# PhishDestroy domain threat record: copyalgo.org

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/copyalgo.org/
Machine-readable companion: https://phishdestroy.io/domain/copyalgo.org/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-24 21:40:53 UTC
- Last availability or vendor check: 2026-10-25 23:00:47 UTC
- Stored record updated: 2026-10-26 03:35:26 UTC
- VirusTotal detections in the stored snapshot: 17/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored infrastructure

- Observed IP address: 158.94.210.119
- Registrar in stored WHOIS data: Dynadot Inc
- Last stored HTTP status: 200
- Registration date in stored WHOIS data: 2026-07-07 12:02:14 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a16fde-9121-771b-b23a-851726b69d87/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/copyalgo.org
- Certificate Transparency search: https://crt.sh/?q=%25.copyalgo.org
- Web Archive lookup: https://web.archive.org/web/*/https://copyalgo.org/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
PhishDestroy listed copyalgo.org as a suspicious domain. The recorded page title was “قرارات ذكية بالذكاء الاصطناعي. تنفيذ سريع وموثوق. CopyAlgo.”. The domain was first seen by PhishDestroy on 2026-10-24 and returned an HTTP 200 response on that date.

How the scam works
The classification is based on multiple security‑engine detections that commonly flag sites used for phishing, fraud or malware distribution. Such pages often promise automated trading or AI‑driven market decisions to entice visitors into providing credentials or downloading malicious content. No concrete malicious behavior was observed on the captured page.

Evidence
VirusTotal scanned the domain on 2026-10-21 and reported 17 detections from 92 engines, including 13 malicious and 4 suspicious classifications such as phishing and malware. Google Safe Browsing checked on 2026-10-25 and returned no warning. urlscan.io captured the site on 2026-10-24; its engine verdict scored the URL as malicious with a score of 93, while the overall verdict was non‑malicious. OTX listed five pulses referencing the domain as of 2026-10-25. PhishDestroy’s internal blocklist marked the domain as blocked, and external blocklists showed zero entries on 2026-10-24.

Infrastructure
The domain was registered with Dynadot Inc on 2026-07-07, giving it an age of 109 days at the time of first observation. DNS records at that time pointed to the IP address 158.94.210.119, which is associated with Omegatech LTD in the Netherlands. The site presented a TLS 1.3 certificate from Let’s Encrypt, valid from 2026-09-01 to 2026-11-30. Cloudflare Radar flagged the domain for malware and scam risk, and DNSSEC was not enabled.

What to do
Visitors should avoid entering any credentials or downloading files from the site, and should change passwords on any accounts where the same credentials may have been reused. Administrators can add copyalgo.org to blocklists or firewall rules and monitor network logs for traffic to the recorded IP address. No wallet‑related actions are required because no wallet‑related activity was observed.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a16fde-9121-771b-b23a-851726b69d87/
Cloudflare Radar report: https://radar.cloudflare.com/scan/e085c895-7e0b-493f-8bab-72b024681d45
URLQuery report: https://urlquery.net/report/a9f837fa-ac66-40e4-97e2-71c96af90576
Stored capture screenshot: https://i.ibb.co/f5WySyv/3aa64fffff29.png
Cloudflare Radar screenshot (2026-10-24T21:44:07Z): https://screenshots.phishdestroy.io/cf/e085c895-7e0b-493f-8bab-72b024681d45.png
URLQuery screenshot: https://screenshots.phishdestroy.io/uq/a9f837fa-ac66-40e4-97e2-71c96af90576.png
VirusTotal report: https://www.virustotal.com/gui/domain/copyalgo.org
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=copyalgo.org
Archived copy: https://web.archive.org/web/20261024214127/https://copyalgo.org/
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-24 22:15:49 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/f5WySyv/3aa64fffff29.png
  Captured: 2026-10-24 21:44:39 UTC
- URLScan capture 1: https://screenshots.phishdestroy.io/01a16fde-9121-771b-b23a-851726b69d87.png
  Captured: 2026-10-24 21:44:39 UTC
  Source report: https://urlscan.io/result/01a16fde-9121-771b-b23a-851726b69d87/
- URLScan capture 2: https://urlscan.io/screenshots/01a0a9ad-7907-75dc-af16-7030476aa9e0.png
  Captured: 2026-10-24 21:40:53 UTC
  Source report: https://urlscan.io/result/01a16fde-9121-771b-b23a-851726b69d87/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/e085c895-7e0b-493f-8bab-72b024681d45.png
  Captured: 2026-10-24 21:44:07 UTC
  Source report: https://radar.cloudflare.com/scan/e085c895-7e0b-493f-8bab-72b024681d45
  SHA-256: c5eb32eb4237597aeccd8fee1cd502dce6147ac50ccda48b3ae4157e6594dd54
- URLQuery: https://screenshots.phishdestroy.io/uq/a9f837fa-ac66-40e4-97e2-71c96af90576.png
  Source report: https://urlquery.net/report/a9f837fa-ac66-40e4-97e2-71c96af90576
  SHA-256: cdea7742c9670b37712530ae6bb504faccbaee16b87315254752ae5c1d922c77
- URLScan · 2026-09-15: https://screenshots.phishdestroy.io/us/01a0a48d-dee5-7528-8140-f49f9a45e226.png
  Captured: 2026-09-15 10:12:42 UTC
  Source report: https://urlscan.io/result/01a0a48d-dee5-7528-8140-f49f9a45e226/
  SHA-256: a3eaf872d7a34932767c44e9bbfbc6962405b9b173be2e72ef30899dbcf5dc47
- URLScan · 2026-09-16: https://screenshots.phishdestroy.io/us/01a0a9ad-7907-75dc-af16-7030476aa9e0.png
  Captured: 2026-09-16 10:05:21 UTC
  Source report: https://urlscan.io/result/01a0a9ad-7907-75dc-af16-7030476aa9e0/
  SHA-256: e64359e12a57d119ba989211830ebeb927816fce10b2f3a548ab6ea6a1901b28

