# PhishDestroy domain threat record: cliffsfundmere.com

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/cliffsfundmere.com/
Machine-readable companion: https://phishdestroy.io/domain/cliffsfundmere.com/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-24 14:31:58 UTC
- Last availability or vendor check: 2026-10-24 23:07:09 UTC
- Stored record updated: 2026-10-25 09:14:59 UTC
- VirusTotal detections in the stored snapshot: 15/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: signal

## Stored infrastructure

- Observed IP address: 158.94.210.119
- Registrar in stored WHOIS data: Dynadot Inc
- Last stored HTTP status: 200
- Registration date in stored WHOIS data: 2026-04-22 17:18:16 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a16e5d-e866-725d-b851-ae6a857f87f4/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/cliffsfundmere.com
- Certificate Transparency search: https://crt.sh/?q=%25.cliffsfundmere.com
- Web Archive lookup: https://web.archive.org/web/*/https://cliffsfundmere.com/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
PhishDestroy listed cliffsfundmere.com as a suspicious domain because eleven VirusTotal vendors marked it malicious. The recorded page title was “Cliffs Fundmere - AI‑Powered Trading Platform & Smart Investing”. PhishDestroy first saw the domain on 2026-10-24 and recorded an HTTP 200 response on that date. Google Safe Browsing reported no threat and external blocklists showed no hits at the time of checking.

How the scam works
The detections suggest the site may be used for typical phishing or fraud tactics, such as presenting a legitimate‑looking service to lure users into providing credentials or personal data. No specific malicious behavior was observed on the captured page, so the exact method cannot be confirmed. In general, phishing sites rely on deceptive branding and persuasive language to trick visitors into disclosing sensitive information.

Evidence
VirusTotal scanned the domain on 2026-10-24 and marked it malicious by 11 vendors and suspicious by 4, with 15 detections out of 92 engines; vendors include BitDefender, G‑Data, Kaspersky and others. Google Safe Browsing checked on the same day and did not flag the domain. urlscan captured the site on 2026-10-24, reporting an overall clean verdict but its engine analysis gave a malicious score of 97. OTX listed five pulses mentioning the domain as of 2026-10-24. PhishDestroy’s internal blocklist includes the domain, while external blocklists showed zero hits at the time of checking.

Infrastructure
The domain was registered with Dynadot Inc on 2026-04-22, giving it an age of about 184 days at the time of observation. The domain was recorded pointing to IP 158.94.210.119, which was associated with Omegatech LTD in the Netherlands. The site used a Let’s Encrypt TLS certificate valid from 2026-08-31 to 2026-11-29 and had ports 22, 80 and 443 open. DNSSEC was not enabled for the zone.

What to do
Visitors should avoid entering any credentials, personal data or financial information on the site and should change passwords if they suspect they may have been entered. Organizations should add cliffsfundmere.com to their web filtering and intrusion detection rules and monitor network logs for connections to the recorded IP address. Security teams can use the provided registration and hosting details to enrich threat intel and coordinate with the registrar if needed.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a16e5d-e866-725d-b851-ae6a857f87f4/
Cloudflare Radar report: https://radar.cloudflare.com/scan/9b71b15e-3aec-42c6-9d90-7efe23a9d117
Stored capture screenshot: https://urlscan.io/screenshots/01a16e5d-e866-725d-b851-ae6a857f87f4.png
Cloudflare Radar screenshot (2026-10-24T14:36:52Z): https://screenshots.phishdestroy.io/cf/9b71b15e-3aec-42c6-9d90-7efe23a9d117.png
URLScan screenshot (2026-07-28T07:54:45Z): https://screenshots.phishdestroy.io/us/019fa7b7-f393-7228-ab3f-0b539c7046c9.png
URLScan capture report: https://urlscan.io/result/019fa7b7-f393-7228-ab3f-0b539c7046c9/
VirusTotal report: https://www.virustotal.com/gui/domain/cliffsfundmere.com
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=cliffsfundmere.com
Archived copy: https://web.archive.org/web/20261024143357/https://cliffsfundmere.com/
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-24 15:09:13 UTC

