# PhishDestroy domain threat record: btcrhomix82trade.com

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/btcrhomix82trade.com/
Machine-readable companion: https://phishdestroy.io/domain/btcrhomix82trade.com/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-23 17:19:39 UTC
- Last availability or vendor check: 2026-10-23 17:19:39 UTC
- Stored record updated: 2026-10-23 18:30:16 UTC
- VirusTotal detections in the stored snapshot: 16/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored infrastructure

- Observed IP address: 158.94.210.119
- Registrar in stored WHOIS data: Dynadot Inc
- Last stored HTTP status: 200
- Registration date in stored WHOIS data: 2026-03-20 09:13:14 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a169c4-a854-7085-ba28-ae54925f1c45/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/btcrhomix82trade.com
- Certificate Transparency search: https://crt.sh/?q=%25.btcrhomix82trade.com
- Web Archive lookup: https://web.archive.org/web/*/https://btcrhomix82trade.com/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
PhishDestroy added btcrhomix82trade.com to its internal blocklist on 2026-10-23 following a trusted intake rule that flagged the 217‑day‑old domain. The recorded page title advertises an AI platform for unified portfolio monitoring. An HTTP 200 response was observed on the same date. Google Safe Browsing showed no flag, while other security services reported risk.

How the scam works
The available signals point to a generic risk category where sites claim advanced crypto services to lure visitors into revealing credentials or downloading unwanted software. No concrete malicious behavior was captured on the page; the classification relies on aggregated detections rather than observed exploitation.

Evidence
VirusTotal scanned the domain on 2026-10-16 and returned 16 detections from 92 engines, including 12 malicious and 4 suspicious labels such as phishing. urlscan.io captured the site on 2026-10-23; its engine score was 94 with malicious tags, though the overall verdict was non‑malicious. Cloudflare Radar on 2026-10-23 marked the URL as malicious and phishing. OTX listed five pulses referencing the domain as of 2026-10-23. PhishDestroy’s internal list marks the domain as malicious, while external blocklists showed a single hit from Cloudflare Family.

Infrastructure
The recorded registration occurred on 2026-03-20 through Dynadot Inc. The recorded IP was 158.94.210.119, which was associated with Omegatech LTD in the Netherlands. TLS was provided by Let’s Encrypt, valid from 2026-08-31 to 2026-11-29. DNS records included an A record and two Dynadot name servers, and DNSSEC was not enabled. An open SSH port (22) was observed during scanning.

What to do
Visitors should avoid entering any crypto credentials or downloading files from this site; if credentials were entered, change passwords and monitor related accounts. Organizations should block the domain at network perimeters, review logs for connections to the recorded IP, and add the domain to internal threat feeds. No wallet‑specific remediation is required unless wallet data was actually exposed.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a169c4-a854-7085-ba28-ae54925f1c45/
Cloudflare Radar report: https://radar.cloudflare.com/scan/9f8f84d6-e651-40f2-b6cb-8e8645eeb0f3
URLQuery report: https://urlquery.net/report/d6294adb-f9db-4f52-b791-7955185ee140
Stored capture screenshot: https://urlscan.io/screenshots/01a169c4-a854-7085-ba28-ae54925f1c45.png
Cloudflare Radar screenshot (2026-10-23T17:53:23Z): https://screenshots.phishdestroy.io/cf/9f8f84d6-e651-40f2-b6cb-8e8645eeb0f3.png
URLQuery screenshot: https://screenshots.phishdestroy.io/uq/d6294adb-f9db-4f52-b791-7955185ee140.png
URLScan screenshot (2026-09-06T01:30:37Z): https://screenshots.phishdestroy.io/us/01a07456-a3ab-760c-bcb8-113c7ddc942c.png
URLScan capture report: https://urlscan.io/result/01a07456-a3ab-760c-bcb8-113c7ddc942c/
URLScan screenshot (2026-09-06T09:30:23Z): https://screenshots.phishdestroy.io/us/01a0760d-e53b-76b9-a16b-6ae3716f95b2.png
URLScan capture report: https://urlscan.io/result/01a0760d-e53b-76b9-a16b-6ae3716f95b2/
URLScan screenshot (2026-09-07T10:27:06Z): https://screenshots.phishdestroy.io/us/01a07b68-2d9e-76aa-b071-e3e738a58772.png
URLScan capture report: https://urlscan.io/result/01a07b68-2d9e-76aa-b071-e3e738a58772/
VirusTotal report: https://www.virustotal.com/gui/domain/btcrhomix82trade.com
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=btcrhomix82trade.com
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-23 18:25:34 UTC

