# PhishDestroy domain threat record: cirexouvarin.net Content language: English Canonical HTML report: https://phishdestroy.io/domain/cirexouvarin.net/ Machine-readable companion: https://phishdestroy.io/domain/cirexouvarin.net/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-10-24 08:26:10 UTC - Last availability or vendor check: 2026-10-24 11:13:47 UTC - Stored record updated: 2026-10-24 11:13:47 UTC - VirusTotal detections in the stored snapshot: 17/92 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: no stored flag ## Stored infrastructure - Observed IP address: 188.114.97.3 - Registrar in stored WHOIS data: Dynadot Inc - Last stored HTTP status: 200 - Registration date (registry RDAP, cirexouvarin.net): 2026-08-31 23:23:27 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a16d02-988f-7788-8f7e-ec61fdab700d/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/cirexouvarin.net - Certificate Transparency search: https://crt.sh/?q=%25.cirexouvarin.net - Web Archive lookup: https://web.archive.org/web/*/https://cirexouvarin.net/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview PhishDestroy listed cirexouvarin.net as a suspicious domain based on multiple security‑vendor detections. The recorded page title is “Cirexo Uvarin — AI‑platform til data‑drevet kryptoinvestering”. The site returned an HTTP 200 response when observed on 2026-10-24. How the scam works The detections indicate the site matches patterns commonly associated with phishing or malware distribution, but no specific credential‑stealing form, wallet request, or malicious payload was observed in the captured page. Evidence VirusTotal analysis on 2026-10-22 reported 14 malicious and 3 suspicious classifications from 92 engines, for a total of 17 detections. Google Safe Browsing checked on 2026-10-24 did not flag the domain. urlscan.io captured the site on 2026-10-24; its engine verdict marked it malicious with a score of 94, while the overall verdict was non‑malicious. OTX listed four pulses referencing the domain as of 2026-10-24. PhishDestroy’s internal blocklist marked the domain as malicious on 2026-10-24, while external blocklists returned zero matches on that date. Infrastructure The domain was registered with Dynadot Inc on 2026-08-31, giving it an age of 53 days at the time of observation. The domain was observed to resolve via Cloudflare CDN to the IPv4 addresses 188.114.96.3 and 188.114.97.3, which were listed under the CloudFLARENET‑EU network in GB. The TLS certificate, issued by Google Trust Services, was valid from 2026-08-31 to 2026-11-29 and covered cirexouvarin.net and its wildcard. DNSSEC was not enabled in the observed DNS records. What to do Visitors should avoid entering credentials or downloading files; if any data was submitted, change the associated passwords and monitor accounts for unusual activity. Defenders should block the exact domain in firewalls, log any connections to it, and treat it as malicious in security policies. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a16d02-988f-7788-8f7e-ec61fdab700d/ Cloudflare Radar report: https://radar.cloudflare.com/scan/6ddc77dd-eed1-4e05-959f-b470e5737b78 URLQuery report: https://urlquery.net/report/035f859f-22cb-4081-9868-c9229892b4b7 Stored capture screenshot: https://urlscan.io/screenshots/01a16d02-988f-7788-8f7e-ec61fdab700d.png Cloudflare Radar screenshot (2026-10-24T08:58:08Z): https://screenshots.phishdestroy.io/cf/6ddc77dd-eed1-4e05-959f-b470e5737b78.png URLQuery screenshot: https://screenshots.phishdestroy.io/uq/035f859f-22cb-4081-9868-c9229892b4b7.png URLScan screenshot (2026-09-02T07:16:50Z): https://screenshots.phishdestroy.io/us/01a060f8-d403-70a9-bf60-e3d8730ff64e.png URLScan capture report: https://urlscan.io/result/01a060f8-d403-70a9-bf60-e3d8730ff64e/ URLScan screenshot (2026-09-02T09:45:09Z): https://screenshots.phishdestroy.io/us/01a06181-f2ff-71ae-8cbe-1852af2719f4.png URLScan