# PhishDestroy domain threat record: btctraderai.pro Content language: English Canonical HTML report: https://phishdestroy.io/domain/btctraderai.pro/ Machine-readable companion: https://phishdestroy.io/domain/btctraderai.pro/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-10-23 17:03:57 UTC - Last availability or vendor check: 2026-10-23 17:54:09 UTC - Stored record updated: 2026-10-23 18:30:17 UTC - VirusTotal detections in the stored snapshot: 15/92 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: no stored flag ## Stored infrastructure - Observed IP address: 104.21.38.23 - Registrar in stored WHOIS data: NICENIC INTERNATIONAL GROUP CO., LIMITED - Last stored HTTP status: 200 - Registration date in stored WHOIS data: 2026-03-12 10:46:12 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a169e4-39d4-7080-a0e1-bb3b0eccc426/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/btctraderai.pro - Certificate Transparency search: https://crt.sh/?q=%25.btctraderai.pro - Web Archive lookup: https://web.archive.org/web/*/https://btctraderai.pro/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview PhishDestroy added btctraderai.pro to its internal blocklist on 2026-10-23 after a trusted intake rule flagged the site because it had been registered for 225 days. The recorded page title reads "BTC Trader AI | Premium AI-Powered Trading Overview". An HTTP 200 response was observed on the same date. How the scam works No specific malicious mechanism was observed on the page, but the combination of security detections suggests the domain could be used for phishing or fraudulent crypto‑related offers. Pages that advertise AI‑driven trading often lure users into depositing funds or revealing credentials, which is a common pattern for fake‑exchange scams. Evidence VirusTotal scanned the domain on 2026-10-17 and reported 15 detections from 92 engines, including classifications such as phishing, malicious, suspicious and spam by vendors like BitDefender, ESET and Forcepoint ThreatSeeker. Google Safe Browsing checked on 2026-10-23 and did not flag the site. urlscan.io captured a snapshot on 2026-07-28; its engine score was 98 (malicious) but the overall verdict was non‑malicious. Cloudflare Radar scanned on 2026-10-23 and labeled the domain malicious with a malware tag. PhishDestroy’s internal list marks the domain as blocked, while external blocklists showed no entries at the time of checking. Infrastructure The domain was registered on 2026-03-12 through NICENIC INTERNATIONAL GROUP CO., LIMITED, giving it an age of 225 days at first sighting. Hosting is provided via Cloudflare, with recorded IP addresses 172.67.218.9 and 104.21.38.23. The TLS certificate, issued by Google Trust Services, was valid from 2026-09-05 to 2026-12-04. What to do Visitors should avoid entering any login credentials, personal data or cryptocurrency details on this site; if such information was submitted, change passwords and monitor associated accounts. Defenders can block the exact domain at the network perimeter and add it to threat‑intel feeds, noting that PhishDestroy already lists it internally. Regularly review DNS logs for queries to btctraderai.pro and investigate any related traffic. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/019fa7b6-c543-7152-85b6-c9fbe4ea79c9/ Cloudflare Radar report: https://radar.cloudflare.com/scan/6950c9f7-2e46-4861-ab31-7d61f8237641 Stored capture screenshot: https://urlscan.io/screenshots/019fa7b6-c543-7152-85b6-c9fbe4ea79c9.png Cloudflare Radar screenshot (2026-10-23T17:06:05Z): https://screenshots.phishdestroy.io/cf/6950c9f7-2e46-4861-ab31-7d61f8237641.png URLScan screenshot (2026-07-27T10:45:33Z): https://screenshots.phishdestroy.io/us/019fa32d-eef6-7230-a9b5-29daaf14dcba.png URLScan capture report: https://urlscan.io/result/019fa32d-eef6-7230-a9b5-29daaf14dcba/ VirusTotal report: https://www.virustotal.com/gui/domain/btctraderai.pro Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=btctraderai.pro Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-23 17:08:41 UTC ## Stored page captures - Primary capture: https://urlscan.io/screenshots/01a169e4-39d4-7080-a0e1-bb3b0eccc426.png Captured: 2026-10-23 17:54:09 UTC - URLScan capture: https://screenshots.phishdestroy.io/019fa7b6-c543-7152-85b6-c9fbe4ea79c9.png Captured: 2026-10-23 17:03:57 UTC Source report: https://urlscan.io/result/01a169e4-39d4-7080-a0e1-bb3b0eccc426/ - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/6950c9f7-2e46-4861-ab31-7d61f8237641.png Captured: 2026-10-23 17:06:05 UTC Source report: https://radar.cloudflare.com/scan/6950c9f7-2e46-4861-ab31-7d61f8237641 SHA-256: 06e5c15918ccc0befa5f6692ced12a076c1dec381141bf90a3b0a575c7008360 - URLQuery: https://screenshots.phishdestroy.io/uq/5904e014-a74c-44ab-abb3-acce4eb748b4.png Source report: https://urlquery.net/report/5904e014-a74c-44ab-abb3-acce4eb748b4 SHA-256: 1058adb5181eb4069be47ec0dda016a9c900cea1e4db0b5a765e23c7c7e807c6 - URLScan · 2026-07-27: https://screenshots.phishdestroy.io/us/019fa32d-eef6-7230-a9b5-29daaf14dcba.png Captured: 2026-07-27 10:45:33 UTC Source report: https://urlscan.io/result/019fa32d-eef6-7230-a9b5-29daaf14dcba/ SHA-256: 90967f9336dde7fe9abcbc9f793e574a9414a2025a86663dbce0bf7622b00fdd - URLScan · 2026-07-28: https://screenshots.phishdestroy.io/us/019fa7b6-c543-7152-85b6-c9fbe4ea79c9.png Captured: 2026-07-28 07:53:29 UTC Source report: https://urlscan.io/result/019fa7b6-c543-7152-85b6-c9fbe4ea79c9/ SHA-256: 90967f9336dde7fe9abcbc9f793e574a9414a2025a86663dbce0bf7622b00fdd - URLScan · 2026-10-23: https://screenshots.phishdestroy.io/us/01a169ca-4635-7223-a36e-d58a8c9bcc6d.png Captured: 2026-10-23 17:23:59 UTC Source report: https://urlscan.io/result/01a169ca-4635-7223-a36e-d58a8c9bcc6d/ SHA-256: da51119c27393ddd0fb399988e97ab730c816e6be2b63336e4549e132367f948 - URLScan · 2026-10-23: https://screenshots.phishdestroy.io/us/01a169cf-06e4-734e-b58e-5ffec46b9be6.png Captured: 2026-10-23 17:30:46 UTC Source report: https://urlscan.io/result/01a169cf-06e4-734e-b58e-5ffec46b9be6/ SHA-256: ad3a5fa4f6c1c0984f47d00493526abe84eb47cec7fbaf7289f98df92791309f - URLScan · 2026-10-23: https://screenshots.phishdestroy.io/us/01a169d4-c0f0-7471-b04d-c8d9be9dc616.png Captured: 2026-10-23 17:35:24 UTC Source report: https://urlscan.io/result/01a169d4-c0f0-7471-b04d-c8d9be9dc616/ SHA-256: 3e4de037a437b316c0386ec155c38268a5db8187c6a99aabc0b26be27a10f064 ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-23T18:04:09Z", "uuid": "01a169e4-39d4-7080-a0e1-bb3b0eccc426", "scanned_at": "2026-10-23T17:52:22Z", "final_url": "https://btctraderai.pro/", "status": 200, "redirected": "https-only", "redirects": [ { "to": "https://btctraderai.pro/", "from": "http://btctraderai.pro/", "status": 307 } ], "ip": "104.21.38.23", "domains": [ "cdnjs.cloudflare.com", "challenges.cloudflare.com", "cdn.jsdelivr.net", "fonts.googleapis.com", "static.cloudflareinsights.com", "static.cloudflare.com" ], "ips": [ "104.18.94.41", "104.18.95.41", "151.101.65.229", "142.250.195.138", "104.17.24.14", "104.21.38.23" ], "asns": [ "13335", "54113", "15169" ], "countries": [ "US" ], "doc_hash": "da0b7156f88beff0d1f80f07024d1748da5839c3fbff63d30738656d7691464a", "script_hashes": [ "ccf00d1923b0131a10e0c6d26f95e5dee6ebf8621a27e83c5a2f68a2e0093142" ], "globals": [ "LANG_MSGS", "ClientJS", "_y4jvq", "toggleTermsPopup", "__tsGet", "__tsNeedsClick", "__tsShow", "__tsReset", "__lgBS", "__cfQR", "turnstile", "__cfRLUnblockHandlers", "__lgT0" ], "cookies": [ "entry_url" ], "tls": { "san": [ "btctraderai.pro" ], "cipher": "AES_128_GCM", "issuer": "WE1", "subject": "btctraderai.pro", "protocol": "QUIC", "valid_to": "2026-12-04T23:00:49Z", "valid_from": "2026-09-05T22:00:55Z" }, "domain_age_days": 225, "apex_age_days": 225, "tls_age_days": 47, "tls_valid_days": 90, "requests": 23, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 97, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "cloudflare", "content-type": "text/html; charset=utf-8", "strict-transport-security": "max-age=31536000; includeSubDomains; preload", "content-security-policy": "font-src 'self' https://fonts.gstatic.com https://cdnjs.cloudflare.com; default-src 'self'; img-src 'self' data: blob:; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://cdnjs.clou", "x-frame-options": "SAMEORIGIN", "x-content-type-options": "nosniff", "referrer-policy": "strict-origin-when-cross-origin", "permissions-policy": "camera=(), microphone=(), geolocation=()", "cross-origin-opener-policy": "same-origin" } }, "cf": { "v": 1, "fetched_at": "2026-10-23T17:08:03Z", "uuid": "6950c9f7-2e46-4861-ab31-7d61f8237641", "scanned_at": "2026-10-23T17:06:05Z", "final_url": "https://btctraderai.pro/", "status": 200, "history": [ { "url": "https://btctraderai.pro/", "status": 200 } ], "dom_hash": "27993990b46111203e076c85eb54b6398f77acd7d5b10188b3f2510cd54e1a19", "doc_hash": "eedc1860d19ad5337f49657c20769df718c344643e2951789fed07ca4b17e2d8", "phishing_v2": [ "phishing" ], "domain_risks": [ "Malware", "Security threats", "CIPA Filter", "CIPA" ], "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "btctraderai.pro", "type": "A", "value": "104.21.38.23" }, { "name": "btctraderai.pro", "type": "A", "value": "172.67.218.9" }, { "name": "btctraderai.pro", "type": "AAAA", "value": "2606:4700:3036::6815:2617" }, { "name": "btctraderai.pro", "type": "AAAA", "value": "2606:4700:3033::ac43:da09" } ], "dnssec_valid": false, "ip": "104.21.38.23", "verdict": { "tags": [ "malware" ], "malicious": true, "categories": [ "malware" ] }, "whois": { "registrar": "NICENIC INTERNATIONAL GROUP CO., LIMITED", "created": "2026-03-12T11:46:12Z", "updated": "2026-08-11T23:03:39Z", "expires": "2027-03-12T11:46:12Z", "nameservers": [ "maria.ns.cloudflare.com", "dilbert.ns.cloudflare.com" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-23T17:04:54Z", "analysis_at": "2026-10-17T11:46:21Z", "stats": { "timeout": 0, "harmless": 44, "malicious": 10, "suspicious": 5, "undetected": 33 }, "detections": { "CRDF": "malicious", "DNS8": "suspicious", "ESET": "suspicious", "VIPRE": "phishing", "G-Data": "phishing", "Lionic": "phishing", "Sophos": "phishing", "Fortinet": "spam", "SOCRadar": "phishing", "Kaspersky": "phishing", "Seclookup": "malicious", "Gridinsoft": "suspicious", "BitDefender": "phishing", "alphaMountain.ai": "spam", "Forcepoint