## Stored page captures

- Primary capture: https://urlscan.io/screenshots/01a16e5d-e866-725d-b851-ae6a857f87f4.png
  Captured: 2026-10-24 14:45:31 UTC
- URLScan capture: https://screenshots.phishdestroy.io/019fa321-72a2-72aa-825e-5cbe11682623.png
  Captured: 2026-10-24 14:31:58 UTC
  Source report: https://urlscan.io/result/01a16e5d-e866-725d-b851-ae6a857f87f4/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/9b71b15e-3aec-42c6-9d90-7efe23a9d117.png
  Captured: 2026-10-24 14:36:52 UTC
  Source report: https://radar.cloudflare.com/scan/9b71b15e-3aec-42c6-9d90-7efe23a9d117
  SHA-256: 06946ecea616c772e4c7e63d487a8d59b05b76f6c1032a672c3236e1c19b9e27
- URLScan · 2026-07-27: https://screenshots.phishdestroy.io/us/019fa321-72a2-72aa-825e-5cbe11682623.png
  Captured: 2026-07-27 10:31:54 UTC
  Source report: https://urlscan.io/result/019fa321-72a2-72aa-825e-5cbe11682623/
  SHA-256: c8ae5b2eb632fb03e96c2d1e34715fa76005234dd3e22b0ba88de6d963f1f181
- URLScan · 2026-07-28: https://screenshots.phishdestroy.io/us/019fa7b7-f393-7228-ab3f-0b539c7046c9.png
  Captured: 2026-07-28 07:54:45 UTC
  Source report: https://urlscan.io/result/019fa7b7-f393-7228-ab3f-0b539c7046c9/
  SHA-256: 54fba8d325462c2f1a7760c43105006a6f118e5c447abc17588a76c5a3e991ab

