# PhishDestroy domain threat record: byteroxe.pro

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/byteroxe.pro/
Machine-readable companion: https://phishdestroy.io/domain/byteroxe.pro/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-23 20:20:19 UTC
- Last availability or vendor check: 2026-10-23 20:20:19 UTC
- Stored record updated: 2026-10-23 22:20:58 UTC
- VirusTotal detections in the stored snapshot: 17/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored infrastructure

- Observed IP address: 188.114.97.3
- Registrar in stored WHOIS data: Dynadot Inc
- Last stored HTTP status: 200
- Registration date (registry RDAP, byteroxe.pro): 2026-03-25 16:39:32 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a16a6a-11bc-73dd-abb7-6d407122983e/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/byteroxe.pro
- Certificate Transparency search: https://crt.sh/?q=%25.byteroxe.pro
- Web Archive lookup: https://web.archive.org/web/*/https://byteroxe.pro/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
PhishDestroy added byteroxe.pro to its internal blocklist on 2026-10-23 after the site was first seen by the service. The recorded page title advertises an "AI Trading Platform" and the HTTP response returned a 200 status on the same date. Google Safe Browsing reported no threat, while OTX listed four pulses mentioning the domain. The domain was registered on 2026-03-25 and is hosted behind Cloudflare in the United Kingdom.

How the scam works
The available detections place the site in generic phishing and malware risk categories, meaning it could be used to harvest credentials, deliver malicious payloads, or trick users into financial actions. No specific malicious behavior was observed on the page itself, so the exact scam method remains unconfirmed.

Evidence
VirusTotal scanned the domain on 2026-10-22 and recorded 17 detections from 92 engines, including 14 malicious and 3 suspicious labels from vendors such as BitDefender, ESET and Forcepoint ThreatSeeker. URLScan’s machine‑learning engine flagged the URL as malicious with a score of 96 on 2026-10-23, though its overall verdict was non‑malicious. Cloudflare Radar also marked the domain as malicious for malware on 2026-10-23, while external public blocklists returned zero hits at that time.

Infrastructure
The domain was registered on 2026-03-25 through Dynadot Inc, giving it an age of about 212 days at first sighting. The recorded IP was 188.114.97.3, a Cloudflare edge node that was identified as part of the CloudFLARENET‑EU network and associated with GB. The TLS certificate, issued by Google Trust Services on 2026-09-20, is valid until 2026-12-19 and covers only the apex domain.

What to do
Visitors should avoid entering any credentials, personal data or financial information on the site and should change passwords if they suspect they may have been submitted. Organizations can block the exact domain name at the firewall or proxy and monitor DNS queries for any lookups to byteroxe.pro. Continue to watch for updates from security feeds, as the current evidence reflects a suspicious classification without confirmed malicious activity.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a16a6a-11bc-73dd-abb7-6d407122983e/
Cloudflare Radar report: https://radar.cloudflare.com/scan/14fab147-3031-4ab9-9d21-76b69595b423
URLQuery report: https://urlquery.net/report/3cf4017b-294f-4a21-b8c2-dc2a55bb85d0
Stored capture screenshot: https://urlscan.io/screenshots/01a16a6a-11bc-73dd-abb7-6d407122983e.png
Cloudflare Radar screenshot (2026-10-23T20:51:17Z): https://screenshots.phishdestroy.io/cf/14fab147-3031-4ab9-9d21-76b69595b423.png
URLQuery screenshot: https://screenshots.phishdestroy.io/uq/3cf4017b-294f-4a21-b8c2-dc2a55bb85d0.png
URLScan screenshot (2026-10-23T20:21:15Z): https://screenshots.phishdestroy.io/us/01a16a6c-8c9e-7750-aeb3-d12066ab24fc.png
URLScan capture report: https://urlscan.io/result/01a16a6c-8c9e-7750-aeb3-d12066ab24fc/
VirusTotal report: https://www.virustotal.com/gui/domain/byteroxe.pro
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=byteroxe.pro
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-23 20:52:57 UTC

