# PhishDestroy domain threat record: cevsterflax.digital

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/cevsterflax.digital/
Machine-readable companion: https://phishdestroy.io/domain/cevsterflax.digital/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-24 05:17:56 UTC
- Last availability or vendor check: 2026-10-24 11:13:41 UTC
- Stored record updated: 2026-10-24 18:21:38 UTC
- VirusTotal detections in the stored snapshot: 17/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored infrastructure

- Observed IP address: 104.21.88.234
- Registrar in stored WHOIS data: Spaceship, Inc.
- Last stored HTTP status: 200
- Registration date (registry RDAP, cevsterflax.digital): 2026-09-06 10:12:57 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a16c66-efc4-70c9-98e4-7c91d1ceb17f/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/cevsterflax.digital
- Certificate Transparency search: https://crt.sh/?q=%25.cevsterflax.digital
- Web Archive lookup: https://web.archive.org/web/*/https://cevsterflax.digital/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
PhishDestroy listed cevsterflax.digital on its internal blocklist because several security vendors flagged the domain as malicious or phishing. The recorded page title reads “Cevsterflax | AI Trading Platform | Authorized Entry Point”. The domain was first seen by PhishDestroy on 2026-10-24 and returned an HTTP 200 response at that time.

How the scam works
The listing does not confirm a specific fraud technique, but domains that present themselves as AI‑driven trading platforms are commonly used to lure users into providing credentials, personal data, or financial details. Such sites may attempt credential harvesting, social engineering, or redirect visitors to malicious content. No direct evidence of these actions was observed on the captured page, only the risk implied by the vendor detections.

Evidence
VirusTotal (analysis on 2026-10-20, retrieved 2026-10-24) reported 14 malicious and 3 suspicious detections out of 92 engines, with vendors such as alphaMountain.ai, BitDefender, and Forcepoint ThreatSeeker marking it malicious. Google Safe Browsing checked on 2026-10-24 did not flag the site. urlscan.io captured the page twice: on 2026-09-18 the verdict was clean, while on 2026-10-24 the engine score was 99 (malicious) but the overall verdict was non‑malicious. OTX listed 5 pulses referencing the domain as of 2026-10-24. Cloudflare Radar classified the site as phishing and malware on 2026-10-24. PhishDestroy’s internal blocklist marked the domain true on 2026-10-24; external blocklists showed no matches.

Infrastructure
The domain was registered on 2026-09-06 through Spaceship, Inc., with an expiration of 2027-09-06, giving it an age of 47 days at the time of observation. The recorded IP was 104.21.88.234, belonging to Cloudflare (recorded country CA), and the site employed Cloudflare’s CDN and WAF at the time of capture. TLS was issued by Google Trust Services on 2026-09-06, valid until 2026-12-05. The recorded nameservers were elle.ns.cloudflare.com and renan.ns.cloudflare.com, and DNSSEC was not enabled.

What to do
Visitors should avoid entering any credentials, personal information, or financial details on the site; if such data was submitted, change related passwords immediately. No malware was observed, so no system cleanup is required unless additional symptoms appear. Defenders should block the exact domain, monitor DNS queries for 104.21.88.234, and consider adding the domain to internal blocklists. Review access logs for any connections to the recorded IP and ensure that any compromised accounts are secured.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a16c66-efc4-70c9-98e4-7c91d1ceb17f/
Cloudflare Radar report: https://radar.cloudflare.com/scan/4580b18a-6ed4-4893-8f62-125576e408c2
URLQuery report: https://urlquery.net/report/c6ba8f0d-699a-4fd4-a891-8d71e50b0fd7
Stored capture screenshot: https://urlscan.io/screenshots/01a16c66-efc4-70c9-98e4-7c91d1ceb17f.png
Cloudflare Radar screenshot (2026-10-24T05:23:11Z): https://screenshots.phishdestroy.io/cf/4580b18a-6ed4-4893-8f62-125576e408c2.png
URLQuery screenshot: https://screenshots.phishdestroy.io/uq/c6ba8f0d-699a-4fd4-a891-8d71e50b0fd7.png
URLScan screenshot (2026-09-17T17:30:36Z): https://screenshots.phishdestroy.io/us/01a0b06b-7fd3-757c-9d30-6b310ec5bad6.png
URLScan capture report: https://urlscan.io/result/01a0b06b-7fd3-757c-9d30-6b310ec5bad6/
URLScan screenshot (2026-09-18T09:52:48Z): https://screenshots.phishdestroy.io/us/01a0b3ee-ba37-720f-bb68-80ab491a7d0b.png
URLScan capture report: https://urlscan.io/result/01a0b3ee-ba37-720f-bb68-80ab491a7d0b/
URLScan screenshot (2026-10-24T05:51:23Z): https://screenshots.phishdestroy.io/us/01a16c76-8e8b-773d-a24f-4b271b7d0a6f.png
URLScan capture report: https://urlscan.io/result/01a16c76-8e8b-773d-a24f-4b271b7d0a6f/
VirusTotal report: https://www.virustotal.com/gui/domain/cevsterflax.digital
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=cevsterflax.digital
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-24 06:24:52 UTC

