# PhishDestroy domain threat record: btcnivalis.shop

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/btcnivalis.shop/
Machine-readable companion: https://phishdestroy.io/domain/btcnivalis.shop/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-23 17:34:29 UTC
- Last availability or vendor check: 2026-10-23 23:14:36 UTC
- Stored record updated: 2026-10-24 06:20:55 UTC
- VirusTotal detections in the stored snapshot: 18/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored infrastructure

- Observed IP address: 188.114.96.3
- Registrar in stored WHOIS data: Dynadot Inc.
- Last stored HTTP status: 200
- Registration date (registry RDAP, btcnivalis.shop): 2026-06-03 07:36:45 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a169d2-3fbc-73cd-b284-1a1933135bb9/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/btcnivalis.shop
- Certificate Transparency search: https://crt.sh/?q=%25.btcnivalis.shop
- Web Archive lookup: https://web.archive.org/web/*/https://btcnivalis.shop/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
PhishDestroy’s automated assessment categorizes btcnivalis.shop as a fake crypto exchange. The recorded page title reads “BTC Nivalis | AI Crypto Trading Platform | Official Website.” The domain was first seen by PhishDestroy on 2026-10-23. A request on 2026-10-24 returned HTTP status code 200.

How the scam works
Fake exchange sites typically advertise high‑yield or AI‑driven trading to convince visitors to deposit cryptocurrency, then disappear with the funds or harvest private keys. They may also harvest login credentials for legitimate exchanges, enabling subsequent unauthorized withdrawals.

Evidence
VirusTotal scanned the domain on 2026-10-21 and reported 18 detections from 92 engines, including 15 malicious and 3 suspicious labels from vendors such as BitDefender, ESET and Forcepoint ThreatSeeker. Google Safe Browsing checked on 2026-10-24 and did not flag the site. URLScan captured the page on 2026-10-23; its engine analysis marked it malicious with a score of 95, though the overall verdict was non‑malicious. Cloudflare Radar also scanned on 2026-10-23 and returned a malicious verdict with a malware category. OTX listed five pulses referencing the domain as of 2026-10-24. PhishDestroy’s internal blocklist includes the domain, while external blocklists returned zero matches on the same date.

Infrastructure
The domain was registered on 2026-06-03 through Dynadot Inc., 142 days before its first sighting. Hosting records show the site resolved to IP 188.114.96.3, associated with the CloudFLARENET‑EU network in Great Britain. TLS details captured on 2026-10-24 show a Google Trust Services certificate valid until 2026-12-29, with the connection using TLS 1.3 and a Cloudflare web‑application firewall in place.

What to do
Visitors should avoid entering any credentials, private keys or sending cryptocurrency to the site; if such data were submitted, change associated passwords immediately and revoke any wallet approvals. Users who may have exposed seed phrases should generate a new secure wallet and transfer assets. Defenders can block the exact domain and its resolved IPs, monitor DNS queries for 188.114.96.3, and apply firewall rules to prevent outbound connections to this address.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a169d2-3fbc-73cd-b284-1a1933135bb9/
Cloudflare Radar report: https://radar.cloudflare.com/scan/1a132208-5310-4420-b18f-1d0d8015030f
Stored capture screenshot: https://urlscan.io/screenshots/01a169d2-3fbc-73cd-b284-1a1933135bb9.png
Cloudflare Radar screenshot (2026-10-23T18:07:40Z): https://screenshots.phishdestroy.io/cf/1a132208-5310-4420-b18f-1d0d8015030f.png
URLScan screenshot (2026-10-23T17:15:03Z): https://screenshots.phishdestroy.io/us/01a169c2-244e-733e-9535-4ae3bf9faad8.png
URLScan capture report: https://urlscan.io/result/01a169c2-244e-733e-9535-4ae3bf9faad8/
VirusTotal report: https://www.virustotal.com/gui/domain/btcnivalis.shop
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=btcnivalis.shop
Revoke token approvals: https://revoke.cash/
Report crypto fraud (Chainabuse): https://www.chainabuse.com/report
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-24 00:10:53 UTC

