# PhishDestroy domain threat record: btcvantix94.net

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/btcvantix94.net/
Machine-readable companion: https://phishdestroy.io/domain/btcvantix94.net/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-26 20:03:50 UTC
- Last availability or vendor check: 2026-10-26 20:03:50 UTC
- Stored record updated: 2026-10-26 21:00:11 UTC
- VirusTotal detections in the stored snapshot: 3/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: sui

## Stored infrastructure

- Observed IP address: 158.94.210.119
- Registrar in stored WHOIS data: Dynadot Inc
- Last stored HTTP status: 200
- Registration date in stored WHOIS data: 2026-10-19 03:20:47 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a179ce-e634-704b-8a04-94d9884f061c/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/btcvantix94.net
- Certificate Transparency search: https://crt.sh/?q=%25.btcvantix94.net
- Web Archive lookup: https://web.archive.org/web/*/https://btcvantix94.net/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
The captured screenshot from 2026-10-26 shows an Italian-language landing page for BTC Vantix 9.4, headlined L'intelligenza artificiale per le tue decisioni finanziarie. Zero commissioni, with a blue Inizia ora gratuitamente call-to-action button. PhishDestroy listed btcvantix94.net after automatic intake on 2026-10-26, the first-seen date, seven days after the domain was registered on 2026-10-19.

How the scam works
The page presented real-time data analysis, predictive models, 24/7 risk monitoring and the promise Tieni il 100% dei tuoi profitti, closing with Zero commissioni. 100% Risultati. As observed on 2026-10-26, this free-start funnel steers visitors toward signing up and funding an account under the lure of guaranteed, commission-free AI trading returns, a category risk typical of fraudulent investment schemes.

Evidence
The screenshot shows the AI decision-making headline, free-start button and the bullet claims Analisi predittiva costante, Monitoraggio rischio 24/7 and Setup immediato. On 2026-10-26 VirusTotal flagged the domain as malicious, with Netcraft labelling it malicious, while Google Safe Browsing was not flagged on the same date. OTX recorded 0 pulses and PhishDestroy's internal blocklist flagged it while no external blocklists listed it, both checked 2026-10-26; the page fetch that day returned a response with no cross-site redirect. No urlscan, Spamhaus, script-hash or framework data was collected, so those checks remain unverified rather than cleared.

Infrastructure
Registered 2026-10-19 through Dynadot Inc, with hosting at one recorded address and no WAF or CDN named in the collected data. No TLS details, HTTP security-header results, email authentication, CAA records or DNSSEC data were gathered, so those postures are unknown; an absent check is not evidence of safety.

What to do
If you entered credentials or financial details through btcvantix94.net, change your password on the genuine service you used, enable 2FA, and alert your bank about any transfers or deposits initiated from the page. Defenders should block btcvantix94.net and hunt for sibling domains registered through the same registrar within the days around 2026-10-19.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a179ce-e634-704b-8a04-94d9884f061c/
Stored capture screenshot: https://i.ibb.co/jkwxwW1V/ae97d4536825.png
VirusTotal report: https://www.virustotal.com/gui/domain/btcvantix94.net
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=btcvantix94.net
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-26 20:10:46 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/jkwxwW1V/ae97d4536825.png
  Captured: 2026-10-26 20:03:50 UTC
- URLScan capture 1: https://screenshots.phishdestroy.io/01a179ce-e634-704b-8a04-94d9884f061c.png
  Captured: 2026-10-26 20:03:50 UTC
  Source report: https://urlscan.io/result/01a179ce-e634-704b-8a04-94d9884f061c/
- URLScan · 2026-10-26: https://screenshots.phishdestroy.io/us/01a179d0-f6cf-74cc-9aa0-2badaddac61f.png
  Captured: 2026-10-26 20:05:10 UTC
  Source report: https://urlscan.io/result/01a179d0-f6cf-74cc-9aa0-2badaddac61f/
  SHA-256: 344984169d3cbd7cc6e92b6f03cc96532ff80cecd6d2b623133a81beeb0aa971
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/9c7b54b8-0aaa-4cc3-aecb-11674993ea17.png
  Captured: 2026-10-26 20:34:27 UTC
  Source report: https://radar.cloudflare.com/scan/9c7b54b8-0aaa-4cc3-aecb-11674993ea17
  SHA-256: 2d01fcfbddb7bb7de62904732e0b5c23d2e47c5cdb6a63650f8f761cbe1fbf8c