## Stored page captures

- Primary capture: https://urlscan.io/screenshots/01a16c66-efc4-70c9-98e4-7c91d1ceb17f.png
  Captured: 2026-10-24 05:36:08 UTC
- URLScan capture: https://screenshots.phishdestroy.io/01a0b3ee-ba37-720f-bb68-80ab491a7d0b.png
  Captured: 2026-10-24 05:17:56 UTC
  Source report: https://urlscan.io/result/01a16c66-efc4-70c9-98e4-7c91d1ceb17f/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/4580b18a-6ed4-4893-8f62-125576e408c2.png
  Captured: 2026-10-24 05:23:11 UTC
  Source report: https://radar.cloudflare.com/scan/4580b18a-6ed4-4893-8f62-125576e408c2
  SHA-256: 5add2d9cf22bf0591dc12ee753596b7c66cedb2fe88ddbbf34524fb176b32975
- URLQuery: https://screenshots.phishdestroy.io/uq/c6ba8f0d-699a-4fd4-a891-8d71e50b0fd7.png
  Source report: https://urlquery.net/report/c6ba8f0d-699a-4fd4-a891-8d71e50b0fd7
  SHA-256: 0e8c89ba42faa48c829d96770450a05142628541ab4414fea956ee754f9dcd10
- URLScan · 2026-09-17: https://screenshots.phishdestroy.io/us/01a0b06b-7fd3-757c-9d30-6b310ec5bad6.png
  Captured: 2026-09-17 17:30:36 UTC
  Source report: https://urlscan.io/result/01a0b06b-7fd3-757c-9d30-6b310ec5bad6/
  SHA-256: 81c97fcbb6d7f8baf9f1dcff2daaaefe115a4539b6d336b3936dbcf4a033c9e3
- URLScan · 2026-09-18: https://screenshots.phishdestroy.io/us/01a0b3ee-ba37-720f-bb68-80ab491a7d0b.png
  Captured: 2026-09-18 09:52:48 UTC
  Source report: https://urlscan.io/result/01a0b3ee-ba37-720f-bb68-80ab491a7d0b/
  SHA-256: 93970616e1394b76a4adbed7e9c3dc0abe483a360221af775eb6b939725f73ba
- URLScan · 2026-10-24: https://screenshots.phishdestroy.io/us/01a16c76-8e8b-773d-a24f-4b271b7d0a6f.png
  Captured: 2026-10-24 05:51:23 UTC
  Source report: https://urlscan.io/result/01a16c76-8e8b-773d-a24f-4b271b7d0a6f/
  SHA-256: a7febcd188c391da60631e0bbe94adcf6328e3dbf7495ce434d46636dc0b8eda