capture report: https://urlscan.io/result/01a06181-f2ff-71ae-8cbe-1852af2719f4/ URLScan screenshot (2026-09-03T09:56:32Z): https://screenshots.phishdestroy.io/us/01a066b2-bb94-76ed-b911-6b049794c78c.png URLScan capture report: https://urlscan.io/result/01a066b2-bb94-76ed-b911-6b049794c78c/ URLScan screenshot (2026-10-24T08:37:16Z): https://screenshots.phishdestroy.io/us/01a16d0e-5dae-76aa-85e5-8f832998fb46.png URLScan capture report: https://urlscan.io/result/01a16d0e-5dae-76aa-85e5-8f832998fb46/ VirusTotal report: https://www.virustotal.com/gui/domain/cirexouvarin.net Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=cirexouvarin.net Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-24 08:59:23 UTC ## Stored page captures - Primary capture: https://urlscan.io/screenshots/01a16d02-988f-7788-8f7e-ec61fdab700d.png Captured: 2026-10-24 08:26:10 UTC - URLScan capture: https://screenshots.phishdestroy.io/01a16d02-988f-7788-8f7e-ec61fdab700d.png Captured: 2026-10-24 08:26:10 UTC Source report: https://urlscan.io/result/01a16d02-988f-7788-8f7e-ec61fdab700d/ - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/6ddc77dd-eed1-4e05-959f-b470e5737b78.png Captured: 2026-10-24 08:58:08 UTC Source report: https://radar.cloudflare.com/scan/6ddc77dd-eed1-4e05-959f-b470e5737b78 SHA-256: 2b2b07aa4c55e08e3718b7be6861471d26cbc7630ce1032abd9ba779b4a1ccba - URLQuery: https://screenshots.phishdestroy.io/uq/035f859f-22cb-4081-9868-c9229892b4b7.png Source report: https://urlquery.net/report/035f859f-22cb-4081-9868-c9229892b4b7 SHA-256: 2ed0233689b6776b8539019c55919aa6f9461b9f49b87fb226634935d8c8126d - URLScan · 2026-09-02: https://screenshots.phishdestroy.io/us/01a060f8-d403-70a9-bf60-e3d8730ff64e.png Captured: 2026-09-02 07:16:50 UTC Source report: https://urlscan.io/result/01a060f8-d403-70a9-bf60-e3d8730ff64e/ SHA-256: 35c8c219b8ad8ebce065e531792f3758deda6c89b814d28c34d7995086ef6cfa - URLScan · 2026-09-02: https://screenshots.phishdestroy.io/us/01a06181-f2ff-71ae-8cbe-1852af2719f4.png Captured: 2026-09-02 09:45:09 UTC Source report: https://urlscan.io/result/01a06181-f2ff-71ae-8cbe-1852af2719f4/ SHA-256: a8a93ec0ae693e3b3686c38b560042de8975193939c53f566f1d5ae347b266b9 - URLScan · 2026-09-03: https://screenshots.phishdestroy.io/us/01a066b2-bb94-76ed-b911-6b049794c78c.png Captured: 2026-09-03 09:56:32 UTC Source report: https://urlscan.io/result/01a066b2-bb94-76ed-b911-6b049794c78c/ SHA-256: 35c8c219b8ad8ebce065e531792f3758deda6c89b814d28c34d7995086ef6cfa - URLScan · 2026-10-24: https://screenshots.phishdestroy.io/us/01a16d0e-5dae-76aa-85e5-8f832998fb46.png Captured: 2026-10-24 08:37:16 UTC Source report: https://urlscan.io/result/01a16d0e-5dae-76aa-85e5-8f832998fb46/ SHA-256: ba38f1222965db816287a5bed9b394d4090c4bc1f1368c71daf86e1c7a670bb5 ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-24T08:48:03Z", "uuid": "01a16d02-988f-7788-8f7e-ec61fdab700d", "scanned_at": "2026-10-24T08:24:14Z", "final_url": "https://cirexouvarin.net/", "status": 200, "redirected": "https-only", "redirects": [ { "to": "https://cirexouvarin.net/", "from": "http://cirexouvarin.net/", "status": 307 } ], "ip": "188.114.96.3", "ips": [ "188.114.96.3" ], "asns": [ "13335" ], "doc_hash": "9900c2af5f30d5866ebf1b8166017240750308384714bfbc9a8360b13aa8baa3", "script_hashes": [ "2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8", "8aa5f8f647356dcd4fc5dbbe0efd5bc0e8da74026bc61e24636e2e1f5749b0ce" ], "globals": [ "__dclq", "__dclOrig", "__dclFlush", "__smsCheckBeforeSubmit", "__isSmsEnabled", "__isSmsVerified", "intlTelInput" ], "cookies": [ "connect.sid" ], "tls": { "san": [ "cirexouvarin.net", "*.cirexouvarin.net" ], "cipher": "AES_128_GCM", "issuer": "WE1", "subject": "cirexouvarin.net", "protocol": "QUIC", "valid_to": "2026-11-29T23:24:33Z", "valid_from": "2026-08-31T22:25:56Z" }, "domain_age_days": 53, "apex_age_days": 53, "tls_age_days": 53, "tls_valid_days": 90, "requests": 11, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 94, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "cloudflare", "content-type": "text/html; charset=utf-8", "x-content-type-options": "nosniff", "referrer-policy": "same-origin" } }, "cf": { "v": 1, "fetched_at": "2026-10-24T08:58:23Z", "uuid": "6ddc77dd-eed1-4e05-959f-b470e5737b78", "scanned_at": "2026-10-24T08:58:08Z", "final_url": "https://cirexouvarin.net/", "status": 200, "history": [ { "url": "https://cirexouvarin.net/", "status": 200 } ], "dom_hash": "ea4acbdca73acb94a5ea0acda2b54d74b1aa3f5ef7a5fd4a91d2acf69adbdd87", "doc_hash": "1ba26d528c556e69237df8708c4f190d085576f9ed756a31e3867e69caf4971a", "phishing_v2": [ "phishing" ], "domain_risks": [ "Malware", "Security threats", "CIPA Filter", "CIPA" ], "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "cirexouvarin.net", "type": "A", "value": "104.21.40.141" }, { "name": "cirexouvarin.net", "type": "A", "value": "172.67.152.184" }, { "name": "cirexouvarin.net", "type": "AAAA", "value": "2606:4700:3033::ac43:98b8" }, { "name": "cirexouvarin.net", "type": "AAAA", "value": "2606:4700:3030::6815:288d" } ], "dnssec_valid": false, "ip": "104.21.40.141", "verdict": { "tags": [ "malware" ], "malicious": true, "categories": [ "malware" ] }, "whois": { "registrar": "Dynadot Inc", "created": "2026-08-31T23:23:27Z", "updated": "2026-08-31T23:23:40Z", "expires": "2027-08-31T23:23:27Z", "nameservers": [ "keenan.ns.cloudflare.com", "ursula.ns.cloudflare.com" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-24T08:57:57Z", "analysis_at": "2026-10-22T19:05:13Z", "stats": { "timeout": 0, "harmless": 43, "malicious": 14, "suspicious": 3, "undetected": 32 }, "detections": { "CRDF": "malicious", "DNS8": "suspicious", "ESET": "suspicious", "VIPRE": "phishing", "G-Data": "phishing", "Lionic": "phishing", "Sophos": "malware", "CyRadar": "phishing", "Fortinet": "phishing", "SOCRadar": "phishing", "Kaspersky": "phishing", "Seclookup": "malicious", "Gridinsoft": "suspicious", "BitDefender": "phishing", "Chong Lua Dao": "malicious", "alphaMountain.ai": "phishing", "Forcepoint ThreatSeeker": "phishing" }, "reputation": 0, "tags": [ "dga" ], "registrar": "Dynadot Inc", "created": "2026-08-31T23:23:27Z", "expires": "2027-08-31T23:23:27Z", "updated": "2026-08-31T23:23:40Z", "first_seen": "2026-09-02T07:08:10Z", "dns": [ { "ttl": 300, "type": "A", "value": "104.21.40.141" }, { "ttl": 300, "type": "AAAA", "value": "2606:4700:3033::ac43:98b8" }, { "ttl": 3600, "type": "TXT", "value": "google-site-verification=eGZN_HWlvt_8iCLKYAa8gT4T6NRWy9Y8_UQ5nwH0_PQ" }, { "ttl": 21600, "type": "NS", "value": "ursula.ns.cloudflare.com" }, { "ttl": 300, "type": "AAAA", "value": "2606:4700:3030::6815:288d" }, { "ttl": 21600, "type": "NS", "value": "keenan.ns.cloudflare.com" }, { "ttl": 1800, "type": "SOA", "rname": "dns.cloudflare.com", "value": "keenan.ns.cloudflare.com" }, { "ttl": 300, "type": "A", "value": "172.67.152.184" } ], "dns_at": "2026-10-22T19:10:36Z", "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c", "cert": { "san": [ "cirexouvarin.net", "*.cirexouvarin.net" ], "issuer": "Google Trust Services / WE1", "serial": "d1e35cbd2c425e60e95fb4b802c37b3", "sha256": "1e889587c1a8af5ef571a2df553d306852285d15297c9b07f6b36fb03f31f8cb", "subject": "cirexouvarin.net", "valid_to": "2026-11-29T23:24:33Z", "valid_from": "2026-08-31T22:25:56Z" }, "whois": { "registrar": "Dynadot Inc", "registrar_iana_id": "472", "registrar_url": "http://www.dynadot.com", "created": "2026-08-31T23:23:27Z", "updated": "2026-08-31T23:23:40Z", "expires": "2027-08-31T23:23:27Z", "status": [ "clientTransferProhibited" ], "nameservers": [ "keenan.ns.cloudflare.com", "ursula.ns.cloudflare.com" ], "dnssec": "unsigned" }, "rdap": { "status": [ "transfer prohibited" ], "events": { "expiration": "2027-08-31T23:23:27Z", "last changed": "2026-08-31T23:23:40Z", "registration": "2026-08-31T23:23:27Z", "registrar expiration": "2027-08-31T23:23:27Z", "last