# PhishDestroy domain threat record: btcvexilly92.shop

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/btcvexilly92.shop/
Machine-readable companion: https://phishdestroy.io/domain/btcvexilly92.shop/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-23 17:27:36 UTC
- Last availability or vendor check: 2026-10-23 23:14:36 UTC
- Stored record updated: 2026-10-24 06:20:56 UTC
- VirusTotal detections in the stored snapshot: 2/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: flagged

## Stored classification

- Targeted brand: ups

## Stored infrastructure

- Observed IP address: 188.114.97.3
- Registrar in stored WHOIS data: Dynadot Inc.
- Last stored HTTP status: 200
- Registration date in stored WHOIS data: 2026-04-04 22:00:00 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a169cb-efcc-74df-9cbf-bfcaeaf9cbac/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/btcvexilly92.shop
- Certificate Transparency search: https://crt.sh/?q=%25.btcvexilly92.shop
- Web Archive lookup: https://web.archive.org/web/*/https://btcvexilly92.shop/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
PhishDestroy added btcvexilly92.shop to its internal blocklist on 2026-10-23 because the intake system flagged it for a social‑engineering risk. The recorded page title claims the site is an "AI Trading Platform" and an HTTP 200 response was observed on the same date.

How the scam works
The available detections indicate the domain could be used for phishing or other social‑engineering attacks, typically by presenting a fake service to lure users into revealing credentials or authorising transactions. No concrete malicious behavior was observed on the page itself; the assessment is based on external threat indicators rather than observed exploitation.

Evidence
Google Safe Browsing flagged the domain for social engineering on 2026-10-23. VirusTotal recorded 2 malicious detections out of 92 engines on 2026-10-22, with alphaMountain.ai and SOCRadar labeling it as phishing. urlscan.io’s engine gave the URL a malicious score of 99 on 2026-10-23, though its overall verdict was non‑malicious. Cloudflare Radar identified phishing and malware categories on 2026-10-23. OTX listed 5 pulses referencing the domain on 2026-10-23. PhishDestroy’s internal blocklist contains the domain, while external blocklists checked showed no listings and Spamhaus DBL reported it as not listed.

Infrastructure
The domain was registered with Dynadot Inc. on 2026-04-05, giving it 201 days of age at first sighting. Hosting is provided through Cloudflare’s network in Great Britain, with the recorded IPv4 address 188.114.97.3 and associated IPv6 addresses. The TLS certificate, issued by Google Trust Services, is valid until 2026-12-29 and uses modern cipher suites; DNSSEC was not enabled and the authoritative nameservers are abby.ns.cloudflare.com and scott.ns.cloudflare.com.

What to do
Visitors should avoid entering any personal or financial information on the site and change passwords if they suspect credentials were submitted. Organizations should add btcvexilly92.shop to web‑filtering and intrusion‑detection rules, monitor outbound traffic to its IP addresses, and review access logs for any connections to the domain.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a169cb-efcc-74df-9cbf-bfcaeaf9cbac/
Cloudflare Radar report: https://radar.cloudflare.com/scan/bbd96546-2175-4e93-9361-eda66d7d4085
Stored capture screenshot: https://urlscan.io/screenshots/01a169cb-efcc-74df-9cbf-bfcaeaf9cbac.png
Cloudflare Radar screenshot (2026-10-23T17:59:44Z): https://screenshots.phishdestroy.io/cf/bbd96546-2175-4e93-9361-eda66d7d4085.png
VirusTotal report: https://www.virustotal.com/gui/domain/btcvexilly92.shop
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=btcvexilly92.shop
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-23 19:04:59 UTC

## Stored page captures

- Primary capture: https://urlscan.io/screenshots/01a169cb-efcc-74df-9cbf-bfcaeaf9cbac.png
  Captured: 2026-10-23 17:27:36 UTC
- URLScan capture: https://screenshots.phishdestroy.io/01a169cb-efcc-74df-9cbf-bfcaeaf9cbac.png
  Captured: 2026-10-23 17:27:36 UTC
  Source report: https://urlscan.io/result/01a169cb-efcc-74df-9cbf-bfcaeaf9cbac/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/bbd96546-2175-4e93-9361-eda66d7d4085.png
  Captured: 2026-10-23 17:59:44 UTC
  Source report: https://radar.cloudflare.com/scan/bbd96546-2175-4e93-9361-eda66d7d4085
  SHA-256: 2c0f8085436d8933818641d2cbbcb409fbf0c7d221bd0fccf5b5b0d3643eb8a2

