# PhishDestroy domain threat record: brumelys.net Content language: English Canonical HTML report: https://phishdestroy.io/domain/brumelys.net/ Machine-readable companion: https://phishdestroy.io/domain/brumelys.net/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: unknown - First observed by PhishDestroy: 2026-10-23 14:29:03 UTC - Stored record updated: 2026-10-23 16:30:28 UTC - VirusTotal detections in the stored snapshot: 15/92 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: no stored flag ## Stored classification - Targeted brand: signal ## Stored infrastructure - Observed IP address: 188.114.97.1 - Registrar in stored WHOIS data: Dynadot Inc - Last stored HTTP status: 200 - Registration date (registry RDAP, brumelys.net): 2026-09-29 13:24:57 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a109a8-ec44-7309-925f-a0def505d515/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/brumelys.net - Certificate Transparency search: https://crt.sh/?q=%25.brumelys.net - Web Archive lookup: https://web.archive.org/web/*/https://brumelys.net/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview PhishDestroy added brumelys.net to its internal blocklist on 2026-10-23 after a trusted intake flagged the domain because it was only 24 days old. The recorded page title advertises an AI‑driven investment platform called Brumélys. An HTTP 200 response was observed on the same date, confirming the site was reachable at that time. Google Safe Browsing did not flag the domain and no external blocklists listed it. How the scam works The listing does not confirm a specific fraud technique, but newly created domains that promise AI‑based financial advice are commonly used to lure users into disclosing personal data or credentials. Such pages may collect login details, email addresses, or other information that can later be exploited. Without observed credential submission, the risk remains speculative but warrants caution. Evidence VirusTotal scanned the domain on 2026-10-23 and reported 15 detections from 92 engines, including 12 malicious and 3 suspicious labels from vendors such as BitDefender, ESET and Forcepoint ThreatSeeker. urlscan.io recorded a high malicious score of 96 from its engine model on 2026-10-05, though its overall verdict was non‑malicious. Cloudflare Radar flagged the site as phishing and malware on 2026-10-23. OTX listed two pulses mentioning the domain, and PhishDestroy’s internal blocklist marked it true while external blocklists showed zero hits. Infrastructure The domain was registered with Dynadot Inc on 2026-09-29 and uses Cloudflare nameservers (garret.ns.cloudflare.com, nicole.ns.cloudflare.com). Recorded hosting IPs belong to Cloudflare’s network in Great Britain, and the TLS certificate from Let’s Encrypt is valid from 2026-09-29 to 2026-12-28. DNSSEC is not enabled for the zone. What to do Visitors should avoid entering any credentials, personal data, or financial information on the site; if such data was submitted, change related passwords immediately. Organizations should block the exact domain and monitor logs for connections to the recorded Cloudflare IPs. Security teams can reference the VirusTotal and Cloudflare Radar detections when updating threat intel feeds. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a109a8-ec44-7309-925f-a0def505d515/ Cloudflare Radar report: https://radar.cloudflare.com/scan/c8867e9c-1a83-400e-bd17-0faf6073f940 Stored capture screenshot: https://urlscan.io/screenshots/01a109a8-ec44-7309-925f-a0def505d515.png Cloudflare Radar screenshot (2026-10-23T14:32:58Z): https://screenshots.phishdestroy.io/cf/c8867e9c-1a83-400e-bd17-0faf6073f940.png URLScan screenshot (2026-10-05T12:22:56Z): https://screenshots.phishdestroy.io/us/01a10c04-466d-77fc-a4cf-701217e71e74.png URLScan capture report: https://urlscan.io/result/01a10c04-466d-77fc-a4cf-701217e71e74/ VirusTotal report: https://www.virustotal.com/gui/domain/brumelys.net Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=brumelys.net Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-23 15:08:04 UTC ## Stored page captures - Primary capture: https://urlscan.io/screenshots/01a109a8-ec44-7309-925f-a0def505d515.png Captured: 2026-10-23 14:29:03 UTC - URLScan capture: https://screenshots.phishdestroy.io/01a109a8-ec44-7309-925f-a0def505d515.png Source report: https://urlscan.io/result/01a109a8-ec44-7309-925f-a0def505d515/ - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/c8867e9c-1a83-400e-bd17-0faf6073f940.png Captured: 2026-10-23 14:32:58 UTC Source report: https://radar.cloudflare.com/scan/c8867e9c-1a83-400e-bd17-0faf6073f940 SHA-256: 39d204be4cf5d02078ac17f9f083158e79750d179ad6c3abfd413d750cb9037d - URLScan · 2026-10-05: https://screenshots.phishdestroy.io/us/01a10c04-466d-77fc-a4cf-701217e71e74.png Captured: 2026-10-05 12:22:56 UTC Source report: https://urlscan.io/result/01a10c04-466d-77fc-a4cf-701217e71e74/ SHA-256: 310fc8f4619d853b237846fbd8d394a62eadf29673f5e5c59374053ce0e81182 ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-23T14:34:03Z", "uuid": "01a109a8-ec44-7309-925f-a0def505d515", "scanned_at": "2026-10-05T01:23:55Z", "final_url": "https://brumelys.net/", "status": 200, "ip": "188.114.96.3", "ips": [ "188.114.96.3" ], "asns": [ "13335" ], "link_domains": [ "www.cftc.gov", "www.fca.org.uk", "www.sec.gov" ], "doc_hash": "843bb3f6d2da6d3ee8ff400e185496d7845ffb868806bc99d5c6bb1a544649b3", "script_hashes": [ "2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8", "8aa5f8f647356dcd4fc5dbbe0efd5bc0e8da74026bc61e24636e2e1f5749b0ce", "05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e", "294dada4e00c2a2ff8fcb217ebdc695e5d9a786e70a56bc3561cecb405f91bb4", "6194f015040375c84108b81a0f67994796438909731f95845a41468b2cc7bda7", "92d8e6f62c4b40bc0732fdbdd07ee4369e115c7f68e81ca9c0828f26ed12f2f5", "e79a99543a0af4ea61fa00f8d5d6718501e334693a96e0ed8bf192f30ee62942", "a4000409a897003b1c5a8e1f9f32e18a11b022452151cc47c17ecdcb76d5223b" ], "globals": [ "__dclq", "__dclOrig", "__dclFlush", "__CURRENCY", "__CURRENCY_POS", "__smsCheckBeforeSubmit", "__isSmsEnabled", "__isSmsVerified", "intlTelInput", "$", "jQuery", "faqItems", "count", "countElement" ], "tls": { "san": [ "*.brumelys.net", "brumelys.net" ], "cipher": "AES_128_GCM", "issuer": "YE1", "subject": "brumelys.net", "protocol": "QUIC", "valid_to": "2026-12-28T12:28:49Z", "valid_from": "2026-09-29T12:28:50Z" }, "domain_age_days": 5, "apex_age_days": 5, "tls_age_days": 5, "tls_valid_days": 89, "requests": 36, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 96, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "cloudflare", "content-type": "text/html; charset=utf-8", "x-content-type-options": "nosniff" } }, "cf": { "v": 1, "fetched_at": "2026-10-23T14:34:05Z", "uuid": "c8867e9c-1a83-400e-bd17-0faf6073f940", "scanned_at": "2026-10-23T14:32:58Z", "final_url": "https://brumelys.net/", "status": 200, "history": [ { "url": "https://brumelys.net/", "status": 200 } ], "dom_hash": "502a97c01fc00cd95ea6871aae74646222d3291871f7f85d1b7decffea624180", "doc_hash": "c62d29dabe044a47b3e4db538e3f2d0b9840855ffd92d13f72b6c3a5507a2f3a", "phishing_v2": [ "phishing" ], "domain_risks": [ "Newly Seen