7218-ac4d-e619525f4c7b.png Cloudflare Radar screenshot (2026-10-23T12:13:25Z): https://screenshots.phishdestroy.io/cf/b1d0b40d-0444-43ae-a494-90e512441f49.png URLQuery screenshot: https://screenshots.phishdestroy.io/uq/7b990066-5115-41a3-9b3f-7f4bbd90ef7a.png URLScan screenshot (2026-09-11T20:54:20Z): https://screenshots.phishdestroy.io/us/01a0923f-dea6-741d-93ec-da0ff0146e09.png URLScan capture report: https://urlscan.io/result/01a0923f-dea6-741d-93ec-da0ff0146e09/ VirusTotal report: https://www.virustotal.com/gui/domain/bovirentix-fin.pro Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=bovirentix-fin.pro Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-23 12:48:44 UTC ## Stored page captures - Primary capture: https://urlscan.io/screenshots/01a168b1-6e09-7218-ac4d-e619525f4c7b.png Captured: 2026-10-23 12:19:01 UTC - URLScan capture 1: https://screenshots.phishdestroy.io/01a168b1-6e09-7218-ac4d-e619525f4c7b.png Captured: 2026-10-23 12:19:01 UTC Source report: https://urlscan.io/result/01a168b1-6e09-7218-ac4d-e619525f4c7b/ - URLScan capture 2: https://urlscan.io/screenshots/01a0923f-dea6-741d-93ec-da0ff0146e09.png Captured: 2026-10-23 12:02:23 UTC Source report: https://urlscan.io/result/01a168b1-6e09-7218-ac4d-e619525f4c7b/ - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/b1d0b40d-0444-43ae-a494-90e512441f49.png Captured: 2026-10-23 12:13:25 UTC Source report: https://radar.cloudflare.com/scan/b1d0b40d-0444-43ae-a494-90e512441f49 SHA-256: 5e4e958343594d3130efcdc0dad4a54af11597bd80aa6c9421bb2147c3771767 - URLQuery: https://screenshots.phishdestroy.io/uq/7b990066-5115-41a3-9b3f-7f4bbd90ef7a.png Source report: https://urlquery.net/report/7b990066-5115-41a3-9b3f-7f4bbd90ef7a SHA-256: 5a0ecbe2a0f8564220d7dc1c0b8a7c8ea89338f70c5599a8c30bfcfaab09c8f7 - URLScan · 2026-09-11: https://screenshots.phishdestroy.io/us/01a0923f-dea6-741d-93ec-da0ff0146e09.png Captured: 2026-09-11 20:54:20 UTC Source report: https://urlscan.io/result/01a0923f-dea6-741d-93ec-da0ff0146e09/ SHA-256: e6f646c80ecf877fa3adcfee74f8688272a5dba900c9f7c362955665ca8612ed ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-23T12:47:52Z", "uuid": "01a168b1-6e09-7218-ac4d-e619525f4c7b", "scanned_at": "2026-10-23T12:17:13Z", "final_url": "https://bovirentix-fin.pro/", "status": 200, "redirected": "https-only", "redirects": [ { "to": "https://bovirentix-fin.pro/", "from": "http://bovirentix-fin.pro/", "status": 307 } ], "ip": "188.114.96.3", "domains": [ "cdnjs.cloudflare.com", "challenges.cloudflare.com", "cdn.jsdelivr.net", "fonts.googleapis.com", "static.cloudflare.com" ], "ips": [ "104.18.95.41", "104.18.94.41", "104.17.208.5", "142.251.13.95", "104.17.25.14", "188.114.96.3" ], "asns": [ "13335", "15169" ], "countries": [ "US" ], "script_hashes": [ "ccf00d1923b0131a10e0c6d26f95e5dee6ebf8621a27e83c5a2f68a2e0093142" ], "globals": [ "LANG_MSGS", "ClientJS", "_amzgi4", "toggleTermsPopup", "__tsGet", "__tsNeedsClick", "__tsShow", "__tsReset", "__lgBS", "__cfQR", "turnstile", "__cfRLUnblockHandlers", "__lgT0" ], "cookies": [ "entry_url" ], "domain_age_days": 219, "apex_age_days": 219, "tls_age_days": 41, "tls_valid_days": 90, "requests": 22, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 99, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "content-type": "image/png" } }, "cf": { "v": 1, "fetched_at": "2026-10-23T12:16:48Z", "uuid": "b1d0b40d-0444-43ae-a494-90e512441f49", "scanned_at": "2026-10-23T12:13:25Z", "final_url": "https://bovirentix-fin.pro/", "status": 200, "history": [ { "url": "https://bovirentix-fin.pro/", "status": 200 } ], "dom_hash": "079149e0f0ce2b23a395be9369e5f1ca027c04fe5a5d4b6a9316144bf068fb9f", "doc_hash": "59fefc4f5394fc72f39cd8a8afc791d25a105ed88c5c7b26e481d8d993a6672c", "phishing_v2": [ "phishing" ], "domain_risks": [ "Malware", "Security threats", "CIPA