# PhishDestroy domain threat record: crestvaluetronapp.digital Content language: English Canonical HTML report: https://phishdestroy.io/domain/crestvaluetronapp.digital/ Machine-readable companion: https://phishdestroy.io/domain/crestvaluetronapp.digital/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-10-25 01:50:02 UTC - Last availability or vendor check: 2026-10-25 12:22:20 UTC - Stored record updated: 2026-10-25 15:21:43 UTC - VirusTotal detections in the stored snapshot: 16/92 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: no stored flag ## Stored classification - Targeted brand: ups ## Stored infrastructure - Observed IP address: 185.62.58.129 - Registrar in stored WHOIS data: NICENIC INTERNATIONAL GROUP CO., LIMITED - Last stored HTTP status: 200 - Registration date in stored WHOIS data: 2026-03-09 13:35:46 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a17087-5a17-755b-9f93-af5ad047273f/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/crestvaluetronapp.digital - Certificate Transparency search: https://crt.sh/?q=%25.crestvaluetronapp.digital - Web Archive lookup: https://web.archive.org/web/*/https://crestvaluetronapp.digital/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview PhishDestroy listed crestvaluetronapp.digital as suspicious based on multiple security‑vendor detections. The domain was first seen by PhishDestroy on 2026-10-25; the recorded page title on that date was “Crestvaluetronapp” and described AI‑assisted automation for execution workflows and trading tooling. An HTTP GET on 2026-10-25 returned status code 200. How the scam works The current evidence does not reveal a concrete malicious behavior; the listing reflects aggregated detections rather than observed phishing, malware delivery, or credential harvesting on the page. Consequently PhishDestroy can only classify the site as suspicious without attributing a specific scam mechanism. Evidence VirusTotal analysis on 2026-10-20 reported 12 malicious and 4 suspicious detections out of 92 engines, with vendors such as BitDefender, Fortinet and G‑Data marking it malicious. Google Safe Browsing checked on 2026-10-25 did not flag the URL, while urlscan.io captured the site on 2026-10-25 and its machine‑learning engine scored it 98 and labeled it malicious despite an overall non‑malicious verdict. Cloudflare Radar scan on 2026-10-25 classified the domain as malicious under the malware category; OTX listed five pulses referencing the domain; PhishDestroy’s internal blocklist contains the domain, and external blocklists (including Spamhaus) showed no listing. Infrastructure The domain was registered on 2026-03-09 through NICENIC INTERNATIONAL GROUP CO., LIMITED. At the time of capture it resolved to IP 185.62.58.129, which was associated with Snel.com B.V. in the Netherlands and served via Cloudflare DNS (clyde.ns.cloudflare.com, dahlia.ns.cloudflare.com). The site presented a TLS 1.3 certificate issued by ZeroSSL ECC DV SSL CA 2, valid from 2026-10-01 to 2026-12-30. What to do Visitors should avoid entering credentials, downloading files, or granting any permissions on this site; if credentials were submitted, change them immediately and monitor the associated accounts. Organizations can block the domain at the perimeter and review logs for any connections to 185.62.58.129. No wallet‑specific remediation is required because no wallet‑related activity was observed. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a17087-5a17-755b-9f93-af5ad047273f/ Cloudflare Radar report: https://radar.cloudflare.com/scan/89761e5f-68ff-4d60-9688-20c736d170a1 Stored capture screenshot: https://urlscan.io/screenshots/01a17087-5a17-755b-9f93-af5ad047273f.png Cloudflare Radar screenshot (2026-10-25T02:29:34Z): https://screenshots.phishdestroy.io/cf/89761e5f-68ff-4d60-9688-20c736d170a1.png URLScan screenshot (2026-10-25T00:48:13Z): https://screenshots.phishdestroy.io/us/01a17087-61e1-73ac-b5ea-28af0f6d2f3b.png URLScan capture report: https://urlscan.io/result/01a17087-61e1-73ac-b5ea-28af0f6d2f3b/ VirusTotal report: https://www.virustotal.com/gui/domain/crestvaluetronapp.digital Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=crestvaluetronapp.digital Archived copy: https://web.archive.org/web/20261025005108/https://crestvaluetronapp.digital/ Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-25 