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-26T20:19:21Z",
        "uuid": "01a179ce-e634-704b-8a04-94d9884f061c",
        "scanned_at": "2026-10-26T20:02:55Z",
        "final_url": "https://btcvantix94.net/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://btcvantix94.net/",
                "from": "http://btcvantix94.net/",
                "status": 307
            },
            {
                "to": "http://btcvantix94.net/",
                "from": "https://btcvantix94.net/",
                "status": 307
            },
            {
                "to": "https://btcvantix94.net/",
                "from": "http://btcvantix94.net/",
                "status": 301
            }
        ],
        "ip": "158.94.210.119",
        "ips": [
            "158.94.210.119"
        ],
        "asns": [
            "202412"
        ],
        "countries": [
            "NL"
        ],
        "doc_hash": "69c809574b4a5274f85471579983474467fd9b94a3bd68f0abfe7b6dd63a7734",
        "script_hashes": [
            "8aa5f8f647356dcd4fc5dbbe0efd5bc0e8da74026bc61e24636e2e1f5749b0ce"
        ],
        "globals": [
            "__dclq",
            "__dclOrig",
            "__dclFlush",
            "__smsCheckBeforeSubmit",
            "__isSmsEnabled",
            "__isSmsVerified",
            "intlTelInput"
        ],
        "cookies": [
            "connect.sid"
        ],
        "tls": {
            "san": [
                "*.btcvantix94.net",
                "btcvantix94.net"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "YE2",
            "subject": "btcvantix94.net",
            "protocol": "TLS 1.3",
            "valid_to": "2027-01-23T02:32:25Z",
            "valid_from": "2026-10-25T02:32:26Z"
        },
        "domain_age_days": 5,
        "apex_age_days": 5,
        "tls_age_days": 1,
        "tls_valid_days": 89,
        "requests": 8,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 98,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "content-type": "text/html; charset=utf-8",
            "x-content-type-options": "nosniff",
            "referrer-policy": "same-origin"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-26T21:23:44Z",
        "uuid": "9c7b54b8-0aaa-4cc3-aecb-11674993ea17",
        "scanned_at": "2026-10-26T20:34:27Z",
        "final_url": "https://btcvantix94.net/",
        "status": 200,
        "history": [
            {
                "url": "https://btcvantix94.net/",
                "status": 200
            }
        ],
        "dom_hash": "1af06ccef5ebcb2dd1e682b64285522ee7b3a8eca6e4421f36b130d90a3ac64b",
        "doc_hash": "948ea9af9d5c857c0a34c6d262adb71bafe91a6e9439c387fb9eda345b910e9c",
        "url_risks": [
            "Scam"
        ],
        "domain_risks": [
            "Scam",
            "Security threats",
            "Newly Seen Domains",
            "Security Risks",
            "New Domains",
            "CIPA Filter",
            "CIPA"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "btcvantix94.net",
                "type": "A",
                "value": "158.94.210.119"
            }
        ],
        "dnssec_valid": false,
        "ip": "158.94.210.119",
        "whois": {
            "registrar": "Dynadot Inc",
            "created": "2026-10-19T05:20:47Z",
            "updated": "2026-10-19T05:20:59Z",
            "expires": "2027-10-19T05:20:47Z",
            "nameservers": [
                "jose.ns.cloudflare.com",
                "lilyana.ns.cloudflare.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-26T20:34:17Z",
        "analysis_at": "2026-10-26T11:57:16Z",
        "stats": {
            "timeout": 0,
            "harmless": 54,
            "malicious": 1,
            "suspicious": 2,
            "undetected": 35
        },
        "detections": {
            "Netcraft": "malicious",
            "Gridinsoft": "suspicious",
            "alphaMountain.ai": "spam"
        },
        "reputation": 0,
        "tags": [
            "dga"
        ],
        "categories": {
            "Sophos": "spam urls",
            "alphaMountain.ai": "Spam, Suspicious (alphaMountain.ai)",