Domains", "Security Risks", "New Domains", "Malware", "Security threats", "CIPA Filter", "CIPA" ], "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "brumelys.net", "type": "A", "value": "172.67.154.251" }, { "name": "brumelys.net", "type": "A", "value": "104.21.72.208" }, { "name": "brumelys.net", "type": "AAAA", "value": "2606:4700:3031::ac43:9afb" }, { "name": "brumelys.net", "type": "AAAA", "value": "2606:4700:3031::6815:48d0" } ], "dnssec_valid": false, "ip": "172.67.154.251", "verdict": { "tags": [ "malware" ], "malicious": true, "categories": [ "malware" ] }, "whois": { "registrar": "Dynadot Inc", "created": "2026-09-29T13:24:57Z", "updated": "2026-09-29T13:25:15Z", "expires": "2027-09-29T13:24:57Z", "nameservers": [ "garret.ns.cloudflare.com", "nicole.ns.cloudflare.com" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-23T15:02:36Z", "analysis_at": "2026-10-23T14:37:47Z", "stats": { "timeout": 0, "harmless": 46, "malicious": 12, "suspicious": 3, "undetected": 31 }, "detections": { "CRDF": "malicious", "DNS8": "suspicious", "ESET": "suspicious", "VIPRE": "phishing", "G-Data": "phishing", "Sophos": "phishing", "Fortinet": "spam", "Netcraft": "malicious", "SOCRadar": "phishing", "Kaspersky": "phishing", "Seclookup": "malicious", "Gridinsoft": "phishing", "BitDefender": "phishing", "alphaMountain.ai": "phishing", "Forcepoint ThreatSeeker": "phishing" }, "reputation": 0, "registrar": "Dynadot Inc", "created": "2026-09-29T13:24:57Z", "expires": "2027-09-29T13:24:57Z", "updated": "2026-09-29T13:25:15Z", "first_seen": "2026-09-30T06:17:13Z", "dns": [ { "ttl": 21600, "type": "NS", "value": "nicole.ns.cloudflare.com" }, { "ttl": 300, "type": "A", "value": "172.67.154.251" }, { "ttl": 21600, "type": "NS", "value": "garret.ns.cloudflare.com" }, { "ttl": 300, "type": "AAAA", "value": "2606:4700:3031::6815:48d0" }, { "ttl": 3600, "type": "TXT", "value": "google-site-verification=76noczbJJqjsXtS_imwzFxg128BbvE7oE0eMR3_sLe4" }, { "ttl": 300, "type": "A", "value": "104.21.72.208" }, { "ttl": 1800, "type": "SOA", "rname": "dns.cloudflare.com", "value": "garret.ns.cloudflare.com" }, { "ttl": 300, "type": "AAAA", "value": "2606:4700:3031::ac43:9afb" } ], "dns_at": "2026-10-23T14:39:08Z", "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c", "cert": { "san": [ "*.brumelys.net", "brumelys.net" ], "issuer": "Let's Encrypt / YE1", "serial": "6178f6d3cc561d4b9a352d223f2a6a038c7", "sha256": "400ed929171747fe9a78762e18409043c9704c1fb561637a57e0f12c1f635d86", "subject": "brumelys.net", "valid_to": "2026-12-28T12:28:49Z", "valid_from": "2026-09-29T12:28:50Z" }, "whois": { "registrar": "Dynadot Inc", "registrar_iana_id": "472", "registrar_url": "http://www.dynadot.com", "created": "2026-09-29T13:24:57Z", "updated": "2026-09-29T13:25:15Z", "expires": "2027-09-29T13:24:57Z", "status": [ "clientTransferProhibited" ], "nameservers": [ "garret.ns.cloudflare.com", "nicole.ns.cloudflare.com" ], "dnssec": "unsigned" }, "rdap": { "status": [ "transfer prohibited" ], "events": { "expiration": "2027-09-29T13:24:57Z", "last changed": "2026-09-29T13:25:15Z", "registration": "2026-09-29T13:24:57Z", "registrar expiration": "2027-09-29T13:24:57Z", "last update of RDAP database": "2026-10-23T11:17:52Z" } } }, "webcheck": { "v": 1, "fetched_at": "2026-10-23T14:34:17Z", "mail_config": { "spf_lookups": 0 }, "caa_records": { "domain": "brumelys.net" }, "block_lists": { "resolvers": 12, "blocked_by": [ "CloudFlare Family" ], "blocked_count": 1 }, "archives": { "last": "2026-10-23T14:32:26Z", "first": "2026-09-29T14:41:17Z", "changes": 1, "days_archived": 2, "scans_per_day": 