## Stored page captures

- Primary capture: https://urlscan.io/screenshots/01a169d2-3fbc-73cd-b284-1a1933135bb9.png
  Captured: 2026-10-23 17:34:29 UTC
- URLScan capture: https://screenshots.phishdestroy.io/01a169d2-3fbc-73cd-b284-1a1933135bb9.png
  Captured: 2026-10-23 17:34:29 UTC
  Source report: https://urlscan.io/result/01a169d2-3fbc-73cd-b284-1a1933135bb9/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/1a132208-5310-4420-b18f-1d0d8015030f.png
  Captured: 2026-10-23 18:07:40 UTC
  Source report: https://radar.cloudflare.com/scan/1a132208-5310-4420-b18f-1d0d8015030f
  SHA-256: dfa3950827206c272f7eb3cecbb757c31e95126292add3ed13cbad6f69e21100
- URLScan · 2026-10-23: https://screenshots.phishdestroy.io/us/01a169c2-244e-733e-9535-4ae3bf9faad8.png
  Captured: 2026-10-23 17:15:03 UTC
  Source report: https://urlscan.io/result/01a169c2-244e-733e-9535-4ae3bf9faad8/
  SHA-256: 42974b9ffbec860c86d0b6c9cf1e0a2ba5d26718eeacec2f0a20eb32f1844e5a