## Stored page captures

- Primary capture: https://urlscan.io/screenshots/01a16a6a-11bc-73dd-abb7-6d407122983e.png
  Captured: 2026-10-23 20:20:19 UTC
- URLScan capture: https://screenshots.phishdestroy.io/01a16a6a-11bc-73dd-abb7-6d407122983e.png
  Captured: 2026-10-23 20:20:19 UTC
  Source report: https://urlscan.io/result/01a16a6a-11bc-73dd-abb7-6d407122983e/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/14fab147-3031-4ab9-9d21-76b69595b423.png
  Captured: 2026-10-23 20:51:17 UTC
  Source report: https://radar.cloudflare.com/scan/14fab147-3031-4ab9-9d21-76b69595b423
  SHA-256: bc0ad2dc6e12685eb8470a601afc0f3d7fe617a28fc47082b7baa1c499cb6b34
- URLQuery: https://screenshots.phishdestroy.io/uq/3cf4017b-294f-4a21-b8c2-dc2a55bb85d0.png
  Source report: https://urlquery.net/report/3cf4017b-294f-4a21-b8c2-dc2a55bb85d0
  SHA-256: f948975420cd2b12e705fd085ff36044c4ccadeaced8b461cede1aa32fd82b75
- URLScan · 2026-10-23: https://screenshots.phishdestroy.io/us/01a16a6c-8c9e-7750-aeb3-d12066ab24fc.png
  Captured: 2026-10-23 20:21:15 UTC
  Source report: https://urlscan.io/result/01a16a6c-8c9e-7750-aeb3-d12066ab24fc/
  SHA-256: 084ad9c9e0cf813dca08909e91682316e1a974f76d1932271502a4161b9ec747