0.04, "avg_page_bytes": 11597 }, "robots_txt": { "agents": [ "*" ], "present": true, "sitemaps": [ "https://brumelys.net/sitemap.xml" ] }, "sitemap": { "present": true, "url_count": 5 }, "social_tags": { "title": "Brumélys — La plateforme IA pour investir avec clarté", "robots": "index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1", "description": "Brumélys est la plateforme d'investissement basée sur l'IA qui transforme les données de marché en recommandations lisibles, sans dépôt minimum requis. Découvrez une analyse de précision accessible dès le premier euro.", "canonicalUrl": "https://brumelys.net/" }, "trackers": { "requests": 48, "trackers": [ { "name": "Cloudflare", "company": "Cloudflare", "country": "US", "category": "Hosting", "requests": 1 }, { "name": "jsDelivr", "company": "jsDelivr", "category": "Hosting", "requests": 3 } ] }, "mixed_content": { "third_party_scripts": 0 }, "status": { "up": true, "code": 200, "timings": { "dns": 1, "tls": 31, "wait": 93, "connect": 8, "download": 11 }, "response_ms": 144 }, "tls_connection": { "alpn": "h2", "cipher": "TLS_AES_256_GCM_SHA384", "protocol": "TLSv1.3", "versions": [ "TLSv1", "TLSv1.1", "TLSv1.2", "TLSv1.3" ], "authorized": true, "forward_secrecy": true }, "ports": { "open": [ 80, 443, 8080 ] }, "carbon": { "bytes": 75558, "co2_grams": 0.0028, "cleaner_than": 28 }, "dns_server": { "ns": [ { "ip": "172.64.32.211", "host": "nicole.ns.cloudflare.com" }, { "ip": "108.162.195.246", "host": "garret.ns.cloudflare.com" } ], "zone": "brumelys.net" }, "cookies": { "cookies": [ { "name": "cf-c", "http_only": true, "same_site": "Lax" }, { "name": "__cf_clicked" }, { "name": "ph_phc_t6w4wzJE2sbz4ro8LmZZTssm5go3KD6mP7QsqcDQRSp6_posthog", "secure": true, "same_site": "Lax" } ] }, "location": { "ip": "2a06:98c1:3121::3", "asn": "13335", "org": "CloudFLARENET-EU", "city": "London", "country": "GB" }, "ssl": { "issuer": "Let's Encrypt / YE1", "subject": "brumelys.net" }, "dns": { "A": [ "188.114.97.3", "188.114.96.3" ], "NS": [ "garret.ns.cloudflare.com", "nicole.ns.cloudflare.com" ], "SOA": "{\"nsname\": \"garret.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2416229959, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}", "TXT": [ "google-site-verification=76noczbJJqjsXtS_imwzFxg128BbvE7oE0eMR3_sLe4" ], "AAAA": [ "2a06:98c1:3121::3", "2a06:98c1:3120::3" ] }, "dnssec": { "ds": false, "rrsig": false, "dnskey": false }, "hsts": { "message": "Site does not serve any HSTS headers." }, "http_security": { "xFrameOptions": false, "referrerPolicy": "same-origin", "xXSSProtection": false, "permissionsPolicy": false, "xContentTypeOptions": "nosniff", "contentSecurityPolicy": false, "strictTransportPolicy": false, "crossOriginOpenerPolicy": false, "crossOriginEmbedderPolicy": false, "crossOriginResourcePolicy": false }, "firewall": { "waf": "Cloudflare", "has_waf": true }, "get_ip": { "ip": "2a06:98c1:3120::3", "family": 6 }, "redirects": { "chain": [ "https://brumelys.net" ] }, "tech_stack": { "technologies": [ "Node.js", "Express", "lit-html", "lit-element", "Cloudflare", "HTTP/3" ] }, "linked_pages": { "internal_count": 9 }, "whois": { "registrar": "Dynadot Inc", "created": "2026-09-29T13:24:57Z", "updated": "2026-09-29T13:25:15Z", "expires": "2027-09-29T13:24:57Z", "status": [ "clientTransferProhibited https://icann.org/epp" ], "nameservers": [ "garret.ns.cloudflare.com", "nicole.ns.cloudflare.com" ] }, "headers": { "headers": { "server": "cloudflare", "content-type": "text/html; charset=utf-8", "x-content-type-options": "nosniff", "referrer-policy": "same-origin" } } } } ```