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-23T18:04:11Z",
        "uuid": "01a169d2-3fbc-73cd-b284-1a1933135bb9",
        "scanned_at": "2026-10-23T17:32:40Z",
        "final_url": "https://btcnivalis.shop/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://btcnivalis.shop/",
                "from": "http://btcnivalis.shop/",
                "status": 307
            }
        ],
        "ip": "172.67.201.65",
        "domains": [
            "cdnjs.cloudflare.com",
            "challenges.cloudflare.com",
            "cdn.jsdelivr.net",
            "fonts.googleapis.com",
            "static.cloudflareinsights.com",
            "static.cloudflare.com"
        ],
        "ips": [
            "104.18.95.41",
            "104.17.207.5",
            "172.217.222.95",
            "104.17.25.14",
            "172.67.201.65"
        ],
        "asns": [
            "13335",
            "15169"
        ],
        "countries": [
            "US"
        ],
        "doc_hash": "5ee5981fe637217a07cfef8a1ee1709bd345b8c6c580227f5eea5b09a0122c43",
        "script_hashes": [
            "ccf00d1923b0131a10e0c6d26f95e5dee6ebf8621a27e83c5a2f68a2e0093142"
        ],
        "globals": [
            "LANG_MSGS",
            "ClientJS",
            "_hskz4",
            "toggleTermsPopup",
            "__tsGet",
            "__tsNeedsClick",
            "__tsShow",
            "__tsReset",
            "__lgBS",
            "__cfQR",
            "turnstile",
            "__cfRLUnblockHandlers",
            "__lgT0"
        ],
        "cookies": [
            "entry_url"
        ],
        "tls": {
            "san": [
                "btcnivalis.shop"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "WE1",
            "subject": "btcnivalis.shop",
            "protocol": "TLS 1.3",
            "valid_to": "2026-12-29T23:50:32Z",
            "valid_from": "2026-09-30T22:50:33Z"
        },
        "domain_age_days": 142,
        "apex_age_days": 142,
        "tls_age_days": 22,
        "tls_valid_days": 90,
        "requests": 21,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 95,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "cloudflare",
            "content-type": "text/html; charset=utf-8",
            "strict-transport-security": "max-age=15552000; includeSubDomains; preload",
            "content-security-policy": "default-src 'self'; frame-src https://challenges.cloudflare.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://cdnjs.cloudflare.com; img-src 'self' data: blob:; connect-src 'se",
            "x-frame-options": "SAMEORIGIN",
            "x-content-type-options": "nosniff",
            "referrer-policy": "strict-origin-when-cross-origin",
            "permissions-policy": "camera=(), microphone=(), geolocation=()",
            "cross-origin-opener-policy": "same-origin"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-23T18:08:09Z",
        "uuid": "1a132208-5310-4420-b18f-1d0d8015030f",
        "scanned_at": "2026-10-23T18:07:40Z",
        "final_url": "https://btcnivalis.shop/",
        "status": 200,
        "history": [
            {
                "url": "https://btcnivalis.shop/",
                "status": 200
            }
        ],
        "dom_hash": "7433f69ec6e314bbc42e1b14d75f33eb3c8d6ce9bc386299b46f8c84a4dfff48",
        "doc_hash": "05b567cee18635a7c46ee22fe60e247c399e6c87a7401b26576f69d3ede7e73c",
        "phishing_v2": [
            "phishing"
        ],
        "domain_risks": [
            "Malware",
            "Security threats",
            "CIPA Filter",
            "CIPA"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "btcnivalis.shop",
                "type": "A",
                "value": "188.114.96.0"
            },
            {
                "name": "btcnivalis.shop",
                "type": "A",
                "value": "188.114.97.0"
            },
            {
                "name": "btcnivalis.shop",
                "type": "AAAA",
                "value": "2a06:98c1:3121::"
            },
            {
                "name": "btcnivalis.shop",
                "type": "AAAA",
                "value": "2a06:98c1:3120::"
            }
        ],
        "dnssec_valid": false,
        "ip": "188.114.96.0",
        "verdict": {
            "tags": [
                "malware"
            ],
            "malicious": true,
            "categories": [
                "malware"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-24T00:10:20Z",
        "analysis_at": "2026-10-21T13:56:28Z",
        "stats": {
            "timeout": 0,
            "harmless": 41,
            "malicious": 15,
            "suspicious": 3,
            "undetected": 33
        },
        "detections": {
            "CRDF": "malicious",
            "DNS8": "suspicious",
            "ESET": "suspicious",
            "VIPRE": "phishing",
            "G-Data": "phishing",
            "Lionic": "phishing",
            "Sophos": "phishing",
            "CyRadar": "phishing",
            "Webroot": "malicious",
            "Fortinet": "phishing",
            "SOCRadar": "phishing",
            "Kaspersky": "phishing",
            "Seclookup": "malicious",
            "Gridinsoft": "suspicious",
            "BitDefender": "phishing",
            "Chong Lua Dao": "malicious",
            "alphaMountain.ai": "phishing",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "tags": [
            "dga"
        ],
        "first_seen": "2026-06-03T09:59:13Z",
        "dns": [
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3036::6815:4cd7"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "104.21.76.215"
            },
            {
                "ttl": 1800,
                "type": "SOA",
                "rname": "dns.cloudflare.com",
                "value": "izabella.ns.cloudflare.com"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "izabella.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "172.67.201.65"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3033::ac43:c941"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "yadiel.ns.cloudflare.com"
            }
        ],
        "dns_at": "2026-10-21T14:02:08Z",
        "jarm": "27d40d40d00040d00042d43d00041df04c41293ba84f6efe3a613b22f983e6",
        "cert": {
            "san": [
                "btcnivalis.shop"
            ],
            "issuer": "Google Trust Services / WE1",
            "serial": "f4204e2c0457e75130eb1cae4c0d468",
            "sha256": "ce4741137672239da945ebde1bdb56b018666d70e8ac5921f27e5b6180856ade",
            "subject": "btcnivalis.shop",
            "valid_to": "2026-12-29T23:50:32Z",
            "valid_from": "2026-09-30T22:50:33Z"