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-23T20:51:59Z",
        "uuid": "01a16a6a-11bc-73dd-abb7-6d407122983e",
        "scanned_at": "2026-10-23T20:18:31Z",
        "final_url": "https://byteroxe.pro/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://byteroxe.pro/",
                "from": "http://byteroxe.pro/",
                "status": 307
            }
        ],
        "ip": "188.114.97.3",
        "domains": [
            "cdnjs.cloudflare.com",
            "challenges.cloudflare.com",
            "cdn.jsdelivr.net",
            "fonts.googleapis.com",
            "static.cloudflareinsights.com",
            "static.cloudflare.com"
        ],
        "ips": [
            "104.18.95.41",
            "2a04:4e42:600::485",
            "2a00:1450:4001:c17::5f",
            "104.17.24.14",
            "188.114.97.3"
        ],
        "asns": [
            "13335",
            "54113",
            "15169"
        ],
        "countries": [
            "US",
            "DE"
        ],
        "doc_hash": "d473224954da6952004393f33b103448d65563a278d55f04d8f1a588d5c9c4be",
        "script_hashes": [
            "ccf00d1923b0131a10e0c6d26f95e5dee6ebf8621a27e83c5a2f68a2e0093142"
        ],
        "globals": [
            "LANG_MSGS",
            "ClientJS",
            "_o4ocd0v",
            "toggleTermsPopup",
            "__tsGet",
            "__tsNeedsClick",
            "__tsShow",
            "__tsReset",
            "__lgBS",
            "__cfQR",
            "turnstile",
            "__cfRLUnblockHandlers",
            "__lgT0"
        ],
        "cookies": [
            "entry_url"
        ],
        "tls": {
            "san": [
                "byteroxe.pro"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "WE1",
            "subject": "byteroxe.pro",
            "protocol": "QUIC",
            "valid_to": "2026-12-19T07:10:58Z",
            "valid_from": "2026-09-20T06:11:01Z"
        },
        "domain_age_days": 211,
        "apex_age_days": 211,
        "tls_age_days": 33,
        "tls_valid_days": 90,
        "requests": 20,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 96,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "cloudflare",
            "content-type": "text/html; charset=utf-8",
            "strict-transport-security": "max-age=31536000; includeSubDomains; preload",
            "content-security-policy": "font-src 'self' https://fonts.gstatic.com https://cdnjs.cloudflare.com; frame-ancestors 'self'; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://cdnjs.cloudflare.com; img-src 'sel",
            "x-frame-options": "SAMEORIGIN",
            "x-content-type-options": "nosniff",
            "referrer-policy": "strict-origin-when-cross-origin",
            "permissions-policy": "camera=(), microphone=(), geolocation=()",
            "cross-origin-opener-policy": "same-origin"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-23T20:52:02Z",
        "uuid": "14fab147-3031-4ab9-9d21-76b69595b423",
        "scanned_at": "2026-10-23T20:51:17Z",
        "final_url": "https://byteroxe.pro/",
        "status": 200,
        "history": [
            {
                "url": "https://byteroxe.pro/",
                "status": 200
            }
        ],
        "dom_hash": "eb50a4314f6becb40518b3ca3ba32a3e3e108a7bbdd2f6f3f1a94150553cd908",
        "doc_hash": "085d43204b5c7ec4709adb7aa4b2cbde03b436019d738a1d76fb291c7aaa3e05",
        "phishing_v2": [
            "phishing"
        ],
        "domain_risks": [
            "Malware",
            "Security threats",
            "CIPA Filter",
            "CIPA"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "byteroxe.pro",
                "type": "A",
                "value": "188.114.97.0"
            },
            {
                "name": "byteroxe.pro",
                "type": "A",
                "value": "188.114.96.0"
            },
            {
                "name": "byteroxe.pro",
                "type": "AAAA",
                "value": "2a06:98c1:3121::"
            },
            {
                "name": "byteroxe.pro",
                "type": "AAAA",
                "value": "2a06:98c1:3120::"
            }
        ],
        "dnssec_valid": false,
        "ip": "188.114.97.0",
        "verdict": {
            "tags": [
                "malware"
            ],
            "malicious": true,
            "categories": [
                "malware"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-23T20:50:48Z",
        "analysis_at": "2026-10-22T18:09:43Z",
        "stats": {
            "timeout": 0,
            "harmless": 44,
            "malicious": 14,
            "suspicious": 3,
            "undetected": 31
        },
        "detections": {
            "CRDF": "malicious",
            "DNS8": "suspicious",
            "ESET": "suspicious",
            "VIPRE": "malware",
            "G-Data": "phishing",
            "Lionic": "phishing",
            "Sophos": "phishing",
            "CyRadar": "phishing",
            "Fortinet": "phishing",
            "SOCRadar": "phishing",
            "Kaspersky": "phishing",
            "Seclookup": "malicious",
            "Gridinsoft": "suspicious",
            "BitDefender": "phishing",
            "Chong Lua Dao": "malicious",
            "alphaMountain.ai": "phishing",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "categories": {
            "alphaMountain.ai": "Phishing (alphaMountain.ai)"
        },
        "created": "2026-03-25T00:00:00Z",
        "updated": "2026-03-26T00:00:00Z",
        "first_seen": "2026-03-26T09:47:58Z",
        "dns": [
            {
                "ttl": 21600,
                "type": "NS",
                "value": "rudy.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3032::ac43:d9b8"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "172.67.217.184"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "eloise.ns.cloudflare.com"
            },
            {
                "ttl": 1800,
                "type": "SOA",
                "rname": "dns.cloudflare.com",
                "value": "eloise.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3037::6815:2db3"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "104.21.45.179"
            }
        ],
        "dns_at": "2026-10-22T18:15:11Z",
        "jarm": "27d40d40d00040d00042d43d00041df04c41293ba84f6efe3a613b22f983e6",
        "cert": {
            "san": [
                "byteroxe.pro"
            ],
            "issuer": "Google Trust Services / WE1",
            "serial": "4c125604941e0410eb0eb61b770d8ce",
            "sha256": "c1092c98d982d9b4e0f25caf2a05babb6d58b9991fe6acccfe2601bfbe653670",
            "subject": "byteroxe.pro",
            "valid_to": "2026-12-19T07:10:58Z",
            "valid_from": "2026-09-20T06:11:01Z"
        },
        "rdap": {
            "status": [
                "transfer prohibited"
            ],
            "events": {
                "expiration": "2027-03-25T16:39:32Z",
                "last changed": "2026-03-26T09:21:13Z",
                "registration": "2026-03-25T16:39:32Z",
                "registrar expiration": "2027-03-25T16:39:32Z",
                "last update of RDAP database": "2026-10-16T06:55:24Z"
            },
            "registrar": "DYNADOT LLC",
            "registrar_iana_id": "472"