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-24T21:47:06Z",
        "uuid": "01a16fde-9121-771b-b23a-851726b69d87",
        "scanned_at": "2026-10-24T21:43:57Z",
        "final_url": "https://copyalgo.org/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://copyalgo.org/",
                "from": "http://copyalgo.org/",
                "status": 307
            }
        ],
        "ip": "158.94.210.119",
        "ips": [
            "158.94.210.119"
        ],
        "asns": [
            "202412"
        ],
        "countries": [
            "NL"
        ],
        "doc_hash": "d4e7fbe6de8b91ac3b65c552310ea8771ab25651a00e61f3c6d3029b05b6958d",
        "script_hashes": [
            "8aa5f8f647356dcd4fc5dbbe0efd5bc0e8da74026bc61e24636e2e1f5749b0ce"
        ],
        "globals": [
            "__dclq",
            "__dclOrig",
            "__dclFlush",
            "__smsCheckBeforeSubmit",
            "__isSmsEnabled",
            "__isSmsVerified",
            "intlTelInput"
        ],
        "cookies": [
            "connect.sid"
        ],
        "tls": {
            "san": [
                "copyalgo.org"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "YE1",
            "subject": "copyalgo.org",
            "protocol": "TLS 1.3",
            "valid_to": "2026-11-30T14:29:55Z",
            "valid_from": "2026-09-01T14:29:56Z"
        },
        "domain_age_days": 109,
        "apex_age_days": 109,
        "tls_age_days": 53,
        "tls_valid_days": 89,
        "requests": 5,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 93,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "content-type": "text/html; charset=utf-8",
            "x-content-type-options": "nosniff",
            "referrer-policy": "same-origin"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-24T21:47:08Z",
        "uuid": "e085c895-7e0b-493f-8bab-72b024681d45",
        "scanned_at": "2026-10-24T21:44:07Z",
        "final_url": "https://copyalgo.org/",
        "status": 200,
        "history": [
            {
                "url": "https://copyalgo.org/",
                "status": 200
            }
        ],
        "dom_hash": "5b04be327201bc38161c2d6347345b38b3ab600bfeb9bf10ffbea0927077c1a5",
        "doc_hash": "e8f34484bd4b1f0b361a7d17e8a9f8fdd822d7c99c0ab829f2a1269efe5cc749",
        "url_risks": [
            "Scam"
        ],
        "domain_risks": [
            "Malware",
            "Security threats",
            "Scam",
            "CIPA Filter",
            "CIPA"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "copyalgo.org",
                "type": "A",
                "value": "158.94.210.119"
            }
        ],
        "dnssec_valid": false,
        "ip": "158.94.210.119",
        "verdict": {
            "tags": [
                "malware"
            ],
            "malicious": true,
            "categories": [
                "malware"
            ]
        },
        "whois": {
            "registrar": "Dynadot Inc",
            "created": "2026-07-07T14:02:14Z",
            "updated": "2026-08-13T12:39:04Z",
            "expires": "2027-07-07T14:02:14Z",
            "nameservers": [
                "ns1.dyna-ns.net",
                "ns2.dyna-ns.net"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-24T22:14:01Z",
        "analysis_at": "2026-10-21T07:27:10Z",
        "stats": {
            "timeout": 0,
            "harmless": 44,
            "malicious": 13,
            "suspicious": 4,
            "undetected": 31
        },
        "detections": {
            "CRDF": "malicious",
            "DNS8": "suspicious",
            "ESET": "suspicious",
            "VIPRE": "phishing",
            "G-Data": "phishing",
            "Lionic": "phishing",
            "Sophos": "phishing",
            "CyRadar": "phishing",
            "Fortinet": "spam",
            "Netcraft": "malicious",
            "SOCRadar": "phishing",