Filter", "CIPA" ], "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "bovirentix-fin.pro", "type": "A", "value": "104.21.29.53" }, { "name": "bovirentix-fin.pro", "type": "A", "value": "172.67.171.95" }, { "name": "bovirentix-fin.pro", "type": "AAAA", "value": "2606:4700:3032::ac43:ab5f" }, { "name": "bovirentix-fin.pro", "type": "AAAA", "value": "2606:4700:3035::6815:1d35" } ], "dnssec_valid": false, "ip": "104.21.29.53", "verdict": { "tags": [ "malware" ], "malicious": true, "categories": [ "malware" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-23T12:44:41Z", "analysis_at": "2026-10-18T17:43:41Z", "stats": { "timeout": 0, "harmless": 46, "malicious": 11, "suspicious": 5, "undetected": 30 }, "detections": { "CRDF": "malicious", "DNS8": "suspicious", "ESET": "suspicious", "VIPRE": "phishing", "G-Data": "phishing", "Lionic": "phishing", "Sophos": "phishing", "Fortinet": "spam", "SOCRadar": "phishing", "Kaspersky": "phishing", "Seclookup": "malicious", "Gridinsoft": "suspicious", "BitDefender": "phishing", "alphaMountain.ai": "spam", "Bfore.Ai PreCrime": "malicious", "Forcepoint ThreatSeeker": "phishing" }, "reputation": 0, "categories": { "alphaMountain.ai": "Spam (alphaMountain.ai)" }, "created": "2026-03-17T00:00:00Z", "updated": "2026-03-17T00:00:00Z", "first_seen": "2026-03-17T15:05:51Z", "dns": [ { "ttl": 300, "type": "TXT", "value": "google-site-verification=umfzmcKQqyTHu0iL9RrYmt0a4_9Kpu16cmK_I73810c" }, { "ttl": 300, "type": "TXT", "value": "v=spf1 ip4:46.166.131.92 ~all" }, { "ttl": 1800, "type": "SOA", "rname": "dns.cloudflare.com", "value": "bowen.ns.cloudflare.com" }, { "ttl": 300, "type": "A", "value": "104.21.29.53" }, { "ttl": 300, "type": "A", "value": "172.67.171.95" }, { "ttl": 300, "type": "AAAA", "value": "2606:4700:3035::6815:1d35" }, { "ttl": 21600, "type": "NS", "value": "bowen.ns.cloudflare.com" }, { "ttl": 300, "type": "MX", "value": "mail.bovirentix-fin.pro", "priority": 10 }, { "ttl": 21600, "type": "NS", "value": "nicole.ns.cloudflare.com" }, { "ttl": 300, "type": "AAAA", "value": "2606:4700:3032::ac43:ab5f" } ], "dns_at": "2026-10-18T17:48:58Z", "jarm": "27d40d40d00040d00042d43d00041df04c41293ba84f6efe3a613b22f983e6", "cert": { "san": [ "bovirentix-fin.pro" ], "issuer": "Google Trust Services / WE1", "serial": "3037ffa8912899820ea288025fb1b011", "sha256": "d6c5d7e76d1def1b567f3acf5745baf63f36978f64444f6534ae69006193138c", "subject": "bovirentix-fin.pro", "valid_to": "2026-12-10T15:04:22Z", "valid_from": "2026-09-11T14:04:28Z" }, "whois": [], "rdap": { "status": [ "client delete prohibited", "client transfer prohibited" ], "events": { "expiration": "2027-03-16T16:00:00Z", "registration": "2026-03-16T16:00:00Z", "registrar expiration": "2027-03-16T16:00:00Z", "last update of RDAP database": "2026-03-16T16:00:00Z" }, "registrar": "NICENIC INTERNATIONAL GROUP CO., LIMITED", "registrar_iana_id": "3765" } }, "webcheck": { "v": 1, "fetched_at": "2026-10-23T12:17:03Z", "mail_config": { "mx": [ "mail.bovirentix-fin.pro" ], "spf": "v=spf1 ip4:46.166.131.92 ~all", "spf_lookups": 0 }, "caa_records": { "domain": "bovirentix-fin.pro" }, "block_lists": { "resolvers": 12, "blocked_by": [ "CloudFlare Family" ], "blocked_count": 1 }, "archives": { "last": "2026-10-23T12:05:35Z", "first": "2026-10-23T12:05:35Z", "changes": 0, "days_archived": 1, "avg_page_bytes": 42438 }, "robots_txt": { "agents": [ "*" ], "present": true, "sitemaps": [ "https://bovirentix-fin.pro/sitemap.xml" ] }, "sitemap": { "present": true, "url_count": 175 }, "social_tags": { "ogUrl": "https://bovirentix-fin.pro/", "title": "BovirentixFin | AI Trading Platform | Official Website", "ogType": "website", "robots": "index, follow", "ogTitle": "BovirentixFin | Elite Automated Trading Platform Overview", "ogSiteName": "BovirentixFin", "themeColor": "#0a2040", "description": "BovirentixFin delivers a premium overview of automated trading bots and AI-assisted trading guidance, detailing workflows, governance, security, and execution fundamentals...", "twitterCard": "summary", "canonicalUrl": "https://bovirentix-fin.pro/", "ogDescription": "BovirentixFin presents a premium view of automated trading bots and AI-powered trading