ThreatSeeker": "phishing" }, "reputation": 0, "created": "2026-03-11T00:00:00Z", "updated": "2026-03-11T00:00:00Z", "first_seen": "2026-03-12T15:36:28Z", "dns": [ { "ttl": 300, "type": "AAAA", "value": "2606:4700:3036::6815:2617" }, { "ttl": 300, "type": "A", "value": "104.21.38.23" }, { "ttl": 300, "type": "TXT", "value": "v=spf1 ip4:46.166.131.92 ~all" }, { "ttl": 300, "type": "A", "value": "172.67.218.9" }, { "ttl": 300, "type": "AAAA", "value": "2606:4700:3033::ac43:da09" }, { "ttl": 300, "type": "MX", "value": "mail.btctraderai.pro", "priority": 10 }, { "ttl": 1800, "type": "SOA", "rname": "dns.cloudflare.com", "value": "dilbert.ns.cloudflare.com" }, { "ttl": 21600, "type": "NS", "value": "maria.ns.cloudflare.com" }, { "ttl": 21600, "type": "NS", "value": "dilbert.ns.cloudflare.com" }, { "ttl": 300, "type": "TXT", "value": "google-site-verification=i2UWdJ3WA2vda238zkIMc2N9TXPziE_YuBgribE8jKk" } ], "dns_at": "2026-10-17T11:51:39Z", "jarm": "27d40d40d00040d00042d43d00041df04c41293ba84f6efe3a613b22f983e6", "cert": { "san": [ "btctraderai.pro" ], "issuer": "Google Trust Services / WE1", "serial": "e61ae08cbd1eb2ce1360bbdb2dcbf458", "sha256": "7815bba7437cbd3b8e8a36a10c889fccaa66e040d30c74456e5a9343a750ba3f", "subject": "btctraderai.pro", "valid_to": "2026-12-04T23:00:49Z", "valid_from": "2026-09-05T22:00:55Z" }, "whois": [], "rdap": { "status": [ "client delete prohibited", "client transfer prohibited" ], "events": { "expiration": "2027-03-11T16:00:00Z", "registration": "2026-03-11T16:00:00Z", "registrar expiration": "2027-03-11T16:00:00Z", "last update of RDAP database": "2026-03-11T16:00:00Z" }, "registrar": "NICENIC INTERNATIONAL GROUP CO., LIMITED", "registrar_iana_id": "3765" } }, "webcheck": { "v": 1, "fetched_at": "2026-10-23T17:06:26Z", "mail_config": { "mx": [ "mail.btctraderai.pro" ], "spf": "v=spf1 ip4:46.166.131.92 ~all", "spf_lookups": 0 }, "caa_records": { "domain": "btctraderai.pro" }, "block_lists": { "resolvers": 12, "blocked_by": [ "CloudFlare Family" ], "blocked_count": 1 }, "archives": { "last": "2026-10-17T16:57:09Z", "first": "2026-10-17T16:57:09Z", "changes": 0, "days_archived": 1, "avg_page_bytes": 41206 }, "robots_txt": { "agents": [ "*" ], "present": true, "sitemaps": [ "https://btctraderai.pro/sitemap.xml" ] }, "sitemap": { "present": true, "url_count": 175 }, "social_tags": { "ogUrl": "https://btctraderai.pro/", "title": "BTC Trader AI | Premium AI-Powered Trading Overview", "ogType": "website", "robots": "index, follow", "ogTitle": "BTC Trader AI | Premium AI-Powered Trading Overview", "ogSiteName": "BTC Trader AI", "themeColor": "#111111", "description": "BTC Trader AI delivers a premium overview of AI-driven automated trading agents, execution workflows, risk controls, and enterprise-grade features for modern markets.", "twitterCard": "summary", "canonicalUrl": "https://btctraderai.pro/", "ogDescription": "BTC Trader AI delivers a premium overview of AI-driven automated trading agents, execution workflows, risk controls, and enterprise-ready features for modern markets." }, "trackers": { "requests": 18, "trackers": [ { "name": "Cloudflare", "company": "Cloudflare", "country": "US", "category": "Hosting", "requests": 8 }, { "name": "Google Fonts", "company": "Google", "country": "US", "category": "Hosting", "requests": 1 }, { "name": "jsDelivr", "company": "jsDelivr", "category": "Hosting", "requests": 