            "Kaspersky": "phishing",
            "Seclookup": "malicious",
            "Gridinsoft": "phishing",
            "BitDefender": "phishing",
            "alphaMountain.ai": "spam",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "categories": {
            "Sophos": "phishing and fraud",
            "alphaMountain.ai": "Spam, Suspicious (alphaMountain.ai)"
        },
        "registrar": "Dynadot Inc",
        "created": "2026-07-07T14:02:14Z",
        "expires": "2027-07-07T14:02:14Z",
        "updated": "2026-08-13T12:39:04Z",
        "first_seen": "2026-07-07T14:35:43Z",
        "dns": [
            {
                "ttl": 300,
                "type": "NS",
                "value": "ns1.dyna-ns.net"
            },
            {
                "ttl": 300,
                "type": "SOA",
                "rname": "hostmaster.copyalgo.org",
                "value": "ns1.dyna-ns.net"
            },
            {
                "ttl": 24,
                "type": "A",
                "value": "158.94.210.119"
            },
            {
                "ttl": 300,
                "type": "NS",
                "value": "ns2.dyna-ns.net"
            }
        ],
        "dns_at": "2026-10-21T07:27:27Z",
        "jarm": "40d40d40d00000000043d43d00043d6aff5ab0f4fc31897186312c9e639319",
        "cert": {
            "san": [
                "copyalgo.org"
            ],
            "issuer": "Let's Encrypt / YE1",
            "serial": "5fa23f2aaac17e184e235bc9c12ba05f2a5",
            "sha256": "6145a1e1e4158f841e42d0bb726088a16aeddda93e0035b639765e91cc923799",
            "subject": "copyalgo.org",
            "valid_to": "2026-11-30T14:29:55Z",
            "valid_from": "2026-09-01T14:29:56Z"
        },
        "whois": {
            "registrar": "Dynadot Inc",
            "registrar_iana_id": "472",
            "registrar_url": "http://www.dynadot.com",
            "created": "2026-07-07T14:02:14Z",
            "updated": "2026-08-13T12:39:04Z",
            "expires": "2027-07-07T14:02:14Z",
            "status": [
                "clientTransferProhibited"
            ],
            "nameservers": [
                "ns1.dyna-ns.net",
                "ns2.dyna-ns.net"
            ],
            "dnssec": "unsigned"
        },
        "rdap": {
            "status": [
                "transfer prohibited"
            ],
            "events": {
                "expiration": "2027-07-07T14:02:14Z",
                "last changed": "2026-09-01T10:42:06Z",
                "registration": "2026-07-07T14:02:14Z",
                "registrar expiration": "2027-07-07T14:02:14Z",
                "last update of RDAP database": "2026-10-15T08:06:58Z"
            }
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-24T21:47:25Z",
        "mail_config": {
            "spf_lookups": 0
        },
        "caa_records": {
            "domain": "copyalgo.org"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_by": [
                "CloudFlare Family"
            ],
            "blocked_count": 1
        },
        "robots_txt": {
            "agents": [
                "*"
            ],
            "present": true,
            "sitemaps": [
                "https://copyalgo.org/sitemap.xml"
            ]
        },
        "sitemap": {
            "present": true,
            "url_count": 5
        },
        "social_tags": {
            "title": "قرارات ذكية بالذكاء الاصطناعي. تنفيذ سريع وموثوق. CopyAlgo.",
            "robots": "index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1",
            "description": "تحليل السوق بالذكاء الاصطناعي & تنفيذ الصفقات الآلي — CopyAlgo يساعد المتداولين النشطين على تحسين محافظهم الرقمية وتتبع تحركات الأسواق العالمية بدقة عالية.",
            "canonicalUrl": "https://copyalgo.org/"
        },
        "trackers": {
            "requests": 55,
            "trackers": [
                {
                    "name": "Cloudflare",