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-23T18:08:23Z",
        "mail_config": {
            "spf_lookups": 0
        },
        "caa_records": {
            "domain": "btcnivalis.shop"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_by": [
                "CloudFlare Family"
            ],
            "blocked_count": 1
        },
        "archives": {
            "last": "2026-10-23T17:35:17Z",
            "first": "2026-10-23T17:35:17Z",
            "changes": 0,
            "days_archived": 1,
            "avg_page_bytes": 42711
        },
        "robots_txt": {
            "agents": [
                "*"
            ],
            "present": true,
            "sitemaps": [
                "https://btcnivalis.shop/sitemap.xml"
            ]
        },
        "sitemap": {
            "present": true,
            "url_count": 140
        },
        "social_tags": {
            "title": "BTC Nivalis | AI Crypto Trading Platform | Official Website",
            "robots": "index, follow",
            "themeColor": "#0d0d12",
            "description": "BTC Nivalis delivers a premium, AI-assisted trading platform featuring automated strategies, execution orchestration, and risk governance for informed decision-making.",
            "canonicalUrl": "https://btcnivalis.shop/"
        },
        "trackers": {
            "requests": 21,
            "trackers": [
                {
                    "name": "Cloudflare",
                    "company": "Cloudflare",
                    "country": "US",
                    "category": "Hosting",
                    "requests": 9
                },
                {
                    "name": "Google Fonts",
                    "company": "Google",
                    "country": "US",
                    "category": "Hosting",
                    "requests": 1
                },
                {
                    "name": "jsDelivr",
                    "company": "jsDelivr",
                    "category": "Hosting",
                    "requests": 1
                }
            ]
        },
        "mixed_content": {
            "no_sri": [
                "https://static.cloudflare.com/beacon.min.js",
                "https://challenges.cloudflare.com/turnstile/v0/api.js",
                "https://cdn.jsdelivr.net/npm/clientjs@0.2.1/dist/client.min.js"
            ],
            "third_party_scripts": 3
        },
        "status": {
            "up": true,
            "code": 200,
            "timings": {
                "dns": 2,
                "tls": 31,
                "wait": 148,
                "connect": 9,
                "download": 12
            },
            "response_ms": 202
        },
        "tls_connection": {
            "alpn": "h2",
            "cipher": "TLS_AES_256_GCM_SHA384",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                80,
                443,
                8080
            ]
        },
        "carbon": {
            "bytes": 144862,
            "co2_grams": 0.0053,
            "cleaner_than": 14
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "162.159.44.4",
                    "host": "yadiel.ns.cloudflare.com"
                },
                {
                    "ip": "108.162.194.46",
                    "host": "izabella.ns.cloudflare.com"
                }
            ],
            "zone": "btcnivalis.shop"
        },
        "cookies": {
            "cookies": [
                {
                    "name": "entry_url",
                    "secure": true,
                    "same_site": "Lax"
                }
            ]
        },
        "location": {
            "ip": "2a06:98c1:3120::3",
            "asn": "13335",
            "org": "CloudFLARENET-EU",
            "city": "London",
            "country": "GB"
        },
        "ssl": {
            "issuer": "Google Trust Services / WE1",
            "subject": "btcnivalis.shop"
        },
        "dns": {
            "A": [
                "188.114.97.3",
                "188.114.96.3"
            ],
            "NS": [
                "yadiel.ns.cloudflare.com",
                "izabella.ns.cloudflare.com"
            ],
            "SOA": "{\"nsname\": \"izabella.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2418085373, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}",
            "AAAA": [
                "2a06:98c1:3121::3",
                "2a06:98c1:3120::3"
            ]
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "hsts": {
            "header": "max-age=15552000; includeSubDomains; preload",
            "message": "HSTS max-age is 15552000, below the 31536000 minimum."
        },
        "http_security": {
            "xFrameOptions": "SAMEORIGIN",
            "referrerPolicy": "strict-origin-when-cross-origin",
            "xXSSProtection": false,
            "permissionsPolicy": "camera=(), microphone=(), geolocation=()",
            "xContentTypeOptions": "nosniff",
            "contentSecurityPolicy": "default-src 'self'; frame-src https://challenges.cloudflare.com; style-src 'self' 'unsafe-inline' https://fonts.googleap",
            "strictTransportPolicy": "max-age=15552000; includeSubDomains; preload",
            "crossOriginOpenerPolicy": "same-origin",
            "crossOriginEmbedderPolicy": false,
            "crossOriginResourcePolicy": false
        },
        "firewall": {
            "waf": "Cloudflare",
            "has_waf": true
        },
        "get_ip": {
            "ip": "2a06:98c1:3120::3",
            "family": 6
        },
        "redirects": {
            "chain": [
                "https://btcnivalis.shop"
            ]
        },
        "linked_pages": {
            "internal_count": 43
        },
        "headers": {
            "headers": {
                "server": "cloudflare",
                "content-type": "text/html; charset=utf-8",
                "strict-transport-security": "max-age=15552000; includeSubDomains; preload",
                "content-security-policy": "default-src 'self'; frame-src https://challenges.cloudflare.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://cdnjs.cloudflare.com; img-src 'self' data: blob:; connect-src 'self' https://cloudflareinsights.com https://challenges.cloudflare.com; font-src 'self' https://fonts.",
                "x-frame-options": "SAMEORIGIN",
                "x-content-type-options": "nosniff",
                "referrer-policy": "strict-origin-when-cross-origin",
                "permissions-policy": "camera=(), microphone=(), geolocation=()",
                "cross-origin-opener-policy": "same-origin"
            }
        }
    }
}
```