1 } ] }, "mixed_content": { "no_sri": [ "https://static.cloudflare.com/beacon.min.js", "https://challenges.cloudflare.com/turnstile/v0/api.js", "https://cdn.jsdelivr.net/npm/clientjs@0.2.1/dist/client.min.js" ], "third_party_scripts": 3 }, "status": { "up": true, "code": 200, "timings": { "dns": 12, "tls": 33, "wait": 121, "connect": 7, "download": 17 }, "response_ms": 190 }, "tls_connection": { "alpn": "h2", "cipher": "TLS_AES_256_GCM_SHA384", "protocol": "TLSv1.3", "versions": [ "TLSv1.2", "TLSv1.3" ], "authorized": true, "forward_secrecy": true }, "ports": { "open": [ 80, 443, 8080 ] }, "carbon": { "bytes": 142495, "co2_grams": 0.0052, "cleaner_than": 14 }, "dns_server": { "ns": [ { "ip": "108.162.192.192", "host": "maria.ns.cloudflare.com" }, { "ip": "108.162.193.155", "host": "dilbert.ns.cloudflare.com" } ], "zone": "btctraderai.pro" }, "cookies": { "cookies": [ { "name": "entry_url", "secure": true, "same_site": "Lax" } ] }, "location": { "ip": "2606:4700:3036::6815:2617", "asn": "13335", "org": "Cloudflare, Inc.", "city": "Toronto", "country": "CA" }, "ssl": { "issuer": "Google Trust Services / WE1", "subject": "btctraderai.pro" }, "dns": { "A": [ "104.21.38.23", "172.67.218.9" ], "MX": [ "{\"exchange\": \"mail.btctraderai.pro\", \"priority\": 10}" ], "NS": [ "dilbert.ns.cloudflare.com", "maria.ns.cloudflare.com" ], "SOA": "{\"nsname\": \"dilbert.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2418083840, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}", "TXT": [ "v=spf1 ip4:46.166.131.92 ~all", "google-site-verification=i2UWdJ3WA2vda238zkIMc2N9TXPziE_YuBgribE8jKk" ], "AAAA": [ "2606:4700:3036::6815:2617", "2606:4700:3033::ac43:da09" ] }, "dnssec": { "ds": false, "rrsig": false, "dnskey": false }, "hsts": { "header": "max-age=31536000; includeSubDomains; preload", "message": "Site is compatible with the HSTS preload list!", "compatible": true }, "http_security": { "xFrameOptions": "SAMEORIGIN", "referrerPolicy": "strict-origin-when-cross-origin", "xXSSProtection": false, "permissionsPolicy": "camera=(), microphone=(), geolocation=()", "xContentTypeOptions": "nosniff", "contentSecurityPolicy": "font-src 'self' https://fonts.gstatic.com https://cdnjs.cloudflare.com; default-src 'self'; img-src 'self' data: blob:;", "strictTransportPolicy": "max-age=31536000; includeSubDomains; preload", "crossOriginOpenerPolicy": "same-origin", "crossOriginEmbedderPolicy": false, "crossOriginResourcePolicy": false }, "firewall": { "waf": "Cloudflare", "has_waf": true }, "get_ip": { "ip": "2606:4700:3033::ac43:da09", "family": 6 }, "redirects": { "chain": [ "https://btctraderai.pro" ] }, "linked_pages": { "internal_count": 46 }, "headers": { "headers": { "server": "cloudflare", "content-type": "text/html; charset=utf-8", "strict-transport-security": "max-age=31536000; includeSubDomains; preload", "content-security-policy": "font-src 'self' https://fonts.gstatic.com https://cdnjs.cloudflare.com; default-src 'self'; img-src 'self' data: blob:; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://cdnjs.cloudflare.com; connect-src 'self' https://cloudflareinsights.com https://challenges.cloudflare.com; scr", "x-frame-options": "SAMEORIGIN", "x-content-type-options": "nosniff", "referrer-policy": "strict-origin-when-cross-origin", "permissions-policy": "camera=(), microphone=(), geolocation=()", "cross-origin-opener-policy": "same-origin" } } } } ```