# PhishDestroy domain threat record: btcaurallonv15.digital Content language: English Canonical HTML report: https://phishdestroy.io/domain/btcaurallonv15.digital/ Machine-readable companion: https://phishdestroy.io/domain/btcaurallonv15.digital/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-10-23 17:05:53 UTC - Last availability or vendor check: 2026-10-23 17:05:53 UTC - Stored record updated: 2026-10-23 18:30:16 UTC - VirusTotal detections in the stored snapshot: 19/92 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: no stored flag ## Stored infrastructure - Observed IP address: 104.21.22.50 - Registrar in stored WHOIS data: Dynadot Inc - Last stored HTTP status: 200 - Registration date in stored WHOIS data: 2026-04-12 05:03:15 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a169b8-0e6b-766e-86fd-ac91c8ad4d6e/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/btcaurallonv15.digital - Certificate Transparency search: https://crt.sh/?q=%25.btcaurallonv15.digital - Web Archive lookup: https://web.archive.org/web/*/https://btcaurallonv15.digital/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview PhishDestroy listed btcaurallonv15.digital as a suspicious domain on 2026-10-23. The site presented the title "btc-aurallon v15 | AI Trading Platform | Official Website" and returned HTTP 200 on the same day. The recorded page content was not captured, so the assessment relies on external detections rather than observed malicious behavior. How the scam works A suspicious domain classification typically indicates that the site may be used for phishing, malware delivery, or other fraudulent activities, but no specific technique was observed on this page. The title suggests an AI‑powered trading service, a common lure for credential harvesting or deceptive investment offers. Without concrete evidence of a form, download, or wallet request, the risk remains generic to the category of fraudulent crypto‑related sites. Evidence VirusTotal scanned the domain on 2026-10-21 and reported 19 detections from 92 engines, including 16 malicious and 3 suspicious labels from vendors such as BitDefender, ESET and CRDF. Google Safe Browsing checked on 2026-10-23 returned no flag. OTX listed five pulses mentioning the domain as of 2026-10-23. Cloudflare Radar on 2026-10-23 marked the site as malicious with phishing and malware tags. URLScan on 2026-10-23 gave a malicious engine score of 97, though its overall verdict was non‑malicious. PhishDestroy’s internal blocklist contains the domain, while external blocklists reported zero hits on the same date. Infrastructure The domain was registered with Dynadot on 2026-04-12, 194 days before first detection. DNS records observed at the time pointed to Cloudflare IPs 104.21.22.50 and 172.67.202.241 as well as AAAA addresses, showing the site was using Cloudflare’s CDN. The TLS certificate, issued by Google Trust Services, was valid until 2027-01-04. No DNSSEC records were present. What to do Avoid entering any credentials, personal data, or cryptocurrency wallet information on this site. If you have already submitted such data, change passwords immediately and monitor associated accounts for unauthorized activity. Network defenders should block traffic to btcaurallonv15.digital at the firewall or proxy level and review logs for any connections to the recorded IPs. Continue to monitor security feeds for any new indicators related to this domain. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a169b8-0e6b-766e-86fd-ac91c8ad4d6e/ Cloudflare Radar report: https://radar.cloudflare.com/scan/a9faae06-4f82-4c2f-8657-9c094c95f2d8 URLQuery report: https://urlquery.net/report/f9f23a93-48bb-42ef-972c-52d2e06c8250 Stored capture screenshot: https://urlscan.io/screenshots/01a169b8-0e6b-766e-86fd-ac91c8ad4d6e.png Cloudflare Radar screenshot (2026-10-23T17:44:16Z): https://screenshots.phishdestroy.io/cf/a9faae06-4f82-4c2f-8657-9c094c95f2d8.png URLQuery screenshot: https://screenshots.phishdestroy.io/uq/f9f23a93-48bb-42ef-972c-52d2e06c8250.png URLScan screenshot (2026-10-23T17:05:46Z): https://screenshots.phishdestroy.io/us/01a169b9-9a2d-747a-9b99-857420d3dad3.png URLScan capture report: https://urlscan.io/result/01a169b9-9a2d-747a-9b99-857420d3dad3/ VirusTotal report: https://www.virustotal.com/gui/domain/btcaurallonv15.digital Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=btcaurallonv15.digital Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-23 17:47:13 UTC ## Stored page captures - Primary capture: https://urlscan.io/screenshots/01a169b8-0e6b-766e-86fd-ac91c8ad4d6e.png Captured: 2026-10-23 17:05:53 UTC - URLScan capture: https://screenshots.phishdestroy.io/01a169b8-0e6b-766e-86fd-ac91c8ad4d6e.png Captured: 2026-10-23 17:05:53 UTC Source report: https://urlscan.io/result/01a169b8-0e6b-766e-86fd-ac91c8ad4d6e/ - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/a9faae06-4f82-4c2f-8657-9c094c95f2d8.png Captured: 2026-10-23 17:44:16 UTC Source report: https://radar.cloudflare.com/scan/a9faae06-4f82-4c2f-8657-9c094c95f2d8 SHA-256: 60fc2c08e36af1d008c65d2e073b7a96c9da8327abaa4045978d36da71fdb8ad - URLQuery: https://screenshots.phishdestroy.io/uq/f9f23a93-48bb-42ef-972c-52d2e06c8250.png Source report: https://urlquery.net/report/f9f23a93-48bb-42ef-972c-52d2e06c8250 SHA-256: 7330c68cefcb2aa8cc6c6d7e5711481aec087131586174bb0779ecfd1f55327c - URLScan · 2026-10-23: https://screenshots.phishdestroy.io/us/01a169b9-9a2d-747a-9b99-857420d3dad3.png Captured: 2026-10-23 17:05:46 UTC Source report: https://urlscan.io/result/01a169b9-9a2d-747a-9b99-857420d3dad3/ SHA-256: e3f6ea272fa133f404901dca703e16e3a3f8649c138e8bd7c09ed2d54ee0dc13 ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-23T17:46:20Z", "uuid": "01a169b8-0e6b-766e-86fd-ac91c8ad4d6e", "scanned_at": "2026-10-23T17:04:03Z", "final_url": "https://btcaurallonv15.digital/", "status": 200, "redirected": "https-only", "redirects": [ { "to": "https://btcaurallonv15.digital/", "from": "http://btcaurallonv15.digital/", "status": 307 } ], "ip": "104.21.22.50", "domains": [ "challenges.cloudflare.com", "cdnjs.cloudflare.com", "cdn.jsdelivr.net", "fonts.googleapis.com", "static.cloudflare.com" ], "ips": [ "104.18.94.41", "104.18.95.41", "104.17.207.5", "142.250.154.95", "104.17.24.14", "104.21.22.50" ], "asns": [ "13335", "15169" ], "countries": [ "US" ], "doc_hash": "f79fd2d1ed2f68ca09a36938f51229d4b18261918aae335a93b64b86a849a7cf", "script_hashes": [ "ccf00d1923b0131a10e0c6d26f95e5dee6ebf8621a27e83c5a2f68a2e0093142" ], "globals": [ "LANG_MSGS", "ClientJS", "_s8grvx", "toggleTermsPopup", "__tsGet", "__tsNeedsClick", "__tsShow", "__tsReset", "__lgBS", "__cfQR", "turnstile", "__cfRLUnblockHandlers", "__lgT0" ], "cookies": [ "entry_url" ], "tls": { "san": [ "btcaurallonv15.digital" ], "cipher": "AES_128_GCM", "issuer": "WE1", "subject": "btcaurallonv15.digital", "protocol": "QUIC", "valid_to": "2027-01-04T17:45:12Z", "valid_from": "2026-10-06T16:45:16Z" }, "domain_age_days": 194, "apex_age_days": 194, "tls_age_days": 17, "tls_valid_days": 90, "requests": 21, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 97, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "cloudflare", "content-type": "text/html; charset=utf-8", "strict-transport-security": "max-age=15552000; includeSubDomains; preload", "content-security-policy": "connect-src 'self' https://cloudflareinsights.com https://challenges.cloudflare.com; frame-ancestors 'self'; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://cdnjs.cloudflare.com;", "x-frame-options": "SAMEORIGIN", "x-content-type-options": "nosniff", "referrer-policy": "strict-origin", "permissions-policy": "camera=(), microphone=(), geolocation=()", "cross-origin-opener-policy": "same-origin" } }, "cf": { "v": 