05:05:14 UTC ## Stored page captures - Primary capture: https://urlscan.io/screenshots/01a17087-5a17-755b-9f93-af5ad047273f.png Captured: 2026-10-25 01:50:02 UTC - URLScan capture: https://screenshots.phishdestroy.io/01a17087-5a17-755b-9f93-af5ad047273f.png Captured: 2026-10-25 01:50:02 UTC Source report: https://urlscan.io/result/01a17087-5a17-755b-9f93-af5ad047273f/ - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/89761e5f-68ff-4d60-9688-20c736d170a1.png Captured: 2026-10-25 02:29:34 UTC Source report: https://radar.cloudflare.com/scan/89761e5f-68ff-4d60-9688-20c736d170a1 SHA-256: 9b4463b73362bc3b644aadca90c1526eed1937243edbcb5cd61f2bb249aebb96 - URLScan · 2026-10-25: https://screenshots.phishdestroy.io/us/01a17087-61e1-73ac-b5ea-28af0f6d2f3b.png Captured: 2026-10-25 00:48:13 UTC Source report: https://urlscan.io/result/01a17087-61e1-73ac-b5ea-28af0f6d2f3b/ SHA-256: d24bf65d95c0ce78e91288ca0ae9f8f7c5a75681601de9c7fd53ac200a535f4d ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-25T01:03:40Z", "uuid": "01a17087-5a17-755b-9f93-af5ad047273f", "scanned_at": "2026-10-25T00:48:31Z", "final_url": "https://crestvaluetronapp.digital/", "status": 200, "redirected": "https-only", "redirects": [ { "to": "https://crestvaluetronapp.digital/", "from": "http://crestvaluetronapp.digital/", "status": 307 } ], "ip": "185.62.58.129", "ptr": "static-129-58-62-185.hosted-by-snel.com", "domains": [ "cdn.jsdelivr.net", "challenges.cloudflare.com", "fonts.gstatic.com", "fonts.googleapis.com", "www.cloudflare.com" ], "ips": [ "104.18.95.41", "104.18.94.41", "104.16.123.96", "192.178.155.94", "104.17.207.5", "142.251.179.95", "185.62.58.129" ], "asns": [ "13335", "15169", "62370" ], "countries": [ "US", "NL" ], "doc_hash": "d94c683b033824c332758e16d307e4f419dfc8591df726eb374a9bd210ed87bf", "script_hashes": [ "68353da50a0abf760c5eaded6d7826045945ecc070f7cf9b9369eec457ec23d4" ], "globals": [ "toggleTermsPopup", "intlTelInput", "__TS_SITEKEY", "__tsGet", "__tsReset", "__tsNeedsClick", "__tsShow", "__lgBS", "__visitorCountry", "ClientJS", "turnstile" ], "storage_keys": [ "t_cfp" ], "tls": { "san": [ "crestvaluetronapp.digital" ], "cipher": "AES_128_GCM", "issuer": "ZeroSSL ECC DV SSL CA 2", "subject": "crestvaluetronapp.digital", "protocol": "TLS 1.3", "valid_to": "2026-12-30T23:59:59Z", "valid_from": "2026-10-01T00:00:00Z" }, "domain_age_days": 229, "apex_age_days": 229, "tls_age_days": 24, "tls_valid_days": 90, "requests": 21, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 98, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "content-type": "text/html; charset=utf-8", "referrer-policy": "no-referrer-when-downgrade" } }, "cf": { "v": 1, "fetched_at": "2026-10-25T02:30:57Z", "uuid": "89761e5f-68ff-4d60-9688-20c736d170a1", "scanned_at": "2026-10-25T02:29:34Z", "final_url": "https://crestvaluetronapp.digital/", "status": 200, "history": [ { "url": "https://crestvaluetronapp.digital/", "status": 200 } ], "dom_hash": "46d69b0a553bba483c4a1c83a868f17ddc227296c7996fcd06f8edd3f1efde06", "doc_hash": "d94c683b033824c332758e16d307e4f419dfc8591df726eb374a9bd210ed87bf", "phishing_v2": [ "phishing" ], "domain_risks": [ "Malware", "Security threats", "CIPA Filter", "CIPA" ], "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "crestvaluetronapp.digital", "type": "A", "value": "185.62.58.129" } ], "dnssec_valid": false, "ip": "185.62.58.129", "verdict": { "tags": [ "malware" ], "malicious": true, "categories": [ "malware" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-25T05:01:48Z", "analysis_at": "2026-10-20T15:52:34Z", "stats": { "timeout": 0, "harmless": 44, "malicious": 12, "suspicious": 4, "undetected": 32 }, "detections": { "CRDF": "malicious", "DNS8": "suspicious", "ESET": "suspicious", "VIPRE": "phishing", "G-Data": "phishing", "Lionic": "phishing", "Sophos": "phishing", "Webroot": "malicious", "Fortinet": "phishing", "SOCRadar": "phishing", "Kaspersky": "phishing", "Seclookup": "malicious", "Gridinsoft": "suspicious", "BitDefender": "phishing", "alphaMountain.ai": "spam", "Forcepoint ThreatSeeker": "phishing" }, "reputation": 0, "created": "2026-03-09T00:00:00Z", "updated": "2026-03-09T00:00:00Z", "first_seen": "2026-03-09T18:53:11Z", "dns": [ { "ttl": 21600, "type": "NS", "value": "dahlia.ns.cloudflare.com" }, { "ttl": 