# PhishDestroy domain threat record: btcdivalisv39.com

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/btcdivalisv39.com/
Machine-readable companion: https://phishdestroy.io/domain/btcdivalisv39.com/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-23 17:12:09 UTC
- Last availability or vendor check: 2026-10-23 17:12:09 UTC
- Stored record updated: 2026-10-23 18:45:56 UTC
- VirusTotal detections in the stored snapshot: 16/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: celer

## Stored infrastructure

- Observed IP address: 158.94.210.119
- Registrar in stored WHOIS data: Dynadot Inc
- Last stored HTTP status: 200
- Registration date in stored WHOIS data: 2026-06-03 13:37:47 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a169bd-ce1f-7415-80b9-8fe050d0507a/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/btcdivalisv39.com
- Certificate Transparency search: https://crt.sh/?q=%25.btcdivalisv39.com
- Web Archive lookup: https://web.archive.org/web/*/https://btcdivalisv39.com/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
PhishDestroy listed btcdivalisv39.com as a suspicious domain based on automated analysis and external detections. The recorded page title reads “BTC‑Divalis v39: AI‑Powered Trading Platform”. The domain was first seen by PhishDestroy on 2026-10-23 and returned an HTTP 200 response at that time.

How the scam works
The listing falls into a generic risk category where sites pose as cryptocurrency trading platforms to entice visitors into disclosing credentials, personal data, or funds. Such pages typically promise AI‑driven performance to appear legitimate, but no specific credential‑collection form or wallet request was observed in the captured snapshot.

Evidence
VirusTotal scanned the domain on 2026-10-23 and reported 16 detections from 92 engines, of which 13 were classified as malicious and 3 as suspicious. Google Safe Browsing checked the same day and did not flag the site. urlscan.io captured the page on 2026-10-23; its engine verdict gave a malicious score of 95 with tags indicating malicious behavior, while the overall verdict was non‑malicious with a score of 0. PhishDestroy’s internal blocklist includes the domain; external blocklists returned zero matches, Spamhaus DBL was clear, and Cloudflare Family listed one block. OTX recorded five pulses referencing the domain on 2026-10-23.

Infrastructure
The domain was registered with Dynadot Inc on 2026-06-03, giving it an age of 142 days at first sighting. The recorded IP address is 158.94.210.119, associated with Omegatech LTD in the Netherlands. TLS was provided by a Let's Encrypt certificate valid from 2026-09-01 to 2026-11-30. Open ports observed were 22, 80 and 443. Authoritative nameservers are ns1.dyna-ns.net and ns2.dyna-ns.net.

What to do
Visitors should avoid entering any credentials, private keys, or payment information on the site; if they have already done so, they should change affected passwords and monitor accounts for unauthorized activity. Defenders can block the exact domain at network perimeters, review logs for connections to 158.94.210.119, and keep threat‑intelligence feeds updated for any new indicators related to btcdivalisv39.com.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a169bd-ce1f-7415-80b9-8fe050d0507a/
Cloudflare Radar report: https://radar.cloudflare.com/scan/1625a0ef-9593-44d8-943f-76d8e36570ab
URLQuery report: https://urlquery.net/report/dbb956f3-c0fc-4ea5-999f-dfb8220c576b
Stored capture screenshot: https://urlscan.io/screenshots/01a169bd-ce1f-7415-80b9-8fe050d0507a.png
Cloudflare Radar screenshot (2026-10-23T17:44:07Z): https://screenshots.phishdestroy.io/cf/1625a0ef-9593-44d8-943f-76d8e36570ab.png
URLQuery screenshot: https://screenshots.phishdestroy.io/uq/dbb956f3-c0fc-4ea5-999f-dfb8220c576b.png
VirusTotal report: https://www.virustotal.com/gui/domain/btcdivalisv39.com
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=btcdivalisv39.com
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-23 18:45:16 UTC