assistance, detailing workflows, governance, security practices, and execution features." }, "trackers": { "requests": 18, "trackers": [ { "name": "Cloudflare", "company": "Cloudflare", "country": "US", "category": "Hosting", "requests": 8 }, { "name": "Google Fonts", "company": "Google", "country": "US", "category": "Hosting", "requests": 1 }, { "name": "jsDelivr", "company": "jsDelivr", "category": "Hosting", "requests": 1 } ] }, "mixed_content": { "no_sri": [ "https://static.cloudflare.com/beacon.min.js", "https://challenges.cloudflare.com/turnstile/v0/api.js", "https://cdn.jsdelivr.net/npm/clientjs@0.2.1/dist/client.min.js" ], "third_party_scripts": 3 }, "status": { "up": true, "code": 200, "timings": { "dns": 2, "tls": 17, "wait": 153, "connect": 6, "download": 17 }, "response_ms": 195 }, "tls_connection": { "alpn": "h2", "cipher": "TLS_AES_256_GCM_SHA384", "protocol": "TLSv1.3", "versions": [ "TLSv1.2", "TLSv1.3" ], "authorized": true, "forward_secrecy": true }, "ports": { "open": [ 80, 443, 8080 ] }, "carbon": { "bytes": 142773, "co2_grams": 0.0052, "cleaner_than": 14 }, "dns_server": { "ns": [ { "ip": "162.159.44.83", "host": "bowen.ns.cloudflare.com" }, { "ip": "173.245.58.211", "host": "nicole.ns.cloudflare.com" } ], "zone": "bovirentix-fin.pro" }, "cookies": { "cookies": [ { "name": "entry_url", "secure": true, "same_site": "Lax" } ] }, "location": { "ip": "2a06:98c1:3120::3", "asn": "13335", "org": "CloudFLARENET-EU", "city": "London", "country": "GB" }, "ssl": { "issuer": "Google Trust Services / WE1", "subject": "bovirentix-fin.pro" }, "dns": { "A": [ "188.114.96.3", "188.114.97.3" ], "MX": [ "{\"exchange\": \"mail.bovirentix-fin.pro\", \"priority\": 10}" ], "NS": [ "bowen.ns.cloudflare.com", "nicole.ns.cloudflare.com" ], "SOA": "{\"nsname\": \"bowen.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2418083987, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}", "TXT": [ "google-site-verification=umfzmcKQqyTHu0iL9RrYmt0a4_9Kpu16cmK_I73810c", "v=spf1 ip4:46.166.131.92 ~all" ], "AAAA": [ "2a06:98c1:3120::3", "2a06:98c1:3121::3" ] }, "dnssec": { "ds": false, "rrsig": false, "dnskey": false }, "hsts": { "header": "max-age=15552000; includeSubDomains; preload", "message": "HSTS max-age is 15552000, below the 31536000 minimum." }, "http_security": { "xFrameOptions": "SAMEORIGIN", "referrerPolicy": "strict-origin-when-cross-origin", "xXSSProtection": false, "permissionsPolicy": "camera=(), microphone=(), geolocation=()", "xContentTypeOptions": "nosniff", "contentSecurityPolicy": "style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://cdnjs.cloudflare.com; default-src 'self'; img-src", "strictTransportPolicy": "max-age=15552000; includeSubDomains; preload", "crossOriginOpenerPolicy": "same-origin", "crossOriginEmbedderPolicy": false, "crossOriginResourcePolicy": false }, "firewall": { "waf": "Cloudflare", "has_waf": true }, "get_ip": { "ip": "2a06:98c1:3120::3", "family": 6 }, "redirects": { "chain": [ "https://bovirentix-fin.pro" ] }, "tech_stack": { "technologies": [ "jsDelivr", "Cloudflare Turnstile", "Cloudflare Rocket Loader", "ClientJS", "Priority Hints", "Google Font API", "Font Awesome", "cdnjs", "HSTS", "Cloudflare", "Open Graph", "HTTP/3" ] }, "linked_pages": { "internal_count": 46 }, "headers": { "headers": { "server": "cloudflare", "content-type": "text/html; charset=utf-8", "strict-transport-security": "max-age=15552000; includeSubDomains; preload", "content-security-policy": "style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://cdnjs.cloudflare.com; default-src 'self'; img-src 'self' data: blob:; font-src 'self' https://fonts.gstatic.com https://cdnjs.cloudflare.com; frame-src https://challenges.cloudflare.com; connect-src 'self' https://cloudflareinsigh", "x-frame-options": "SAMEORIGIN", "x-content-type-options": "nosniff", "referrer-policy": "strict-origin-when-cross-origin", "permissions-policy": "camera=(), microphone=(), geolocation=()", "cross-origin-opener-policy": "same-origin" } } } } ```