300, "type": "A", "value": "185.62.58.129" }, { "ttl": 1800, "type": "SOA", "rname": "dns.cloudflare.com", "value": "clyde.ns.cloudflare.com" }, { "ttl": 21600, "type": "NS", "value": "clyde.ns.cloudflare.com" } ], "dns_at": "2026-10-20T15:58:08Z", "jarm": "40d40d40d00000000043d43d00043d6aff5ab0f4fc31897186312c9e639319", "cert": { "san": [ "crestvaluetronapp.digital" ], "issuer": "ZeroSSL GmbH / ZeroSSL ECC DV SSL CA 2", "serial": "93902b7f946cb7c10be85e67c6fca956", "sha256": "d3e76032fd4a25d55aaa913c7f6a115ef141a2625f77f2d4f076ea5286f5b582", "subject": "crestvaluetronapp.digital", "valid_to": "2026-12-30T23:59:59Z", "valid_from": "2026-10-01T00:00:00Z" }, "rdap": { "status": [ "client delete prohibited", "client transfer prohibited" ], "events": { "expiration": "2027-03-08T16:00:00Z", "registration": "2026-03-08T16:00:00Z", "registrar expiration": "2027-03-08T16:00:00Z", "last update of RDAP database": "2026-03-08T16:00:00Z" }, "registrar": "NICENIC INTERNATIONAL GROUP CO., LIMITED", "registrar_iana_id": "3765" } }, "webcheck": { "v": 1, "fetched_at": "2026-10-25T01:25:02Z", "mail_config": { "spf_lookups": 0 }, "caa_records": { "domain": "crestvaluetronapp.digital" }, "block_lists": { "resolvers": 12, "blocked_by": [ "CloudFlare Family" ], "blocked_count": 1 }, "archives": { "last": "2026-10-25T00:51:08Z", "first": "2026-10-25T00:51:08Z", "changes": 0, "days_archived": 1, "avg_page_bytes": 13477 }, "robots_txt": { "agents": [ "*" ], "present": true, "sitemaps": [ "https://crestvaluetronapp.digital/sitemap.xml" ] }, "sitemap": { "present": true, "url_count": 175 }, "social_tags": { "title": "Crestvaluetronapp", "robots": "index, follow", "description": "Crestvaluetronapp delivers AI-assisted automation for execution workflows, risk governance, and enterprise-grade trading tooling powered by intelligent bots.", "canonicalUrl": "https://crestvaluetronapp.digital/" }, "trackers": { "requests": 16, "trackers": [ { "name": "Cloudflare", "company": "Cloudflare", "country": "US", "category": "Hosting", "requests": 2 }, { "name": "Google Fonts", "company": "Google", "country": "US", "category": "Hosting", "requests": 2 }, { "name": "Google Static", "company": "Google", "country": "US", "category": "Hosting", "requests": 3 }, { "name": "jsDelivr", "company": "jsDelivr", "category": "Hosting", "requests": 3 } ] }, "mixed_content": { "no_sri": [ "https://cdn.jsdelivr.net/npm/intl-tel-input@23/build/js/intlTelInput.min.js" ], "third_party_scripts": 1 }, "status": { "up": true, "code": 200, "timings": { "dns": 2, "tls": 32, "wait": 17, "connect": 31, "download": 80 }, "response_ms": 162 }, "tls_connection": { "alpn": "h2", "cipher": "TLS_AES_128_GCM_SHA256", "protocol": "TLSv1.3", "versions": [ "TLSv1.2", "TLSv1.3" ], "authorized": true, "ocsp_stapled": true, "forward_secrecy": true }, "ports": { "open": [ 80, 443 ] }, "carbon": { "bytes": 49731, "co2_grams": 0.0018, "cleaner_than": 37 }, "dns_server": { "ns": [ { "ip": "108.162.192.89", "host": "dahlia.ns.cloudflare.com" }, { "ip": "173.245.59.91", "host": "clyde.ns.cloudflare.com" } ], "zone": "crestvaluetronapp.digital" }, "location": { "ip": "185.62.58.129", "asn": "62370", "org": "Snel.com B.V.", "city": "Schiedam", "country": "NL" }, "ssl": { "issuer": "ZeroSSL GmbH / ZeroSSL ECC DV SSL CA 2", "subject": "crestvaluetronapp.digital" }, "dns": { "A": [ "185.62.58.129" ], "NS": [ "clyde.ns.cloudflare.com", "dahlia.ns.cloudflare.com" ], "SOA": "{\"nsname\": \"clyde.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2417600140, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}" }, "dnssec": { "ds": false, "rrsig": false, "dnskey": false }, "hsts": { "message": "Site does not serve any HSTS headers." }, "http_security": { "xFrameOptions": false, "referrerPolicy": "no-referrer-when-downgrade", "xXSSProtection": false, "permissionsPolicy": false, "xContentTypeOptions": false, "contentSecurityPolicy": false, "strictTransportPolicy": false, "crossOriginOpenerPolicy": false, "crossOriginEmbedderPolicy": false, "crossOriginResourcePolicy": false }, "get_ip": { "ip": "185.62.58.129", "family": 4 }, "redirects": { "chain": [ "https://crestvaluetronapp.digital" ] }, "linked_pages": { "internal_count": 45 }, "headers": { "headers": { "content-type": "text/html; charset=utf-8", "referrer-policy": "no-referrer-when-downgrade" } } } } ```