update of RDAP database": "2026-10-22T08:54:49Z" } } }, "webcheck": { "v": 1, "fetched_at": "2026-10-24T08:58:38Z", "mail_config": { "spf_lookups": 0 }, "caa_records": { "domain": "cirexouvarin.net" }, "block_lists": { "resolvers": 12, "blocked_by": [ "CloudFlare Family" ], "blocked_count": 1 }, "archives": { "last": "2026-10-24T08:28:41Z", "first": "2026-10-16T04:57:50Z", "changes": 1, "days_archived": 2, "scans_per_day": 0.12, "avg_page_bytes": 21155 }, "robots_txt": { "agents": [ "*" ], "present": true, "sitemaps": [ "https://cirexouvarin.net/sitemap.xml" ] }, "sitemap": { "present": true, "url_count": 5 }, "social_tags": { "title": "Cirexo Uvarin — AI-platform til data-drevet kryptoinvestering", "robots": "index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1", "description": "Oplev med Cirexo Uvarin en AI-platform, der omsætter markedsdata til risikojusterede anbefalinger. Få gennemsigtige daglige rapporter og et dokumenteret grundlag for dine beslutninger.", "canonicalUrl": "https://cirexouvarin.net/" }, "trackers": { "requests": 54, "trackers": [ { "name": "Cloudflare", "company": "Cloudflare", "country": "US", "category": "Hosting", "requests": 1 }, { "name": "jsDelivr", "company": "jsDelivr", "category": "Hosting", "requests": 4 } ] }, "mixed_content": { "third_party_scripts": 0 }, "status": { "up": true, "code": 200, "timings": { "dns": 2, "tls": 17, "wait": 133, "connect": 12, "download": 2 }, "response_ms": 166 }, "tls_connection": { "alpn": "h2", "cipher": "TLS_AES_256_GCM_SHA384", "protocol": "TLSv1.3", "versions": [ "TLSv1", "TLSv1.1", "TLSv1.2", "TLSv1.3" ], "authorized": true, "forward_secrecy": true }, "ports": { "open": [ 80, 443, 8080 ] }, "carbon": { "bytes": 74111, "co2_grams": 0.0027, "cleaner_than": 28 }, "dns_server": { "ns": [ { "ip": "172.64.35.11", "host": "keenan.ns.cloudflare.com" }, { "ip": "162.159.38.191", "host": "ursula.ns.cloudflare.com" } ], "zone": "cirexouvarin.net" }, "cookies": { "cookies": [ { "name": "cf-c", "http_only": true, "same_site": "Lax" }, { "name": "__cf_clicked" }, { "name": "ph_phc_t6w4wzJE2sbz4ro8LmZZTssm5go3KD6mP7QsqcDQRSp6_posthog", "secure": true, "same_site": "Lax" } ] }, "location": { "ip": "2a06:98c1:3120::3", "asn": "13335", "org": "CloudFLARENET-EU", "city": "London", "country": "GB" }, "ssl": { "issuer": "Google Trust Services / WE1", "subject": "cirexouvarin.net" }, "dns": { "A": [ "188.114.96.3", "188.114.97.3" ], "NS": [ "keenan.ns.cloudflare.com", "ursula.ns.cloudflare.com" ], "SOA": "{\"nsname\": \"keenan.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2415346550, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}", "TXT": [ "google-site-verification=eGZN_HWlvt_8iCLKYAa8gT4T6NRWy9Y8_UQ5nwH0_PQ" ], "AAAA": [ "2a06:98c1:3121::3", "2a06:98c1:3120::3" ] }, "dnssec": { "ds": false, "rrsig": false, "dnskey": false }, "hsts": { "message": "Site does not serve any HSTS headers." }, "http_security": { "xFrameOptions": false, "referrerPolicy": "same-origin", "xXSSProtection": false, "permissionsPolicy": false, "xContentTypeOptions": "nosniff", "contentSecurityPolicy": false, "strictTransportPolicy": false, "crossOriginOpenerPolicy": false, "crossOriginEmbedderPolicy": false, "crossOriginResourcePolicy": false }, "firewall": { "waf": "Cloudflare", "has_waf": true }, "get_ip": { "ip": "2a06:98c1:3120::3", "family": 6 }, "redirects": { "chain": [ "https://cirexouvarin.net" ] }, "linked_pages": { "internal_count": 10 }, "whois": { "registrar": "Dynadot Inc", "created": "2026-08-31T23:23:27Z", "updated": "2026-08-31T23:23:40Z", "expires": "2027-08-31T23:23:27Z", "status": [ "clientTransferProhibited https://icann.org/epp" ], "nameservers": [ "keenan.ns.cloudflare.com", "ursula.ns.cloudflare.com" ] }, "headers": { "headers": { "server": "cloudflare", "content-type": "text/html; charset=utf-8", "x-content-type-options": "nosniff", "referrer-policy": "same-origin" } } } } ```