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-23T18:02:12Z",
        "uuid": "01a169cb-efcc-74df-9cbf-bfcaeaf9cbac",
        "scanned_at": "2026-10-23T17:27:18Z",
        "final_url": "https://btcvexilly92.shop/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://btcvexilly92.shop/",
                "from": "http://btcvexilly92.shop/",
                "status": 307
            }
        ],
        "ip": "104.21.94.153",
        "domains": [
            "cdnjs.cloudflare.com",
            "challenges.cloudflare.com",
            "cdn.jsdelivr.net",
            "fonts.googleapis.com",
            "static.cloudflareinsights.com",
            "static.cloudflare.com"
        ],
        "ips": [
            "104.18.95.41",
            "104.18.94.41",
            "104.17.208.5",
            "142.251.222.10",
            "104.17.25.14",
            "104.21.94.153"
        ],
        "asns": [
            "13335",
            "15169"
        ],
        "countries": [
            "US"
        ],
        "doc_hash": "13369273bc122f8477546caf47678307413dde90c356a020d2c4357e91582db0",
        "script_hashes": [
            "ccf00d1923b0131a10e0c6d26f95e5dee6ebf8621a27e83c5a2f68a2e0093142"
        ],
        "globals": [
            "LANG_MSGS",
            "ClientJS",
            "_ld7hr",
            "toggleTermsPopup",
            "__tsGet",
            "__tsNeedsClick",
            "__tsShow",
            "__tsReset",
            "__lgBS",
            "__cfQR",
            "turnstile",
            "__cfRLUnblockHandlers",
            "__lgT0"
        ],
        "cookies": [
            "entry_url"
        ],
        "tls": {
            "san": [
                "btcvexilly92.shop"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "WE1",
            "subject": "btcvexilly92.shop",
            "protocol": "QUIC",
            "valid_to": "2026-12-29T04:43:50Z",
            "valid_from": "2026-09-30T03:43:53Z"
        },
        "domain_age_days": 201,
        "apex_age_days": 201,
        "tls_age_days": 23,
        "tls_valid_days": 90,
        "requests": 20,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 99,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "cloudflare",
            "content-type": "text/html; charset=utf-8",
            "strict-transport-security": "max-age=31536000; includeSubDomains; preload",
            "content-security-policy": "style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://cdnjs.cloudflare.com; default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://static.cloudflare.com https://cd",
            "x-frame-options": "SAMEORIGIN",
            "x-content-type-options": "nosniff",
            "referrer-policy": "no-referrer-when-downgrade",
            "permissions-policy": "camera=(), microphone=(), geolocation=()",
            "cross-origin-opener-policy": "same-origin"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-23T18:02:14Z",
        "uuid": "bbd96546-2175-4e93-9361-eda66d7d4085",
        "scanned_at": "2026-10-23T17:59:44Z",
        "final_url": "https://btcvexilly92.shop/",
        "status": 200,
        "history": [
            {
                "url": "https://btcvexilly92.shop/",
                "status": 200
            }
        ],
        "dom_hash": "23cee0402e7fad4dd1f24d4bf8038cecee7bd53e211d9a993bb8c5ea16ff2c49",
        "doc_hash": "9ae76c93bdffd94cbf34e6b8424dbe548143039d415552014cf7b5c72c82685d",
        "phishing_v2": [
            "phishing"
        ],
        "domain_risks": [
            "Malware",
            "Security threats",
            "CIPA Filter",
            "CIPA"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "btcvexilly92.shop",
                "type": "A",
                "value": "188.114.97.0"
            },
            {
                "name": "btcvexilly92.shop",
                "type": "A",
                "value": "188.114.96.0"
            },
            {
                "name": "btcvexilly92.shop",
                "type": "AAAA",
                "value": "2a06:98c1:3120::"
            },
            {
                "name": "btcvexilly92.shop",
                "type": "AAAA",
                "value": "2a06:98c1:3121::"
            }
        ],
        "dnssec_valid": false,
        "ip": "188.114.97.0",
        "verdict": {
            "tags": [
                "malware"
            ],
            "malicious": true,
            "categories": [
                "malware"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-23T19:01:43Z",