## Stored page captures

- Primary capture: https://urlscan.io/screenshots/01a169c4-a854-7085-ba28-ae54925f1c45.png
  Captured: 2026-10-23 17:19:39 UTC
- URLScan capture: https://screenshots.phishdestroy.io/01a169c4-a854-7085-ba28-ae54925f1c45.png
  Captured: 2026-10-23 17:19:39 UTC
  Source report: https://urlscan.io/result/01a169c4-a854-7085-ba28-ae54925f1c45/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/9f8f84d6-e651-40f2-b6cb-8e8645eeb0f3.png
  Captured: 2026-10-23 17:53:23 UTC
  Source report: https://radar.cloudflare.com/scan/9f8f84d6-e651-40f2-b6cb-8e8645eeb0f3
  SHA-256: 4f755a74503ebde8da3854993dcbda147cea45b132340d2056d2294b6a13a329
- URLQuery: https://screenshots.phishdestroy.io/uq/d6294adb-f9db-4f52-b791-7955185ee140.png
  Source report: https://urlquery.net/report/d6294adb-f9db-4f52-b791-7955185ee140
  SHA-256: adc17669d97fd7d430ce275d38f1ec47bd5af92a5e1b440e79bd254fbf0d663d
- URLScan · 2026-09-06: https://screenshots.phishdestroy.io/us/01a07456-a3ab-760c-bcb8-113c7ddc942c.png
  Captured: 2026-09-06 01:30:37 UTC
  Source report: https://urlscan.io/result/01a07456-a3ab-760c-bcb8-113c7ddc942c/
  SHA-256: a819f7c28b0643e76aea056adf6b4606b75187a66d8fd1644e998e663071a878
- URLScan · 2026-09-06: https://screenshots.phishdestroy.io/us/01a0760d-e53b-76b9-a16b-6ae3716f95b2.png
  Captured: 2026-09-06 09:30:23 UTC
  Source report: https://urlscan.io/result/01a0760d-e53b-76b9-a16b-6ae3716f95b2/
  SHA-256: a819f7c28b0643e76aea056adf6b4606b75187a66d8fd1644e998e663071a878
- URLScan · 2026-09-07: https://screenshots.phishdestroy.io/us/01a07b68-2d9e-76aa-b071-e3e738a58772.png
  Captured: 2026-09-07 10:27:06 UTC
  Source report: https://urlscan.io/result/01a07b68-2d9e-76aa-b071-e3e738a58772/
  SHA-256: 0b17a4e2821f89d8ec5f718e40aea796287c20c9ea5c9ecf1491d83ae9440f80