            "Forcepoint ThreatSeeker": "newly registered websites"
        },
        "registrar": "Dynadot Inc",
        "created": "2026-10-19T05:20:47Z",
        "expires": "2027-10-19T05:20:47Z",
        "updated": "2026-10-19T05:20:59Z",
        "first_seen": "2026-10-19T05:29:28Z",
        "dns": [
            {
                "ttl": 300,
                "type": "NS",
                "value": "ns1.dyna-ns.net"
            },
            {
                "ttl": 300,
                "type": "SOA",
                "rname": "hostmaster.btcvantix94.net",
                "value": "ns1.dyna-ns.net"
            },
            {
                "ttl": 300,
                "type": "NS",
                "value": "ns2.dyna-ns.net"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "158.94.210.119"
            }
        ],
        "dns_at": "2026-10-26T12:37:03Z",
        "jarm": "40d40d40d00000000043d43d00043d6aff5ab0f4fc31897186312c9e639319",
        "cert": {
            "san": [
                "*.btcvantix94.net",
                "btcvantix94.net"
            ],
            "issuer": "Let's Encrypt / YE2",
            "serial": "69ff6f00fa1b32b901e6cb5b8c3220cd21e",
            "sha256": "3af6a01015bc2a3864e956c4606db84dccc65259c48027960af68f7fe541f04f",
            "subject": "btcvantix94.net",
            "valid_to": "2027-01-23T02:32:25Z",
            "valid_from": "2026-10-25T02:32:26Z"
        },
        "whois": {
            "registrar": "Dynadot Inc",
            "registrar_iana_id": "472",
            "registrar_url": "http://www.dynadot.com",
            "created": "2026-10-19T05:20:47Z",
            "updated": "2026-10-19T05:20:59Z",
            "expires": "2027-10-19T05:20:47Z",
            "status": [
                "clientTransferProhibited"
            ],
            "nameservers": [
                "jose.ns.cloudflare.com",
                "lilyana.ns.cloudflare.com"
            ],
            "dnssec": "unsigned"
        },
        "rdap": {
            "status": [
                "transfer prohibited"
            ],
            "events": {
                "expiration": "2027-10-19T05:20:47Z",
                "last changed": "2026-10-25T03:31:05Z",
                "registration": "2026-10-19T05:20:47Z",
                "registrar expiration": "2027-10-19T05:20:47Z",
                "last update of RDAP database": "2026-10-25T03:38:34Z"
            }
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-26T20:37:07Z",
        "mail_config": {
            "spf_lookups": 0
        },
        "caa_records": {
            "domain": "btcvantix94.net"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_count": 0
        },
        "archives": {
            "last": "2026-10-26T20:05:07Z",
            "first": "2026-10-26T20:05:07Z",
            "changes": 0,
            "days_archived": 1,
            "avg_page_bytes": 19939
        },
        "robots_txt": {
            "agents": [
                "*"
            ],
            "present": true,
            "sitemaps": [
                "https://btcvantix94.net/sitemap.xml"
            ]
        },
        "sitemap": {
            "present": true,
            "url_count": 5
        },
        "social_tags": {
            "title": "BTC Vantix 9.4 — Piattaforma AI per decisioni finanziarie",
            "robots": "index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1",
            "description": "Scopri con BTC Vantix 9.4 una piattaforma AI con analisi predittiva in tempo reale e zero commissioni. Tieni il 100% dei tuoi profitti con dati verificabili e segnali chiari.",
            "canonicalUrl": "https://btcvantix94.net/"
        },
        "trackers": {
            "requests": 50,
            "trackers": [
                {
                    "name": "Cloudflare",
                    "company": "Cloudflare",
                    "country": "US",
                    "category": "Hosting",
                    "requests": 1
                },
                {
                    "name": "jsDelivr",
                    "company": "jsDelivr",