## Stored page captures

- Primary capture: https://urlscan.io/screenshots/01a169bd-ce1f-7415-80b9-8fe050d0507a.png
  Captured: 2026-10-23 17:12:09 UTC
- URLScan capture: https://screenshots.phishdestroy.io/01a169bd-ce1f-7415-80b9-8fe050d0507a.png
  Captured: 2026-10-23 17:12:09 UTC
  Source report: https://urlscan.io/result/01a169bd-ce1f-7415-80b9-8fe050d0507a/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/1625a0ef-9593-44d8-943f-76d8e36570ab.png
  Captured: 2026-10-23 17:44:07 UTC
  Source report: https://radar.cloudflare.com/scan/1625a0ef-9593-44d8-943f-76d8e36570ab
  SHA-256: 0e4d65d65d59bf924c0d91f246fcee4d22df7a60fcec8baa8be316a05cd38ae6
- URLQuery: https://screenshots.phishdestroy.io/uq/dbb956f3-c0fc-4ea5-999f-dfb8220c576b.png
  Source report: https://urlquery.net/report/dbb956f3-c0fc-4ea5-999f-dfb8220c576b
  SHA-256: 06d8697bf6a5e1f28ce253b47b88b656fc065ac309432a6378229fc4cbc33585

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-23T17:44:33Z",
        "uuid": "01a169bd-ce1f-7415-80b9-8fe050d0507a",
        "scanned_at": "2026-10-23T17:10:34Z",
        "final_url": "https://btcdivalisv39.com/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://btcdivalisv39.com/",
                "from": "http://btcdivalisv39.com/",
                "status": 307
            }
        ],
        "ip": "158.94.210.119",
        "ips": [
            "158.94.210.119"
        ],
        "asns": [
            "202412"
        ],
        "countries": [
            "NL"
        ],
        "doc_hash": "9fb20fd3933677c7cd117a3057fc77af81c6f1edf0e995030c2668f9e504b7c5",
        "script_hashes": [
            "8aa5f8f647356dcd4fc5dbbe0efd5bc0e8da74026bc61e24636e2e1f5749b0ce"
        ],
        "globals": [
            "__dclq",
            "__dclOrig",
            "__dclFlush",
            "__smsCheckBeforeSubmit",
            "__isSmsEnabled",
            "__isSmsVerified",
            "intlTelInput",
            "navToggle",
            "mainNav",
            "langBtn",
            "langDropdown"
        ],
        "cookies": [
            "connect.sid"
        ],
        "tls": {
            "san": [
                "btcdivalisv39.com"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "YE2",
            "subject": "btcdivalisv39.com",
            "protocol": "TLS 1.3",
            "valid_to": "2026-11-30T02:45:53Z",
            "valid_from": "2026-09-01T02:45:54Z"
        },
        "domain_age_days": 142,
        "apex_age_days": 142,
        "tls_age_days": 52,
        "tls_valid_days": 89,
        "requests": 5,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 95,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "content-type": "text/html; charset=utf-8",
            "x-content-type-options": "nosniff",
            "referrer-policy": "same-origin"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-23T17:44:39Z",
        "uuid": "1625a0ef-9593-44d8-943f-76d8e36570ab",
        "scanned_at": "2026-10-23T17:44:07Z",
        "final_url": "https://finsy2-occaecati84.cfd/",
        "status": 200,
        "history": [
            {
                "url": "https://btcdivalisv39.com/",
                "status": 200
            },
            {
                "url": "https://finsy2-occaecati84.cfd/",
                "status": 200
            }
        ],
        "dom_hash": "58de4406ae63486739f785405b40842c7e4da0f72d9468e032adbc5cfd02e7d5",
        "doc_hash": "8bf5300a7debc361fbee5c473c7f1e671d71d6094e9821971f2ebcee200db380",
        "phishing_v2": [
            "phishing"
        ],
        "domain_risks": [
            "Newly Seen Domains",
            "Security Risks"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "finsy2-occaecati84.cfd",
                "type": "A",
                "value": "172.67.190.149"
            },
            {
                "name": "finsy2-occaecati84.cfd",
                "type": "A",
                "value": "104.21.81.192"
            },
            {
                "name": "finsy2-occaecati84.cfd",
                "type": "AAAA",
                "value": "2606:4700:3035::6815:51c0"
            },
            {
                "name": "finsy2-occaecati84.cfd",
                "type": "AAAA",
                "value": "2606:4700:3035::ac43:be95"
            }
        ],
        "dnssec_valid": false,
        "ip": "172.67.190.149",
        "whois": {
            "registrar": "NameCheap, Inc.",
            "created": "2026-10-23T16:01:59Z",
            "updated": "2026-10-23T16:02:06Z",
            "expires": "2027-10-23T23:59:59Z",