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-23T17:54:39Z",
        "uuid": "01a169c4-a854-7085-ba28-ae54925f1c45",
        "scanned_at": "2026-10-23T17:17:45Z",
        "final_url": "https://btcrhomix82trade.com/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://btcrhomix82trade.com/",
                "from": "http://btcrhomix82trade.com/",
                "status": 307
            }
        ],
        "ip": "158.94.210.119",
        "ips": [
            "158.94.210.119"
        ],
        "asns": [
            "202412"
        ],
        "countries": [
            "NL"
        ],
        "doc_hash": "df9f1f3a9ec5a29e47d596b1cf734392e4e1c4268e5321f4babf542fe89d615a",
        "script_hashes": [
            "8aa5f8f647356dcd4fc5dbbe0efd5bc0e8da74026bc61e24636e2e1f5749b0ce"
        ],
        "globals": [
            "__dclq",
            "__dclOrig",
            "__dclFlush",
            "__smsCheckBeforeSubmit",
            "__isSmsEnabled",
            "__isSmsVerified",
            "intlTelInput"
        ],
        "cookies": [
            "connect.sid"
        ],
        "tls": {
            "san": [
                "btcrhomix82trade.com"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "YE2",
            "subject": "btcrhomix82trade.com",
            "protocol": "TLS 1.3",
            "valid_to": "2026-11-29T14:25:10Z",
            "valid_from": "2026-08-31T14:25:11Z"
        },
        "domain_age_days": 217,
        "apex_age_days": 217,
        "tls_age_days": 53,
        "tls_valid_days": 89,
        "requests": 7,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 94,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "content-type": "text/html; charset=utf-8",
            "x-content-type-options": "nosniff",
            "referrer-policy": "same-origin"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-23T17:54:41Z",
        "uuid": "9f8f84d6-e651-40f2-b6cb-8e8645eeb0f3",
        "scanned_at": "2026-10-23T17:53:23Z",
        "final_url": "https://btcrhomix82trade.com/",
        "status": 200,
        "history": [
            {
                "url": "https://btcrhomix82trade.com/",
                "status": 200
            }
        ],
        "dom_hash": "2f90d8511575cb4b55b07937a8a58114097ef4853fab0051cc4ed565c9c0159e",
        "doc_hash": "a2747b537ead0e1d03dbe26367241d3c9ad310a81556b2172f07b5a7585125a8",
        "phishing_v2": [
            "phishing"
        ],
        "url_risks": [
            "Scam"
        ],
        "domain_risks": [
            "Scam",
            "Security threats",
            "Malware",
            "CIPA Filter",
            "CIPA"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "btcrhomix82trade.com",
                "type": "A",
                "value": "158.94.210.119"
            }
        ],
        "dnssec_valid": false,
        "ip": "158.94.210.119",
        "verdict": {
            "tags": [
                "malware"
            ],
            "malicious": true,
            "categories": [
                "malware"
            ]
        },
        "whois": {
            "registrar": "Dynadot Inc",
            "created": "2026-03-20T10:13:14Z",
            "updated": "2026-08-13T12:33:35Z",
            "expires": "2027-03-20T10:13:14Z",
            "nameservers": [
                "ns1.dyna-ns.net",
                "ns2.dyna-ns.net"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-23T18:23:26Z",
        "analysis_at": "2026-10-16T11:39:25Z",
        "stats": {
            "timeout": 0,
            "harmless": 46,
            "malicious": 12,
            "suspicious": 4,
            "undetected": 30
        },
        "detections": {
            "CRDF": "malicious",
            "DNS8": "suspicious",
            "ESET": "suspicious",
            "VIPRE": "phishing",
            "G-Data": "phishing",
            "Lionic": "phishing",
            "Sophos": "phishing",
            "Fortinet": "spam",
            "Netcraft": "malicious",
            "SOCRadar": "phishing",
            "Kaspersky": "phishing",
            "Seclookup": "malicious",
            "Gridinsoft": "suspicious",
            "BitDefender": "phishing",
            "alphaMountain.ai": "phishing",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "tags": [
            "dga"
        ],
        "created": "2026-03-20T00:00:00Z",
        "updated": "2026-04-16T00:00:00Z",
        "first_seen": "2026-03-20T10:35:50Z",
        "dns": [
            {
                "ttl": 300,
                "type": "A",
                "value": "158.94.210.119"
            },
            {
                "ttl": 300,
                "type": "NS",
                "value": "ns2.dyna-ns.net"
            },
            {
                "ttl": 300,
                "type": "SOA",
                "rname": "hostmaster.btcrhomix82trade.com",
                "value": "ns1.dyna-ns.net"
            },
            {
                "ttl": 300,
                "type": "NS",
                "value": "ns1.dyna-ns.net"
            }
        ],
        "dns_at": "2026-10-16T11:44:43Z",
        "jarm": "40d40d40d00000000043d43d00043d6aff5ab0f4fc31897186312c9e639319",
        "cert": {
            "san": [
                "btcrhomix82trade.com"
            ],
            "issuer": "Let's Encrypt / YE2",
            "serial": "5bdb5236ba080c1e5b87933375f90c6b685",
            "sha256": "a81c6975609cc81040599e70f9f9d3a56b1fe81cb58f1f9aa38134ca42cb28c0",
            "subject": "btcrhomix82trade.com",
            "valid_to": "2026-11-29T14:25:10Z",
            "valid_from": "2026-08-31T14:25:11Z"
        },
        "whois": [],
        "rdap": {
            "status": [
                "transfer prohibited"
            ],
            "events": {
                "expiration": "2027-03-20T10:13:14Z",
                "last changed": "2026-08-31T13:41:32Z",
                "registration": "2026-03-20T10:13:14Z",
                "registrar expiration": "2027-03-20T10:13:14Z",