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-23T20:52:14Z",
        "mail_config": {
            "spf_lookups": 0
        },
        "caa_records": {
            "domain": "byteroxe.pro"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_by": [
                "CloudFlare Family"
            ],
            "blocked_count": 1
        },
        "archives": {
            "last": "2026-10-23T20:23:27Z",
            "first": "2026-10-14T08:22:45Z",
            "changes": 1,
            "days_archived": 2,
            "scans_per_day": 0.11,
            "avg_page_bytes": 41969
        },
        "robots_txt": {
            "agents": [
                "*"
            ],
            "present": true,
            "sitemaps": [
                "https://byteroxe.pro/sitemap.xml"
            ]
        },
        "sitemap": {
            "present": true,
            "url_count": 175
        },
        "social_tags": {
            "ogUrl": "https://byteroxe.pro/",
            "title": "Byte Roxe | AI Trading Platform | Official Website",
            "ogType": "website",
            "robots": "index, follow",
            "ogTitle": "Byte Roxe | AI Bot Execution & Risk Controls",
            "ogSiteName": "Byte Roxe",
            "themeColor": "#180025",
            "description": "Byte Roxe unleashes AI-powered trading bot tooling for strategic orchestration, precise execution controls, and risk-aware workflows across major markets with crystal-clear visibility.",
            "twitterCard": "summary",
            "canonicalUrl": "https://byteroxe.pro/",
            "ogDescription": "Experience premium AI-powered trading tools that orchestrate strategies, govern execution, and provide transparent risk controls across global markets."
        },
        "trackers": {
            "requests": 19,
            "trackers": [
                {
                    "name": "Cloudflare",
                    "company": "Cloudflare",
                    "country": "US",
                    "category": "Hosting",
                    "requests": 8
                },
                {
                    "name": "Google Fonts",
                    "company": "Google",
                    "country": "US",
                    "category": "Hosting",
                    "requests": 1
                },
                {
                    "name": "jsDelivr",
                    "company": "jsDelivr",
                    "category": "Hosting",
                    "requests": 1
                },
                {
                    "name": "Cloudflare Insights",
                    "company": "Cloudflare",
                    "country": "US",
                    "category": "Site Analytics",
                    "requests": 1
                }
            ]
        },
        "mixed_content": {
            "no_sri": [
                "https://static.cloudflare.com/beacon.min.js",
                "https://challenges.cloudflare.com/turnstile/v0/api.js",
                "https://cdn.jsdelivr.net/npm/clientjs@0.2.1/dist/client.min.js"
            ],
            "third_party_scripts": 3
        },
        "status": {
            "up": true,
            "code": 200,
            "timings": {
                "dns": 4,
                "tls": 21,
                "wait": 181,
                "connect": 17,
                "download": 16
            },
            "response_ms": 239
        },
        "tls_connection": {
            "alpn": "h2",
            "cipher": "TLS_AES_256_GCM_SHA384",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                80,
                443,
                8080
            ]
        },
        "carbon": {
            "bytes": 146123,
            "co2_grams": 0.0053,
            "cleaner_than": 14
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "162.159.38.208",
                    "host": "eloise.ns.cloudflare.com"
                },
                {
                    "ip": "173.245.59.229",
                    "host": "rudy.ns.cloudflare.com"
                }
            ],
            "zone": "byteroxe.pro"
        },
        "cookies": {
            "cookies": [
                {
                    "name": "entry_url",
                    "secure": true,
                    "same_site": "Lax"
                }
            ]
        },
        "location": {
            "ip": "2a06:98c1:3121::3",
            "asn": "13335",
            "org": "CloudFLARENET-EU",
            "city": "London",
            "country": "GB"
        },
        "ssl": {
            "issuer": "Google Trust Services / WE1",
            "subject": "byteroxe.pro"
        },
        "dns": {
            "A": [
                "188.114.96.3",
                "188.114.97.3"
            ],
            "NS": [
                "eloise.ns.cloudflare.com",
                "rudy.ns.cloudflare.com"
            ],
            "SOA": "{\"nsname\": \"eloise.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2418084465, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}",
            "AAAA": [
                "2a06:98c1:3121::3",
                "2a06:98c1:3120::3"
            ]
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "hsts": {
            "header": "max-age=31536000; includeSubDomains; preload",
            "message": "Site is compatible with the HSTS preload list!",
            "compatible": true
        },
        "http_security": {
            "xFrameOptions": "SAMEORIGIN",
            "referrerPolicy": "strict-origin-when-cross-origin",
            "xXSSProtection": false,
            "permissionsPolicy": "camera=(), microphone=(), geolocation=()",
            "xContentTypeOptions": "nosniff",
            "contentSecurityPolicy": "font-src 'self' https://fonts.gstatic.com https://cdnjs.cloudflare.com; frame-ancestors 'self'; style-src 'self' 'unsafe",
            "strictTransportPolicy": "max-age=31536000; includeSubDomains; preload",
            "crossOriginOpenerPolicy": "same-origin",
            "crossOriginEmbedderPolicy": false,
            "crossOriginResourcePolicy": false
        },
        "firewall": {
            "waf": "Cloudflare",
            "has_waf": true
        },
        "get_ip": {
            "ip": "2a06:98c1:3120::3",
            "family": 6
        },
        "redirects": {
            "chain": [
                "https://byteroxe.pro"
            ]
        },
        "linked_pages": {
            "internal_count": 45
        },
        "headers": {
            "headers": {
                "server": "cloudflare",
                "content-type": "text/html; charset=utf-8",
                "strict-transport-security": "max-age=31536000; includeSubDomains; preload",
                "content-security-policy": "font-src 'self' https://fonts.gstatic.com https://cdnjs.cloudflare.com; frame-ancestors 'self'; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://cdnjs.cloudflare.com; img-src 'self' data: blob:; connect-src 'self' https://cloudflareinsights.com https://challenges.cloudflare.com;",
                "x-frame-options": "SAMEORIGIN",
                "x-content-type-options": "nosniff",
                "referrer-policy": "strict-origin-when-cross-origin",
                "permissions-policy": "camera=(), microphone=(), geolocation=()",
                "cross-origin-opener-policy": "same-origin"
            }
        }
    }
}
```