        "analysis_at": "2026-10-22T12:17:10Z",
        "stats": {
            "timeout": 0,
            "harmless": 56,
            "malicious": 2,
            "suspicious": 0,
            "undetected": 34
        },
        "detections": {
            "SOCRadar": "phishing",
            "alphaMountain.ai": "phishing"
        },
        "reputation": 0,
        "tags": [
            "dga"
        ],
        "categories": {
            "alphaMountain.ai": "Information Technology, Phishing (alphaMountain.ai)"
        },
        "created": "2026-04-05T00:00:00Z",
        "updated": "2026-04-05T00:00:00Z",
        "first_seen": "2026-04-05T10:53:37Z",
        "dns": [
            {
                "ttl": 300,
                "type": "A",
                "value": "172.67.137.200"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3037::6815:5e99"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "scott.ns.cloudflare.com"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "abby.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "104.21.94.153"
            },
            {
                "ttl": 1800,
                "type": "SOA",
                "rname": "dns.cloudflare.com",
                "value": "abby.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3037::ac43:89c8"
            }
        ],
        "dns_at": "2026-10-22T12:24:31Z",
        "jarm": "27d40d40d00040d00042d43d00041df04c41293ba84f6efe3a613b22f983e6",
        "cert": {
            "san": [
                "btcvexilly92.shop"
            ],
            "issuer": "Google Trust Services / WE1",
            "serial": "d6f8ed82379a3b5c0e809f889004db88",
            "sha256": "abb55de181c43d595143e5bc5c5c7830bb273f082535b715a15432342f7303cf",
            "subject": "btcvexilly92.shop",
            "valid_to": "2026-12-29T04:43:50Z",
            "valid_from": "2026-09-30T03:43:53Z"
        },
        "whois": []
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-23T18:02:33Z",
        "mail_config": {
            "spf_lookups": 0
        },
        "caa_records": {
            "domain": "btcvexilly92.shop"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_by": [
                "CloudFlare Family"
            ],
            "blocked_count": 1
        },
        "archives": {
            "last": "2026-10-23T17:29:06Z",
            "first": "2026-10-12T06:00:29Z",
            "changes": 1,
            "days_archived": 2,
            "scans_per_day": 0.09,
            "avg_page_bytes": 42350
        },
        "robots_txt": {
            "agents": [
                "*"
            ],
            "present": true,
            "sitemaps": [
                "https://btcvexilly92.shop/sitemap.xml"
            ]
        },
        "sitemap": {
            "present": true,
            "url_count": 140
        },
        "social_tags": {
            "ogUrl": "https://btcvexilly92.shop/",
            "title": "Btc Vexilly 92 | AI Trading Platform | Official Website",
            "ogType": "website",
            "robots": "index, follow",
            "ogTitle": "Btc Vexilly 92 | AI-Driven Automation for Trading Excellence",
            "ogSiteName": "Btc Vexilly 92",
            "themeColor": "#101010",
            "description": "Btc Vexilly 92 delivers AI-enhanced trading guidance with autonomous bots, disciplined risk governance, and transparent operations for informed decision-making.",
            "twitterCard": "summary",
            "canonicalUrl": "https://btcvexilly92.shop/",
            "ogDescription": "Btc Vexilly 92 delivers AI-powered trading guidance with autonomous bots, disciplined risk governance, and transparent operations for informed decision-making."
        },
        "trackers": {
            "requests": 18,
            "trackers": [
                {
                    "name": "Cloudflare",
                    "company": "Cloudflare",
                    "country": "US",
                    "category": "Hosting",
                    "requests": 8
                },
                {
                    "name": "Google Fonts",
                    "company": "Google",
                    "country": "US",
                    "category": "Hosting",
                    "requests": 1
                },
                {
                    "name": "jsDelivr",
                    "company": "jsDelivr",
                    "category": "Hosting",
                    "requests": 1
                }
            ]
        },
        "mixed_content": {
            "no_sri": [