                "last update of RDAP database": "2026-10-16T06:54:21Z"
            },
            "registrar": "DYNADOT LLC",
            "registrar_iana_id": "472"
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-23T17:54:58Z",
        "mail_config": {
            "spf_lookups": 0
        },
        "caa_records": {
            "domain": "btcrhomix82trade.com"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_by": [
                "CloudFlare Family"
            ],
            "blocked_count": 1
        },
        "archives": {
            "last": "2026-10-23T17:20:43Z",
            "first": "2026-10-23T17:20:43Z",
            "changes": 0,
            "days_archived": 1,
            "avg_page_bytes": 22172
        },
        "robots_txt": {
            "agents": [
                "*"
            ],
            "present": true,
            "sitemaps": [
                "https://btcrhomix82trade.com/sitemap.xml"
            ]
        },
        "sitemap": {
            "present": true,
            "url_count": 5
        },
        "social_tags": {
            "title": "BTC-Rhomix 8.2 — Plateforme d'IA pour la surveillance unifiée du portefeuille",
            "robots": "index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1",
            "description": "BTC-Rhomix 8.2 offre une plate-forme d'IA unifiée qui connecte tous vos comptes d'échange dans un seul tableau de bord, appliquant une analyse prédictive pour faire apparaître les risques avant qu'ils n'affectent votre solde. Demandez une visite guidée aujourd'hui.",
            "canonicalUrl": "https://btcrhomix82trade.com/"
        },
        "trackers": {
            "requests": 30,
            "trackers": [
                {
                    "name": "Cloudflare",
                    "company": "Cloudflare",
                    "country": "US",
                    "category": "Hosting",
                    "requests": 1
                },
                {
                    "name": "jsDelivr",
                    "company": "jsDelivr",
                    "category": "Hosting",
                    "requests": 3
                }
            ]
        },
        "mixed_content": {
            "third_party_scripts": 0
        },
        "status": {
            "up": true,
            "code": 200,
            "timings": {
                "dns": 286,
                "tls": 81,
                "wait": 174,
                "connect": 71,
                "download": 176
            },
            "response_ms": 788
        },
        "tls_connection": {
            "alpn": "h2",
            "cipher": "TLS_AES_128_GCM_SHA256",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                22
            ]
        },
        "carbon": {
            "bytes": 75440,
            "co2_grams": 0.0028,
            "cleaner_than": 28
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "162.159.26.92",
                    "host": "ns1.dyna-ns.net"
                },
                {
                    "ip": "162.159.24.5",
                    "host": "ns2.dyna-ns.net"
                }
            ],
            "zone": "btcrhomix82trade.com"
        },
        "cookies": {
            "cookies": [
                {
                    "name": "cf-c",
                    "http_only": true,
                    "same_site": "Lax"
                },
                {
                    "name": "__cf_clicked"
                },
                {
                    "name": "ph_phc_t6w4wzJE2sbz4ro8LmZZTssm5go3KD6mP7QsqcDQRSp6_posthog",
                    "secure": true,
                    "same_site": "Lax"
                }
            ]
        },
        "location": {
            "ip": "158.94.210.119",
            "asn": "202412",
            "org": "Omegatech LTD",
            "city": "Amsterdam",
            "country": "NL"
        },
        "ssl": {
            "issuer": "Let's Encrypt / YE2",
            "subject": "btcrhomix82trade.com"
        },
        "dns": {
            "A": [
                "158.94.210.119"
            ],
            "NS": [
                "ns1.dyna-ns.net",
                "ns2.dyna-ns.net"
            ],
            "SOA": "{\"nsname\": \"ns1.dyna-ns.net\", \"hostmaster\": \"hostmaster.btcrhomix82trade.com\", \"serial\": 2026083101, \"refresh\": 16384, \"retry\": 2048, \"expire\": 1209600, \"minttl\": 300}"
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "hsts": {
            "message": "Site does not serve any HSTS headers."
        },
        "http_security": {
            "xFrameOptions": false,
            "referrerPolicy": "same-origin",
            "xXSSProtection": false,
            "permissionsPolicy": false,
            "xContentTypeOptions": "nosniff",
            "contentSecurityPolicy": false,
            "strictTransportPolicy": false,
            "crossOriginOpenerPolicy": false,
            "crossOriginEmbedderPolicy": false,
            "crossOriginResourcePolicy": false
        },
        "get_ip": {
            "ip": "158.94.210.119",
            "family": 4
        },
        "redirects": {
            "chain": [
                "https://btcrhomix82trade.com"
            ]
        },
        "linked_pages": {
            "internal_count": 9
        },
        "whois": {
            "registrar": "Dynadot Inc",
            "created": "2026-03-20T10:13:14Z",
            "updated": "2026-08-13T12:33:35Z",
            "expires": "2027-03-20T10:13:14Z",
            "status": [
                "clientTransferProhibited https://icann.org/epp"
            ],
            "nameservers": [
                "ns1.dyna-ns.net",
                "ns2.dyna-ns.net"
            ]
        },
        "headers": {
            "headers": {
                "content-type": "text/html; charset=utf-8",
                "x-content-type-options": "nosniff",
                "referrer-policy": "same-origin"
            }
        }
    }
}
```