                    "company": "Cloudflare",
                    "country": "US",
                    "category": "Hosting",
                    "requests": 1
                },
                {
                    "name": "jsDelivr",
                    "company": "jsDelivr",
                    "category": "Hosting",
                    "requests": 4
                }
            ]
        },
        "mixed_content": {
            "third_party_scripts": 0
        },
        "status": {
            "up": true,
            "code": 200,
            "timings": {
                "dns": 5050,
                "tls": 80,
                "wait": 83,
                "connect": 73,
                "download": 145
            },
            "response_ms": 5431
        },
        "carbon": {
            "bytes": 67137,
            "co2_grams": 0.0025,
            "cleaner_than": 31
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "162.159.24.5",
                    "host": "ns2.dyna-ns.net"
                },
                {
                    "ip": "162.159.26.92",
                    "host": "ns1.dyna-ns.net"
                }
            ],
            "zone": "copyalgo.org"
        },
        "cookies": {
            "cookies": [
                {
                    "name": "cf-c",
                    "http_only": true,
                    "same_site": "Lax"
                },
                {
                    "name": "__cf_clicked"
                },
                {
                    "name": "ph_phc_t6w4wzJE2sbz4ro8LmZZTssm5go3KD6mP7QsqcDQRSp6_posthog",
                    "secure": true,
                    "same_site": "Lax"
                }
            ]
        },
        "location": {
            "ip": "158.94.210.119",
            "asn": "202412",
            "org": "Omegatech LTD",
            "city": "Amsterdam",
            "country": "NL"
        },
        "ssl": {
            "issuer": "Let's Encrypt / YE1",
            "subject": "copyalgo.org"
        },
        "dns": {
            "A": [
                "158.94.210.119"
            ],
            "NS": [
                "ns1.dyna-ns.net",
                "ns2.dyna-ns.net"
            ],
            "SOA": "{\"nsname\": \"ns1.dyna-ns.net\", \"hostmaster\": \"hostmaster.copyalgo.org\", \"serial\": 2026090101, \"refresh\": 16384, \"retry\": 2048, \"expire\": 1209600, \"minttl\": 300}"
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "hsts": {
            "message": "Site does not serve any HSTS headers."
        },
        "http_security": {
            "xFrameOptions": false,
            "referrerPolicy": "same-origin",
            "xXSSProtection": false,
            "permissionsPolicy": false,
            "xContentTypeOptions": "nosniff",
            "contentSecurityPolicy": false,
            "strictTransportPolicy": false,
            "crossOriginOpenerPolicy": false,
            "crossOriginEmbedderPolicy": false,
            "crossOriginResourcePolicy": false
        },
        "get_ip": {
            "ip": "158.94.210.119",
            "family": 4
        },
        "redirects": {
            "chain": [
                "https://copyalgo.org"
            ]
        },
        "linked_pages": {
            "internal_count": 27
        },
        "whois": {
            "registrar": "Dynadot Inc",
            "created": "2026-07-07T14:02:14Z",
            "updated": "2026-08-13T12:39:04Z",
            "expires": "2027-07-07T14:02:14Z",
            "status": [
                "clientTransferProhibited https://icann.org/epp"
            ],
            "nameservers": [
                "ns1.dyna-ns.net",
                "ns2.dyna-ns.net"
            ]
        },
        "headers": {
            "headers": {
                "content-type": "text/html; charset=utf-8",
                "x-content-type-options": "nosniff",
                "referrer-policy": "same-origin"
            }
        }
    }
}
```