1, "fetched_at": "2026-10-23T17:46:22Z", "uuid": "a9faae06-4f82-4c2f-8657-9c094c95f2d8", "scanned_at": "2026-10-23T17:44:16Z", "final_url": "https://btcaurallonv15.digital/", "status": 200, "history": [ { "url": "https://btcaurallonv15.digital/", "status": 200 } ], "dom_hash": "07ad2a457c509d35b93e895830cd407e7401fb892294e631741e48a42d430423", "doc_hash": "0cb40be089d7dba2cf6f823ef6345606516a90e26aabe1e71c4f1a0bd46ea402", "phishing_v2": [ "phishing" ], "domain_risks": [ "Malware", "Security threats", "CIPA Filter", "CIPA" ], "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "btcaurallonv15.digital", "type": "A", "value": "172.67.202.241" }, { "name": "btcaurallonv15.digital", "type": "A", "value": "104.21.22.50" }, { "name": "btcaurallonv15.digital", "type": "AAAA", "value": "2606:4700:3031::6815:1632" }, { "name": "btcaurallonv15.digital", "type": "AAAA", "value": "2606:4700:3032::ac43:caf1" } ], "dnssec_valid": false, "ip": "172.67.202.241", "verdict": { "tags": [ "malware" ], "malicious": true, "categories": [ "malware" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-23T17:43:47Z", "analysis_at": "2026-10-21T13:55:58Z", "stats": { "timeout": 0, "harmless": 43, "malicious": 16, "suspicious": 3, "undetected": 30 }, "detections": { "CRDF": "malicious", "DNS8": "suspicious", "ESET": "suspicious", "VIPRE": "malware", "G-Data": "phishing", "Lionic": "phishing", "Sophos": "phishing", "CyRadar": "phishing", "Webroot": "malicious", "Fortinet": "phishing", "SOCRadar": "phishing", "Kaspersky": "phishing", "Seclookup": "malicious", "Gridinsoft": "suspicious", "BitDefender": "phishing", "Chong Lua Dao": "malicious", "alphaMountain.ai": "phishing", "Bfore.Ai PreCrime": "malicious", "Forcepoint ThreatSeeker": "phishing" }, "reputation": 0, "tags": [ "dga" ], "created": "2026-04-12T00:00:00Z", "updated": "2026-04-12T00:00:00Z", "first_seen": "2026-04-12T09:23:23Z", "dns": [ { "ttl": 300, "type": "AAAA", "value": "2606:4700:3031::6815:1632" }, { "ttl": 300, "type": "AAAA", "value": "2606:4700:3032::ac43:caf1" }, { "ttl": 21600, "type": "NS", "value": "serenity.ns.cloudflare.com" }, { "ttl": 300, "type": "A", "value": "172.67.202.241" }, { "ttl": 1800, "type": "SOA", "rname": "dns.cloudflare.com", "value": "clayton.ns.cloudflare.com" }, { "ttl": 21600, "type": "NS", "value": "clayton.ns.cloudflare.com" }, { "ttl": 300, "type": "A", "value": "104.21.22.50" } ], "dns_at": "2026-10-21T14:01:12Z", "jarm": "27d40d40d00040d00042d43d00041df04c41293ba84f6efe3a613b22f983e6", "cert": { "san": [ "btcaurallonv15.digital" ], "issuer": "Google Trust Services / WE1", "serial": "1c0c759834ff51e10e3b2e1372bb9321", "sha256": "21df7144d378615f60984125f5da80323ccc4b7b2a5d1478c23787a3fcf8e3d8", "subject": "btcaurallonv15.digital", "valid_to": "2027-01-04T17:45:12Z", "valid_from": "2026-10-06T16:45:16Z" }, "rdap": { "status": [ "transfer prohibited" ], "events": { "expiration": "2027-04-12T07:03:15Z", "last changed": "2026-04-12T08:44:16Z", "registration": "2026-04-12T07:03:15Z", "registrar expiration": "2027-04-12T07:03:15Z", "last update of RDAP database": "2026-10-16T06:59:07Z" }, "registrar": "DYNADOT LLC", "registrar_iana_id": "472" } }, "webcheck": { "v": 1, "fetched_at": "2026-10-23T17:46:40Z", "mail_config": { "spf_lookups": 0 }, "caa_records": { "domain": "btcaurallonv15.digital" }, "block_lists": { "resolvers": 12, "blocked_by": [ "CloudFlare Family" ], "blocked_count": 1 }, "archives": { "last": "2026-10-23T17:11:17Z", "first": "2026-10-16T06:39:56Z", "changes": 1, "days_archived": 2, "scans_per_day": 0.13, "avg_page_bytes": 40911 }, "robots_txt": { "agents": [ "*" ], "present": true, "sitemaps": [ "https://btcaurallonv15.digital/sitemap.xml" ] }, "sitemap": { "present": true, "url_count": 140 }, "social_tags": { "title": "btc-aurallon