            "nameservers": [
                "lilyana.ns.cloudflare.com",
                "rocky.ns.cloudflare.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-23T18:43:51Z",
        "analysis_at": "2026-10-23T12:19:01Z",
        "stats": {
            "timeout": 0,
            "harmless": 44,
            "malicious": 13,
            "suspicious": 3,
            "undetected": 32
        },
        "detections": {
            "CRDF": "malicious",
            "DNS8": "suspicious",
            "ESET": "suspicious",
            "VIPRE": "malware",
            "G-Data": "phishing",
            "Lionic": "phishing",
            "Sophos": "phishing",
            "CyRadar": "phishing",
            "Fortinet": "phishing",
            "SOCRadar": "phishing",
            "Kaspersky": "phishing",
            "Seclookup": "malicious",
            "Gridinsoft": "suspicious",
            "BitDefender": "phishing",
            "alphaMountain.ai": "phishing",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "tags": [
            "dga"
        ],
        "categories": {
            "Sophos": "phishing and fraud",
            "alphaMountain.ai": "Phishing (alphaMountain.ai)"
        },
        "registrar": "Dynadot Inc",
        "created": "2026-06-03T15:37:47Z",
        "expires": "2027-06-03T15:37:47Z",
        "updated": "2026-08-13T12:27:06Z",
        "first_seen": "2026-06-03T15:55:40Z",
        "dns": [
            {
                "ttl": 300,
                "type": "SOA",
                "rname": "hostmaster.btcdivalisv39.com",
                "value": "ns1.dyna-ns.net"
            },
            {
                "ttl": 300,
                "type": "NS",
                "value": "ns1.dyna-ns.net"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "158.94.210.119"
            },
            {
                "ttl": 300,
                "type": "NS",
                "value": "ns2.dyna-ns.net"
            }
        ],
        "dns_at": "2026-10-23T12:24:31Z",
        "jarm": "40d40d40d00000000043d43d00043d6aff5ab0f4fc31897186312c9e639319",
        "cert": {
            "san": [
                "btcdivalisv39.com"
            ],
            "issuer": "Let's Encrypt / YE2",
            "serial": "6ba825a8902c029de5e65209bcd4ba5eedb",
            "sha256": "c77d1855efc47675e638859e644d6b9aa9163b6ab2e72d5c1513e42a8122410c",
            "subject": "btcdivalisv39.com",
            "valid_to": "2026-11-30T02:45:53Z",
            "valid_from": "2026-09-01T02:45:54Z"
        },
        "whois": {
            "registrar": "Dynadot Inc",
            "registrar_iana_id": "472",
            "registrar_url": "http://www.dynadot.com",
            "created": "2026-06-03T15:37:47Z",
            "updated": "2026-08-13T12:27:06Z",
            "expires": "2027-06-03T15:37:47Z",
            "status": [
                "clientTransferProhibited"
            ],
            "nameservers": [
                "ns1.dyna-ns.net",
                "ns2.dyna-ns.net"
            ],
            "dnssec": "unsigned"
        },
        "rdap": {
            "status": [
                "transfer prohibited"
            ],
            "events": {
                "expiration": "2027-06-03T15:37:47Z",
                "last changed": "2026-08-31T22:18:25Z",
                "registration": "2026-06-03T15:37:47Z",
                "registrar expiration": "2027-06-03T15:37:47Z",
                "last update of RDAP database": "2026-10-23T10:42:59Z"
            }
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-23T17:44:52Z",
        "mail_config": {
            "spf_lookups": 0
        },
        "caa_records": {
            "domain": "btcdivalisv39.com"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_by": [
                "CloudFlare Family"
            ],
            "blocked_count": 1
        },
        "archives": {
            "last": "2026-10-23T17:13:51Z",
            "first": "2026-10-23T17:13:51Z",
            "changes": 0,
            "days_archived": 1,
            "avg_page_bytes": 23218
        },
        "robots_txt": {
            "agents": [
                "*"
            ],
            "present": true,
            "sitemaps": [
                "https://btcdivalisv39.com/sitemap.xml"
            ]
        },
        "sitemap": {
            "present": true,
            "url_count": 5
        },
        "social_tags": {
            "title": "BTC-Divalis v39: AI-Powered Trading Platform",
            "robots": "index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1",