                    "category": "Hosting",
                    "requests": 3
                }
            ]
        },
        "mixed_content": {
            "third_party_scripts": 0
        },
        "status": {
            "up": true,
            "code": 200,
            "timings": {
                "dns": 305,
                "tls": 98,
                "wait": 116,
                "connect": 75,
                "download": 149
            },
            "response_ms": 743
        },
        "tls_connection": {
            "alpn": "h2",
            "cipher": "TLS_AES_128_GCM_SHA256",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                22,
                80,
                443
            ]
        },
        "carbon": {
            "bytes": 68901,
            "co2_grams": 0.0025,
            "cleaner_than": 30
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "162.159.25.5",
                    "host": "ns2.dyna-ns.net"
                },
                {
                    "ip": "162.159.27.158",
                    "host": "ns1.dyna-ns.net"
                }
            ],
            "zone": "btcvantix94.net"
        },
        "cookies": {
            "cookies": [
                {
                    "name": "cf-c",
                    "http_only": true,
                    "same_site": "Lax"
                },
                {
                    "name": "__cf_clicked"
                },
                {
                    "name": "ph_phc_t6w4wzJE2sbz4ro8LmZZTssm5go3KD6mP7QsqcDQRSp6_posthog",
                    "secure": true,
                    "same_site": "Lax"
                }
            ]
        },
        "location": {
            "ip": "158.94.210.119",
            "asn": "202412",
            "org": "Omegatech LTD",
            "city": "Amsterdam",
            "country": "NL"
        },
        "ssl": {
            "issuer": "Let's Encrypt / YE2",
            "subject": "btcvantix94.net"
        },
        "dns": {
            "A": [
                "158.94.210.119"
            ],
            "NS": [
                "ns1.dyna-ns.net",
                "ns2.dyna-ns.net"
            ],
            "SOA": "{\"nsname\": \"ns1.dyna-ns.net\", \"hostmaster\": \"hostmaster.btcvantix94.net\", \"serial\": 2026102403, \"refresh\": 16384, \"retry\": 2048, \"expire\": 1209600, \"minttl\": 300}"
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "hsts": {
            "message": "Site does not serve any HSTS headers."
        },
        "http_security": {
            "xFrameOptions": false,
            "referrerPolicy": "same-origin",
            "xXSSProtection": false,
            "permissionsPolicy": false,
            "xContentTypeOptions": "nosniff",
            "contentSecurityPolicy": false,
            "strictTransportPolicy": false,
            "crossOriginOpenerPolicy": false,
            "crossOriginEmbedderPolicy": false,
            "crossOriginResourcePolicy": false
        },
        "get_ip": {
            "ip": "158.94.210.119",
            "family": 4
        },
        "redirects": {
            "chain": [
                "https://btcvantix94.net"
            ]
        },
        "tech_stack": {
            "technologies": [
                "Node.js",
                "Express",
                "lit-html",
                "lit-element",
                "HTTP/3"
            ]
        },
        "linked_pages": {
            "internal_count": 9
        },
        "whois": {
            "registrar": "Dynadot Inc",
            "created": "2026-10-19T05:20:47Z",
            "updated": "2026-10-25T03:18:30Z",
            "expires": "2027-10-19T05:20:47Z",
            "status": [
                "clientTransferProhibited https://icann.org/epp"
            ],
            "nameservers": [
                "ns1.dyna-ns.net",
                "ns2.dyna-ns.net"
            ]
        },
        "headers": {
            "headers": {
                "content-type": "text/html; charset=utf-8",
                "x-content-type-options": "nosniff",
                "referrer-policy": "same-origin"
            }
        }
    }
}
```