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-24T15:08:37Z",
        "uuid": "01a16e5d-e866-725d-b851-ae6a857f87f4",
        "scanned_at": "2026-10-24T14:43:37Z",
        "final_url": "https://cliffsfundmere.com/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://cliffsfundmere.com/",
                "from": "http://cliffsfundmere.com/",
                "status": 307
            }
        ],
        "ip": "158.94.210.119",
        "ips": [
            "158.94.210.119"
        ],
        "asns": [
            "202412"
        ],
        "countries": [
            "NL"
        ],
        "doc_hash": "22bfa55be6fb0d0c41473c14ff8e4e90195bd2cf321f297bb658d40c2151fff0",
        "script_hashes": [
            "8aa5f8f647356dcd4fc5dbbe0efd5bc0e8da74026bc61e24636e2e1f5749b0ce"
        ],
        "globals": [
            "__dclq",
            "__dclOrig",
            "__dclFlush",
            "__smsCheckBeforeSubmit",
            "__isSmsEnabled",
            "__isSmsVerified",
            "intlTelInput",
            "navToggle",
            "navWrapper",
            "langBtn",
            "langDropdown"
        ],
        "cookies": [
            "connect.sid"
        ],
        "tls": {
            "san": [
                "cliffsfundmere.com"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "YE1",
            "subject": "cliffsfundmere.com",
            "protocol": "TLS 1.3",
            "valid_to": "2026-11-29T12:22:21Z",
            "valid_from": "2026-08-31T12:22:22Z"
        },
        "domain_age_days": 184,
        "apex_age_days": 184,
        "tls_age_days": 54,
        "tls_valid_days": 89,
        "requests": 8,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 97,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "content-type": "text/html; charset=utf-8",
            "x-content-type-options": "nosniff",
            "referrer-policy": "same-origin"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-24T14:40:02Z",
        "uuid": "9b71b15e-3aec-42c6-9d90-7efe23a9d117",
        "scanned_at": "2026-10-24T14:36:52Z",
        "final_url": "https://cliffsfundmere.com/",
        "status": 200,
        "history": [
            {
                "url": "https://cliffsfundmere.com/",
                "status": 200
            }
        ],
        "dom_hash": "19b2fcfb320b85a45b22df9e9a13c7222a38cd60bf7a1ef0c2d6a601aa6e9a84",
        "doc_hash": "c45e1a879e0e1891e9141f51b03489ced09ac60a9d3f4180ec9ae00d1a53668d",
        "domain_risks": [
            "Malware",
            "Security threats",
            "CIPA Filter",
            "CIPA"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "cliffsfundmere.com",
                "type": "A",
                "value": "158.94.210.119"
            }
        ],
        "dnssec_valid": false,
        "ip": "158.94.210.119",
        "verdict": {
            "tags": [
                "malware"
            ],
            "malicious": true,
            "categories": [
                "malware"
            ]
        },
        "whois": {
            "registrar": "Dynadot Inc",
            "created": "2026-04-22T19:18:16Z",
            "updated": "2026-08-13T12:29:18Z",
            "expires": "2027-04-22T19:18:16Z",
            "nameservers": [
                "ns1.dyna-ns.net",
                "ns2.dyna-ns.net"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-24T15:06:42Z",
        "analysis_at": "2026-10-24T07:06:02Z",
        "stats": {
            "timeout": 0,
            "harmless": 45,
            "malicious": 11,
            "suspicious": 4,
            "undetected": 32
        },
        "detections": {
            "DNS8": "suspicious",
            "ESET": "suspicious",
            "VIPRE": "phishing",
            "G-Data": "phishing",
            "Lionic": "phishing",
            "Sophos": "phishing",
            "CyRadar": "phishing",
            "Fortinet": "spam",
            "SOCRadar": "phishing",
            "Kaspersky": "phishing",
            "Seclookup": "malicious",
            "Gridinsoft": "suspicious",
            "BitDefender": "phishing",
            "alphaMountain.ai": "phishing",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "categories": {
            "Sophos": "phishing and fraud",
            "alphaMountain.ai": "Phishing (alphaMountain.ai)",
            "Forcepoint ThreatSeeker": "phishing and other frauds"
        },
        "created": "2026-04-22T00:00:00Z",
        "updated": "2026-04-22T00:00:00Z",
        "first_seen": "2026-04-22T19:39:55Z",
        "dns": [
            {
                "ttl": 300,
                "type": "A",
                "value": "158.94.210.119"
            },
            {
                "ttl": 300,
                "type": "NS",
                "value": "ns1.dyna-ns.net"
            },
            {
                "ttl": 300,
                "type": "NS",
                "value": "ns2.dyna-ns.net"
            },
            {
                "ttl": 300,
                "type": "SOA",
                "rname": "hostmaster.cliffsfundmere.com",
                "value": "ns1.dyna-ns.net"
            }
        ],
        "dns_at": "2026-10-24T07:10:09Z",
        "jarm": "40d40d40d00000000043d43d00043d6aff5ab0f4fc31897186312c9e639319",
        "cert": {
            "san": [
                "cliffsfundmere.com"
            ],
            "issuer": "Let's Encrypt / YE1",
            "serial": "6f68d67fe15504e4a548aace1aeb9dc6519",
            "sha256": "9a2585e1d6bdc55ec5787a4be2968ac6646c460de19626b0861d6ed3a9fc917b",
            "subject": "cliffsfundmere.com",
            "valid_to": "2026-11-29T12:22:21Z",
            "valid_from": "2026-08-31T12:22:22Z"
        },
        "whois": [],
        "rdap": {
            "status": [
                "transfer prohibited"
            ],
            "events": {
                "expiration": "2027-04-22T19:18:16Z",
                "last changed": "2026-08-31T11:59:49Z",