v15 | AI Trading Platform | Official Website", "robots": "index, follow", "description": "btc-aurallon v15 delivers AI-powered trading support and automated bots with configurable execution controls, monitoring dashboards, and robust operational tooling.", "canonicalUrl": "https://btcaurallonv15.digital/" }, "trackers": { "requests": 18, "trackers": [ { "name": "Cloudflare", "company": "Cloudflare", "country": "US", "category": "Hosting", "requests": 6 }, { "name": "Google Fonts", "company": "Google", "country": "US", "category": "Hosting", "requests": 1 }, { "name": "jsDelivr", "company": "jsDelivr", "category": "Hosting", "requests": 1 } ] }, "mixed_content": { "no_sri": [ "https://static.cloudflare.com/beacon.min.js", "https://challenges.cloudflare.com/turnstile/v0/api.js", "https://cdn.jsdelivr.net/npm/clientjs@0.2.1/dist/client.min.js" ], "third_party_scripts": 3 }, "status": { "up": true, "code": 200, "timings": { "dns": 3, "tls": 23, "wait": 137, "connect": 8, "download": 12 }, "response_ms": 183 }, "tls_connection": { "alpn": "h2", "cipher": "TLS_AES_256_GCM_SHA384", "protocol": "TLSv1.3", "versions": [ "TLSv1.2", "TLSv1.3" ], "authorized": true, "forward_secrecy": true }, "ports": { "open": [ 80, 443, 8080 ] }, "carbon": { "bytes": 140923, "co2_grams": 0.0052, "cleaner_than": 15 }, "dns_server": { "ns": [ { "ip": "108.162.195.226", "host": "clayton.ns.cloudflare.com" }, { "ip": "108.162.194.108", "host": "serenity.ns.cloudflare.com" } ], "zone": "btcaurallonv15.digital" }, "cookies": { "cookies": [ { "name": "entry_url", "secure": true, "same_site": "Lax" } ] }, "location": { "ip": "2606:4700:3032::ac43:caf1", "asn": "13335", "org": "Cloudflare, Inc.", "city": "Toronto", "country": "CA" }, "ssl": { "issuer": "Google Trust Services / WE1", "subject": "btcaurallonv15.digital" }, "dns": { "A": [ "172.67.202.241", "104.21.22.50" ], "NS": [ "clayton.ns.cloudflare.com", "serenity.ns.cloudflare.com" ], "SOA": "{\"nsname\": \"clayton.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2418084770, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}", "AAAA": [ "2606:4700:3031::6815:1632", "2606:4700:3032::ac43:caf1" ] }, "dnssec": { "ds": false, "rrsig": false, "dnskey": false }, "hsts": { "header": "max-age=15552000; includeSubDomains; preload", "message": "HSTS max-age is 15552000, below the 31536000 minimum." }, "http_security": { "xFrameOptions": "SAMEORIGIN", "referrerPolicy": "strict-origin", "xXSSProtection": false, "permissionsPolicy": "camera=(), microphone=(), geolocation=()", "xContentTypeOptions": "nosniff", "contentSecurityPolicy": "connect-src 'self' https://cloudflareinsights.com https://challenges.cloudflare.com; frame-ancestors 'self'; style-src '", "strictTransportPolicy": "max-age=15552000; includeSubDomains; preload", "crossOriginOpenerPolicy": "same-origin", "crossOriginEmbedderPolicy": false, "crossOriginResourcePolicy": false }, "firewall": { "waf": "Cloudflare", "has_waf": true }, "get_ip": { "ip": "2606:4700:3031::6815:1632", "family": 6 }, "redirects": { "chain": [ "https://btcaurallonv15.digital" ] }, "linked_pages": { "internal_count": 39 }, "headers": { "headers": { "server": "cloudflare", "content-type": "text/html; charset=utf-8", "strict-transport-security": "max-age=15552000; includeSubDomains; preload", "content-security-policy": "connect-src 'self' https://cloudflareinsights.com https://challenges.cloudflare.com; frame-ancestors 'self'; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://cdnjs.cloudflare.com; frame-src https://challenges.cloudflare.com; font-src 'self' https://fonts.gstatic.com https://cdnj", "x-frame-options": "SAMEORIGIN", "x-content-type-options": "nosniff", "referrer-policy": "strict-origin", "permissions-policy": "camera=(), microphone=(), geolocation=()", "cross-origin-opener-policy": "same-origin" } } } } ```