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-24T05:53:55Z",
        "uuid": "01a16c66-efc4-70c9-98e4-7c91d1ceb17f",
        "scanned_at": "2026-10-24T05:34:24Z",
        "final_url": "https://cevsterflax.digital/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://cevsterflax.digital/",
                "from": "http://cevsterflax.digital/",
                "status": 307
            }
        ],
        "ip": "104.21.88.234",
        "domains": [
            "cdnjs.cloudflare.com",
            "challenges.cloudflare.com",
            "cdn.jsdelivr.net",
            "fonts.googleapis.com",
            "static.cloudflareinsights.com",
            "static.cloudflare.com"
        ],
        "ips": [
            "104.18.94.41",
            "104.18.95.41",
            "104.17.208.5",
            "142.250.195.170",
            "104.17.24.14",
            "104.21.88.234"
        ],
        "asns": [
            "13335",
            "15169"
        ],
        "countries": [
            "US"
        ],
        "doc_hash": "9a2765d134efba3cec31b7682cea6c57d4a910408238c36b37dc3493fc7460fc",
        "script_hashes": [
            "ccf00d1923b0131a10e0c6d26f95e5dee6ebf8621a27e83c5a2f68a2e0093142"
        ],
        "globals": [
            "LANG_MSGS",
            "ClientJS",
            "_vsjqr4i7",
            "toggleTermsPopup",
            "__tsGet",
            "__tsNeedsClick",
            "__tsShow",
            "__tsReset",
            "__lgBS",
            "__cfQR",
            "turnstile",
            "__cfRLUnblockHandlers",
            "__lgT0"
        ],
        "cookies": [
            "entry_url"
        ],
        "tls": {
            "san": [
                "cevsterflax.digital"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "WE1",
            "subject": "cevsterflax.digital",
            "protocol": "QUIC",
            "valid_to": "2026-12-05T13:44:56Z",
            "valid_from": "2026-09-06T12:44:57Z"
        },
        "domain_age_days": 47,
        "apex_age_days": 47,
        "tls_age_days": 47,
        "tls_valid_days": 90,
        "requests": 20,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 99,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "cloudflare",
            "content-type": "text/html; charset=utf-8",
            "strict-transport-security": "max-age=63072000; includeSubDomains; preload",
            "content-security-policy": "default-src 'self'; connect-src 'self' https://cloudflareinsights.com https://challenges.cloudflare.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://static.cloudflare.com https://cdn.jsdel",
            "x-frame-options": "SAMEORIGIN",
            "x-content-type-options": "nosniff",
            "referrer-policy": "strict-origin-when-cross-origin",
            "permissions-policy": "camera=(), microphone=(), geolocation=()",
            "cross-origin-opener-policy": "same-origin"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-24T05:26:12Z",
        "uuid": "4580b18a-6ed4-4893-8f62-125576e408c2",
        "scanned_at": "2026-10-24T05:23:11Z",
        "final_url": "https://cevsterflax.digital/",
        "status": 200,
        "history": [
            {
                "url": "https://cevsterflax.digital/",
                "status": 200
            }
        ],
        "dom_hash": "6978d716a0853b6d81f78f76ce9768624d954b3e6a1361f6965fb0f2f84c316c",
        "doc_hash": "6f27839b745d9740b5b46382ea4427cadced6e74c54ba52410897f34269f561e",
        "phishing_v2": [
            "phishing"
        ],
        "domain_risks": [
            "Malware",
            "Security threats",
            "CIPA Filter",
            "CIPA"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "cevsterflax.digital",
                "type": "A",
                "value": "104.21.88.234"
            },
            {
                "name": "cevsterflax.digital",
                "type": "A",
                "value": "172.67.154.53"
            },
            {
                "name": "cevsterflax.digital",
                "type": "AAAA",
                "value": "2606:4700:3036::ac43:9a35"
            },
            {
                "name": "cevsterflax.digital",
                "type": "AAAA",
                "value": "2606:4700:3035::6815:58ea"
            }
        ],
        "dnssec_valid": false,
        "ip": "104.21.88.234",
        "verdict": {
            "tags": [
                "malware"
            ],
            "malicious": true,
            "categories": [
                "malware"
            ]
        },
        "whois": {
            "registrar": "Spaceship, Inc.",
            "created": "2026-09-06T10:12:57Z",
            "updated": "2026-09-11T10:13:21Z",
            "expires": "2027-09-06T10:12:57Z",
            "nameservers": [
                "elle.ns.cloudflare.com",