                "registration": "2026-04-22T19:18:16Z",
                "registrar expiration": "2027-04-22T19:18:16Z",
                "last update of RDAP database": "2026-10-23T10:31:28Z"
            },
            "registrar": "DYNADOT LLC",
            "registrar_iana_id": "472"
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-24T14:40:17Z",
        "mail_config": {
            "spf_lookups": 0
        },
        "caa_records": {
            "domain": "cliffsfundmere.com"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_by": [
                "CloudFlare Family"
            ],
            "blocked_count": 1
        },
        "archives": {
            "last": "2026-10-24T14:33:57Z",
            "first": "2026-10-24T14:33:57Z",
            "changes": 0,
            "days_archived": 1,
            "avg_page_bytes": 23355
        },
        "robots_txt": {
            "agents": [
                "*"
            ],
            "present": true,
            "sitemaps": [
                "https://cliffsfundmere.com/sitemap.xml"
            ]
        },
        "sitemap": {
            "present": true,
            "url_count": 5
        },
        "social_tags": {
            "title": "Cliffs Fundmere - AI-Powered Trading Platform & Smart Investing",
            "robots": "index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1",
            "description": "Cliffs Fundmere - Explore AI-driven market analysis and automated trading tools across 190+ markets. Smarter investing decisions, faster opportunities, one powerful platform.",
            "canonicalUrl": "https://cliffsfundmere.com/"
        },
        "trackers": {
            "requests": 31,
            "trackers": [
                {
                    "name": "Cloudflare",
                    "company": "Cloudflare",
                    "country": "US",
                    "category": "Hosting",
                    "requests": 1
                },
                {
                    "name": "jsDelivr",
                    "company": "jsDelivr",
                    "category": "Hosting",
                    "requests": 3
                }
            ]
        },
        "mixed_content": {
            "third_party_scripts": 0
        },
        "status": {
            "up": true,
            "code": 200,
            "timings": {
                "dns": 535,
                "tls": 76,
                "wait": 172,
                "connect": 69,
                "download": 141
            },
            "response_ms": 993
        },
        "tls_connection": {
            "alpn": "h2",
            "cipher": "TLS_AES_128_GCM_SHA256",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                22,
                80,
                443
            ]
        },
        "carbon": {
            "bytes": 91069,
            "co2_grams": 0.0033,
            "cleaner_than": 24
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "162.159.26.92",
                    "host": "ns1.dyna-ns.net"
                },
                {
                    "ip": "162.159.25.5",
                    "host": "ns2.dyna-ns.net"
                }
            ],
            "zone": "cliffsfundmere.com"
        },
        "cookies": {
            "cookies": [
                {
                    "name": "cf-c",
                    "http_only": true,
                    "same_site": "Lax"
                },
                {
                    "name": "__cf_clicked"
                },
                {
                    "name": "ph_phc_t6w4wzJE2sbz4ro8LmZZTssm5go3KD6mP7QsqcDQRSp6_posthog",
                    "secure": true,
                    "same_site": "Lax"
                }
            ]
        },
        "location": {
            "ip": "158.94.210.119",
            "asn": "202412",
            "org": "Omegatech LTD",
            "city": "Amsterdam",
            "country": "NL"
        },
        "ssl": {
            "issuer": "Let's Encrypt / YE1",
            "subject": "cliffsfundmere.com"
        },
        "dns": {
            "A": [
                "158.94.210.119"
            ],
            "NS": [
                "ns2.dyna-ns.net",
                "ns1.dyna-ns.net"
            ],
            "SOA": "{\"nsname\": \"ns1.dyna-ns.net\", \"hostmaster\": \"hostmaster.cliffsfundmere.com\", \"serial\": 2026083101, \"refresh\": 16384, \"retry\": 2048, \"expire\": 1209600, \"minttl\": 300}"
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "hsts": {
            "message": "Site does not serve any HSTS headers."
        },
        "http_security": {
            "xFrameOptions": false,
            "referrerPolicy": "same-origin",
            "xXSSProtection": false,
            "permissionsPolicy": false,
            "xContentTypeOptions": "nosniff",
            "contentSecurityPolicy": false,
            "strictTransportPolicy": false,
            "crossOriginOpenerPolicy": false,
            "crossOriginEmbedderPolicy": false,
            "crossOriginResourcePolicy": false
        },
        "get_ip": {
            "ip": "158.94.210.119",
            "family": 4
        },
        "redirects": {
            "chain": [
                "https://cliffsfundmere.com"
            ]
        },
        "linked_pages": {
            "internal_count": 29
        },
        "whois": {
            "registrar": "Dynadot Inc",
            "created": "2026-04-22T19:18:16Z",
            "updated": "2026-08-13T12:29:18Z",
            "expires": "2027-04-22T19:18:16Z",
            "status": [
                "clientTransferProhibited https://icann.org/epp"
            ],
            "nameservers": [
                "ns1.dyna-ns.net",
                "ns2.dyna-ns.net"
            ]
        },
        "headers": {
            "headers": {
                "content-type": "text/html; charset=utf-8",
                "x-content-type-options": "nosniff",
                "referrer-policy": "same-origin"
            }
        }
    }
}
```