            "description": "Execute trades with institutional-grade precision. BTC-Divalis v39 delivers an algorithmic trading platform with ISO-certified protocols and 140+ global markets.",
            "canonicalUrl": "https://btcdivalisv39.com/"
        },
        "trackers": {
            "requests": 55,
            "trackers": [
                {
                    "name": "Cloudflare",
                    "company": "Cloudflare",
                    "country": "US",
                    "category": "Hosting",
                    "requests": 1
                },
                {
                    "name": "jsDelivr",
                    "company": "jsDelivr",
                    "category": "Hosting",
                    "requests": 4
                }
            ]
        },
        "mixed_content": {
            "third_party_scripts": 0
        },
        "status": {
            "up": true,
            "code": 200,
            "timings": {
                "dns": 394,
                "tls": 75,
                "wait": 96,
                "connect": 67,
                "download": 135
            },
            "response_ms": 767
        },
        "tls_connection": {
            "alpn": "h2",
            "cipher": "TLS_AES_128_GCM_SHA256",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                22,
                80,
                443
            ]
        },
        "carbon": {
            "bytes": 89866,
            "co2_grams": 0.0033,
            "cleaner_than": 24
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "162.159.26.92",
                    "host": "ns1.dyna-ns.net"
                },
                {
                    "ip": "162.159.25.5",
                    "host": "ns2.dyna-ns.net"
                }
            ],
            "zone": "btcdivalisv39.com"
        },
        "cookies": {
            "cookies": [
                {
                    "name": "cf-c",
                    "http_only": true,
                    "same_site": "Lax"
                },
                {
                    "name": "__cf_clicked"
                },
                {
                    "name": "ph_phc_t6w4wzJE2sbz4ro8LmZZTssm5go3KD6mP7QsqcDQRSp6_posthog",
                    "secure": true,
                    "same_site": "Lax"
                }
            ]
        },
        "location": {
            "ip": "158.94.210.119",
            "asn": "202412",
            "org": "Omegatech LTD",
            "city": "Amsterdam",
            "country": "NL"
        },
        "ssl": {
            "issuer": "Let's Encrypt / YE2",
            "subject": "btcdivalisv39.com"
        },
        "dns": {
            "A": [
                "158.94.210.119"
            ],
            "NS": [
                "ns1.dyna-ns.net",
                "ns2.dyna-ns.net"
            ],
            "SOA": "{\"nsname\": \"ns1.dyna-ns.net\", \"hostmaster\": \"hostmaster.btcdivalisv39.com\", \"serial\": 2026083101, \"refresh\": 16384, \"retry\": 2048, \"expire\": 1209600, \"minttl\": 300}"
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "hsts": {
            "message": "Site does not serve any HSTS headers."
        },
        "http_security": {
            "xFrameOptions": false,
            "referrerPolicy": "same-origin",
            "xXSSProtection": false,
            "permissionsPolicy": false,
            "xContentTypeOptions": "nosniff",
            "contentSecurityPolicy": false,
            "strictTransportPolicy": false,
            "crossOriginOpenerPolicy": false,
            "crossOriginEmbedderPolicy": false,
            "crossOriginResourcePolicy": false
        },
        "get_ip": {
            "ip": "158.94.210.119",
            "family": 4
        },
        "redirects": {
            "chain": [
                "https://btcdivalisv39.com"
            ]
        },
        "linked_pages": {
            "internal_count": 30
        },
        "whois": {
            "registrar": "Dynadot Inc",
            "created": "2026-06-03T15:37:47Z",
            "updated": "2026-08-13T12:27:06Z",
            "expires": "2027-06-03T15:37:47Z",
            "status": [
                "clientTransferProhibited https://icann.org/epp"
            ],
            "nameservers": [
                "ns1.dyna-ns.net",
                "ns2.dyna-ns.net"
            ]
        },
        "headers": {
            "headers": {
                "content-type": "text/html; charset=utf-8",
                "x-content-type-options": "nosniff",
                "referrer-policy": "same-origin"
            }
        }
    }
}
```