                "renan.ns.cloudflare.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-24T06:23:44Z",
        "analysis_at": "2026-10-20T03:49:57Z",
        "stats": {
            "timeout": 0,
            "harmless": 43,
            "malicious": 14,
            "suspicious": 3,
            "undetected": 32
        },
        "detections": {
            "CRDF": "malicious",
            "DNS8": "suspicious",
            "ESET": "suspicious",
            "VIPRE": "phishing",
            "G-Data": "phishing",
            "Lionic": "phishing",
            "Sophos": "phishing",
            "CyRadar": "phishing",
            "Fortinet": "phishing",
            "SOCRadar": "phishing",
            "Kaspersky": "phishing",
            "Seclookup": "malicious",
            "Gridinsoft": "suspicious",
            "BitDefender": "phishing",
            "Chong Lua Dao": "malicious",
            "alphaMountain.ai": "phishing",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "first_seen": "2026-09-06T11:38:16Z",
        "dns": [
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3036::ac43:9a35"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "172.67.154.53"
            },
            {
                "ttl": 1800,
                "type": "SOA",
                "rname": "dns.cloudflare.com",
                "value": "elle.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "104.21.88.234"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "renan.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3035::6815:58ea"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "elle.ns.cloudflare.com"
            }
        ],
        "dns_at": "2026-10-20T03:56:14Z",
        "jarm": "27d40d40d00040d00042d43d00041df04c41293ba84f6efe3a613b22f983e6",
        "cert": {
            "san": [
                "cevsterflax.digital"
            ],
            "issuer": "Google Trust Services / WE1",
            "serial": "2e964ac0af613fa80e44474f93f78e2a",
            "sha256": "e01237e4933483be05e51f4f3102f8955eafd79c042a5dff59783e9f90a6c736",
            "subject": "cevsterflax.digital",
            "valid_to": "2026-12-05T13:44:56Z",
            "valid_from": "2026-09-06T12:44:57Z"
        },
        "rdap": {
            "status": [
                "client transfer prohibited",
                "add period"
            ],
            "events": {
                "last changed": "2026-09-06T10:55:02Z",
                "registration": "2026-09-06T10:12:57Z",
                "registrar expiration": "2027-09-06T10:12:57Z",
                "last update of RDAP database": "2026-10-18T03:46:04Z"
            },
            "registrar": "Spaceship, Inc.",
            "registrar_iana_id": "3862"
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-24T05:26:30Z",
        "mail_config": {
            "spf_lookups": 0
        },
        "caa_records": {
            "domain": "cevsterflax.digital"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_by": [
                "CloudFlare Family"
            ],
            "blocked_count": 1
        },
        "robots_txt": {
            "agents": [
                "*"
            ],
            "present": true,
            "sitemaps": [
                "https://cevsterflax.digital/sitemap.xml"
            ]
        },
        "sitemap": {
            "present": true,
            "url_count": 140
        },
        "social_tags": {
            "ogUrl": "https://cevsterflax.digital/",
            "title": "Cevsterflax | AI Trading Platform | Authorized Entry Point",
            "ogType": "website",
            "robots": "index, follow",
            "ogTitle": "Cevsterflax | AI-Driven Trading Mastery",
            "ogSiteName": "Cevsterflax",
            "themeColor": "#0F1114",
            "description": "Cevsterflax delivers AI-powered trading guidance, autonomous trading bots, robust account tools, and streamlined market workflows in a refined, premium experience.",
            "twitterCard": "summary",
            "canonicalUrl": "https://cevsterflax.digital/",
            "ogDescription": "Cevsterflax delivers AI-driven trading guidance, autonomous bots, robust account tools, and streamlined market workflows in a premium experience."
        },
        "trackers": {
            "requests": 18,
            "trackers": [
                {
                    "name": "Cloudflare",
                    "company": "Cloudflare",
                    "country": "US",
                    "category": "Hosting",
                    "requests": 8
                },
                {
                    "name": "Google Fonts",
                    "company": "Google",
                    "country": "US",
                    "category": "Hosting",
                    "requests": 1
                },
                {
                    "name": "jsDelivr",