                "https://static.cloudflare.com/beacon.min.js",
                "https://challenges.cloudflare.com/turnstile/v0/api.js",
                "https://cdn.jsdelivr.net/npm/clientjs@0.2.1/dist/client.min.js"
            ],
            "third_party_scripts": 3
        },
        "status": {
            "up": true,
            "code": 200,
            "timings": {
                "dns": 98,
                "tls": 12,
                "wait": 147,
                "connect": 6,
                "download": 12
            },
            "response_ms": 275
        },
        "tls_connection": {
            "alpn": "h2",
            "cipher": "TLS_AES_256_GCM_SHA384",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                80,
                443,
                8080
            ]
        },
        "carbon": {
            "bytes": 145817,
            "co2_grams": 0.0053,
            "cleaner_than": 14
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "172.64.32.100",
                    "host": "abby.ns.cloudflare.com"
                },
                {
                    "ip": "172.64.33.230",
                    "host": "scott.ns.cloudflare.com"
                }
            ],
            "zone": "btcvexilly92.shop"
        },
        "cookies": {
            "cookies": [
                {
                    "name": "entry_url",
                    "secure": true,
                    "same_site": "Lax"
                }
            ]
        },
        "location": {
            "ip": "2a06:98c1:3121::3",
            "asn": "13335",
            "org": "CloudFLARENET-EU",
            "city": "London",
            "country": "GB"
        },
        "ssl": {
            "issuer": "Google Trust Services / WE1",
            "subject": "btcvexilly92.shop"
        },
        "dns": {
            "A": [
                "188.114.96.3",
                "188.114.97.3"
            ],
            "NS": [
                "abby.ns.cloudflare.com",
                "scott.ns.cloudflare.com"
            ],
            "SOA": "{\"nsname\": \"abby.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2418084638, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}",
            "AAAA": [
                "2a06:98c1:3120::3",
                "2a06:98c1:3121::3"
            ]
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "hsts": {
            "header": "max-age=31536000; includeSubDomains; preload",
            "message": "Site is compatible with the HSTS preload list!",
            "compatible": true
        },
        "http_security": {
            "xFrameOptions": "SAMEORIGIN",
            "referrerPolicy": "no-referrer-when-downgrade",
            "xXSSProtection": false,
            "permissionsPolicy": "camera=(), microphone=(), geolocation=()",
            "xContentTypeOptions": "nosniff",
            "contentSecurityPolicy": "style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://cdnjs.cloudflare.com; default-src 'self'; script-s",
            "strictTransportPolicy": "max-age=31536000; includeSubDomains; preload",
            "crossOriginOpenerPolicy": "same-origin",
            "crossOriginEmbedderPolicy": false,
            "crossOriginResourcePolicy": false
        },
        "firewall": {
            "waf": "Cloudflare",
            "has_waf": true
        },
        "get_ip": {
            "ip": "2a06:98c1:3121::3",
            "family": 6
        },
        "redirects": {
            "chain": [
                "https://btcvexilly92.shop"
            ]
        },
        "linked_pages": {
            "internal_count": 39
        },
        "headers": {
            "headers": {
                "server": "cloudflare",
                "content-type": "text/html; charset=utf-8",
                "strict-transport-security": "max-age=31536000; includeSubDomains; preload",
                "content-security-policy": "style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://cdnjs.cloudflare.com; default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://static.cloudflare.com https://cdn.jsdelivr.net https://challenges.cloudflare.com; font-src 'self' https://fonts.gstatic.com https://",
                "x-frame-options": "SAMEORIGIN",
                "x-content-type-options": "nosniff",
                "referrer-policy": "no-referrer-when-downgrade",
                "permissions-policy": "camera=(), microphone=(), geolocation=()",
                "cross-origin-opener-policy": "same-origin"
            }
        }
    }
}
```