                    "company": "jsDelivr",
                    "category": "Hosting",
                    "requests": 1
                }
            ]
        },
        "mixed_content": {
            "no_sri": [
                "https://static.cloudflare.com/beacon.min.js",
                "https://challenges.cloudflare.com/turnstile/v0/api.js",
                "https://cdn.jsdelivr.net/npm/clientjs@0.2.1/dist/client.min.js"
            ],
            "third_party_scripts": 3
        },
        "status": {
            "up": true,
            "code": 200,
            "timings": {
                "dns": 3,
                "tls": 35,
                "wait": 136,
                "connect": 42,
                "download": 23
            },
            "response_ms": 239
        },
        "tls_connection": {
            "alpn": "h2",
            "cipher": "TLS_AES_256_GCM_SHA384",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                80,
                443,
                8080
            ]
        },
        "carbon": {
            "bytes": 136647,
            "co2_grams": 0.005,
            "cleaner_than": 15
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "172.64.35.62",
                    "host": "renan.ns.cloudflare.com"
                },
                {
                    "ip": "173.245.58.110",
                    "host": "elle.ns.cloudflare.com"
                }
            ],
            "zone": "cevsterflax.digital"
        },
        "cookies": {
            "cookies": [
                {
                    "name": "entry_url",
                    "secure": true,
                    "same_site": "Lax"
                }
            ]
        },
        "location": {
            "ip": "2606:4700:3036::ac43:9a35",
            "asn": "13335",
            "org": "Cloudflare, Inc.",
            "city": "Toronto",
            "country": "CA"
        },
        "ssl": {
            "issuer": "Google Trust Services / WE1",
            "subject": "cevsterflax.digital"
        },
        "dns": {
            "A": [
                "104.21.88.234",
                "172.67.154.53"
            ],
            "NS": [
                "elle.ns.cloudflare.com",
                "renan.ns.cloudflare.com"
            ],
            "SOA": "{\"nsname\": \"elle.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2418086485, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}",
            "AAAA": [
                "2606:4700:3035::6815:58ea",
                "2606:4700:3036::ac43:9a35"
            ]
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "hsts": {
            "header": "max-age=63072000; includeSubDomains; preload",
            "message": "Site is compatible with the HSTS preload list!",
            "compatible": true
        },
        "http_security": {
            "xFrameOptions": "SAMEORIGIN",
            "referrerPolicy": "strict-origin-when-cross-origin",
            "xXSSProtection": false,
            "permissionsPolicy": "camera=(), microphone=(), geolocation=()",
            "xContentTypeOptions": "nosniff",
            "contentSecurityPolicy": "default-src 'self'; connect-src 'self' https://cloudflareinsights.com https://challenges.cloudflare.com; script-src 'sel",
            "strictTransportPolicy": "max-age=63072000; includeSubDomains; preload",
            "crossOriginOpenerPolicy": "same-origin",
            "crossOriginEmbedderPolicy": false,
            "crossOriginResourcePolicy": false
        },
        "firewall": {
            "waf": "Cloudflare",
            "has_waf": true
        },
        "get_ip": {
            "ip": "2606:4700:3036::ac43:9a35",
            "family": 6
        },
        "redirects": {
            "chain": [
                "https://cevsterflax.digital"
            ]
        },
        "linked_pages": {
            "internal_count": 42
        },
        "headers": {
            "headers": {
                "server": "cloudflare",
                "content-type": "text/html; charset=utf-8",
                "strict-transport-security": "max-age=63072000; includeSubDomains; preload",
                "content-security-policy": "default-src 'self'; connect-src 'self' https://cloudflareinsights.com https://challenges.cloudflare.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://static.cloudflare.com https://cdn.jsdelivr.net https://challenges.cloudflare.com; frame-ancestors 'self'; style-src 'self' 'unsafe-inline'",
                "x-frame-options": "SAMEORIGIN",
                "x-content-type-options": "nosniff",
                "referrer-policy": "strict-origin-when-cross-origin",
                "permissions-policy": "camera=(), microphone=(), geolocation=()",
                "cross-origin-opener-policy": "same-origin"
            }
        }
    }
}
```