# PhishDestroy domain threat record: czistyengine.shop Content language: English Canonical HTML report: https://phishdestroy.io/domain/czistyengine.shop/ Machine-readable companion: https://phishdestroy.io/domain/czistyengine.shop/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-10-25 04:12:20 UTC - Last availability or vendor check: 2026-10-25 12:22:26 UTC - Stored record updated: 2026-10-25 12:22:26 UTC - VirusTotal detections in the stored snapshot: 18/92 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: no stored flag ## Stored infrastructure - Observed IP address: 185.62.58.129 - Registrar in stored WHOIS data: REGISTRAR_NOT_FOUND - Last stored HTTP status: 200 ## Evidence links - URLScan report: https://urlscan.io/result/01a17140-67da-72bb-8ec5-b9af1deaed9e/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/czistyengine.shop - Certificate Transparency search: https://crt.sh/?q=%25.czistyengine.shop - Web Archive lookup: https://web.archive.org/web/*/https://czistyengine.shop/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview PhishDestroy’s automated assessment classifies czistyengine.shop as a fake crypto exchange. The recorded page title reads “Czisty | Premium AI Trading Platform | Official Website”. The domain was first seen by PhishDestroy on 2026-10-25 and returned HTTP 200 at that time. How the scam works Fake crypto exchanges typically present a professional‑looking trading interface, promise high returns, and ask users to deposit cryptocurrency. After deposits are made, the operators disappear or refuse withdrawals, resulting in loss of funds. No specific deposit flow was observed on this page, but the classification reflects this common risk category. Evidence VirusTotal scanned the domain on 2026-10-24 and reported 18 detections out of 92 engines, including 15 malicious and 3 suspicious vendors such as BitDefender, ESET and Kaspersky. Google Safe Browsing checked on 2026-10-25 and did not flag the site. urlscan.io captured the page on 2026-10-25 and marked it as not malicious. External blocklists showed no entries, while PhishDestroy’s internal blocklist contains the domain. OTX listed five pulses mentioning the domain as of 2026-10-25. Infrastructure The recorded IP address is 185.62.58.129, hosted by Snel Snel.com B.V. in the Netherlands. TLS was issued by ZeroSSL GmbH (ZeroSSL ECC DV SSL CA 2) and was valid from 2026-09-19 to 2026-12-18. The domain uses Cloudflare nameservers mike.ns.cloudflare.com and nia.ns.cloudflare.com. What to do Do not enter credentials, private keys or wallet approvals on this site; if you have already done so, change passwords and revoke any granted permissions. Monitor your crypto wallets for unauthorized activity and consider moving funds to a new secure wallet. Security teams should block czistyengine.shop at the network perimeter and log any connections to 185.62.58.129 for further investigation. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a17140-67da-72bb-8ec5-b9af1deaed9e/ Cloudflare Radar report: https://radar.cloudflare.com/scan/551876c4-4184-4e04-ab96-238cdd48da51 URLQuery report: https://urlquery.net/report/663b4fac-bd42-45cd-b3b6-9995649f35d1 Stored capture screenshot: https://urlscan.io/screenshots/01a17140-67da-72bb-8ec5-b9af1deaed9e.png VirusTotal report: https://www.virustotal.com/gui/domain/czistyengine.shop Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=czistyengine.shop Archived copy: https://web.archive.org/web/20261025041351/https://czistyengine.shop/ Revoke token approvals: https://revoke.cash/ Report crypto fraud (Chainabuse): https://www.chainabuse.com/report Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-25 05:26:20 UTC ## Stored page captures - Primary capture: https://urlscan.io/screenshots/01a17140-67da-72bb-8ec5-b9af1deaed9e.png Captured: 2026-10-25 04:12:20 UTC - URLScan capture: https://screenshots.phishdestroy.io/01a17140-67da-72bb-8ec5-b9af1deaed9e.png Captured: 2026-10-25 04:12:20 UTC Source report: https://urlscan.io/result/01a17140-67da-72bb-8ec5-b9af1deaed9e/ - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/551876c4-4184-4e04-ab96-238cdd48da51.png Captured: 2026-10-25 04:46:54 UTC Source report: https://radar.cloudflare.com/scan/551876c4-4184-4e04-ab96-238cdd48da51 SHA-256: b300e463b3c1487946ef8ec1895f2e509e950836904e52942a641abb4750946c - URLQuery: https://screenshots.phishdestroy.io/uq/663b4fac-bd42-45cd-b3b6-9995649f35d1.png Source report: https://urlquery.net/report/663b4fac-bd42-45cd-b3b6-9995649f35d1 SHA-256: 86957b6d73540922ff1cc86f7fa6f84b5c50a5023fb02fc99d3d54b7d3e41fd0 - URLScan · 2026-10-25: https://screenshots.phishdestroy.io/us/01a17153-9085-7556-9d58-22324d023d19.png Captured: 2026-10-25 04:31:15 UTC Source report: https://urlscan.io/result/01a17153-9085-7556-9d58-22324d023d19/ SHA-256: 719aac51fef3df552e35986094a6a84bc80864299f83d599432dbe82fe6d93d7 ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-25T05:45:50Z", "uuid": "01a17140-67da-72bb-8ec5-b9af1deaed9e", "scanned_at": "2026-10-25T04:10:20Z", "final_url": "https://czistyengine.shop/", "status": 200, "redirected": "https-only", "redirects": [ { "to": "https://czistyengine.shop/", "from": "http://czistyengine.shop/", "status": 307 } ], "ip": "185.62.58.129", "ptr": "static-129-58-62-185.hosted-by-snel.com", "domains": [ "cdn.jsdelivr.net", "challenges.cloudflare.com", "fonts.gstatic.com", "www.cloudflare.com", "myip.wtf", "fonts.googleapis.com" ], "ips": [ "104.18.94.41", "142.251.14.94", "104.18.95.41", "104.16.124.96", "151.101.65.229", "38.246.113.38", "142.251.20.95", "185.62.58.129" ], "asns": [ "13335", "15169", "54113", "26042", "62370" ], "countries": [ "US", "NL" ], "doc_hash": "9dcf066c40b6be8dfea68ed53c6580981c064cfd498eeb640575325108609ec7", "script_hashes": [ "24c4c0f1718ba26d627792aae83e71a6bc7df86838d3c9364acf497007b38fa8" ], "globals": [ "geoCountry", "geoPrefix", "countryPhoneCodes", "toggleTermsPopup", "intlTelInput", "__TS_SITEKEY", "__tsGet", "__tsReset", "__tsNeedsClick", "__tsShow", "__lgBS", "ClientJS", "__visitorCountry", "turnstile" ], "storage_keys": [ "t_cfp" ], "tls": { "san": [ "czistyengine.shop" ], "cipher": "AES_128_GCM", "issuer": "ZeroSSL ECC DV SSL CA 2", "subject": "czistyengine.shop", "protocol": "TLS 1.3", "valid_to": "2026-12-18T23:59:59Z", "valid_from": "2026-09-19T00:00:00Z" }, "domain_age_days": 110, "apex_age_days": 110, "tls_age_days": 36, "tls_valid_days": 90, "requests": 22, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 97, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "content-type": "text/html; charset=utf-8", "referrer-policy": "no-referrer-when-downgrade" } }, "cf": { "v": 1, "fetched_at": "2026-10-25T05:45:54Z", "uuid": "551876c4-4184-4e04-ab96-238cdd48da51", "scanned_at": "2026-10-25T04:46:54Z", "final_url": "https://czistyengine.shop/", "status": 200, "history": [ { "url": "https://czistyengine.shop/", "status": 200 } ], "dom_hash": "d582c828819cc63033346a36fb7aea5231848e577f22a54eccb8bea82a9beb5b", "doc_hash": "0b2089f97febe36ce0fe6c4ec75652707cbabb6913610c3774161233ed978491", "domain_risks": [ "Malware", "Security threats", "CIPA Filter", "CIPA" ], "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "czistyengine.shop", "type": "A", "value": "185.62.58.129" } ], "dnssec_valid": false, "ip": "185.62.58.129", "verdict": { "tags": [ "malware" ], "malicious": true, "categories": [ "malware" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-25T05:46:03Z", "analysis_at": "2026-10-23T23:18:20Z", "stats": { "timeout": 0, "harmless": 41, "malicious": 15, "suspicious": 3, "undetected": 33 }, "detections": { "CRDF": "malicious", "DNS8": "suspicious", "ESET": "suspicious", "VIPRE": "phishing", "G-Data": "phishing", "Lionic": "phishing", "Sophos": "phishing", "CyRadar": "phishing", "Webroot": "malicious", "Fortinet": "phishing", "SOCRadar": "phishing", "Kaspersky": "phishing", "Seclookup": "malicious", "Gridinsoft": "suspicious", "BitDefender": "phishing", "Chong Lua Dao": "malicious", "alphaMountain.ai": "phishing", "Forcepoint ThreatSeeker": "phishing" }, "reputation": 0, "categories": { "Sophos": "phishing and fraud", "Webroot": "Phishing and Other Frauds", "alphaMountain.ai": "Phishing (alphaMountain.ai)", "Forcepoint ThreatSeeker": "phishing and other frauds" }, "first_seen": "2026-07-06T10:28:10Z", "dns": [ { "ttl": 300, "type": "A", "value": "185.62.58.129" }, { "ttl": 1800, "type": "SOA", "rname": "dns.cloudflare.com", "value": "mike.ns.cloudflare.com" }, { "ttl": 21600, "type": "NS", "value": "mike.ns.cloudflare.com" }, { "ttl": 21600, "type": "NS", "value": "nia.ns.cloudflare.com" } ], "dns_at": "2026-10-23T23:20:31Z", "jarm": "40d40d40d00000000043d43d00043d6aff5ab0f4fc31897186312c9e639319", "cert": { "san": [ "czistyengine.shop" ], "issuer": "ZeroSSL GmbH / ZeroSSL ECC DV SSL CA 2", "serial": "d9c3a88f66fabfc0e7a1d6440bc10da9", "sha256": "fef9ca13865917bb667d551a9952ff89240b5d995bf77dad4c884e30018e2782", "subject": "czistyengine.shop", "valid_to": "2026-12-18T23:59:59Z", "valid_from": "2026-09-19T00:00:00Z" } }, "webcheck": { "v": 1, "fetched_at": "2026-10-25T06:06:23Z", "mail_config": { "spf_lookups": 0 }, "caa_records": { "domain": "czistyengine.shop" }, "block_lists": { "resolvers": 12, "blocked_by": [ "CloudFlare Family" ], "blocked_count": 1 }, "archives": { "last": "2026-10-25T04:13:51Z", "first": "2026-10-25T04:13:51Z", "changes": 0, "days_archived": 1, "avg_page_bytes": 12597 }, "robots_txt": { "agents": [ "*" ], "present": true, "sitemaps": [ "https://czistyengine.shop/sitemap.xml" ] }, "sitemap": { "present": true, "url_count": 140 }, "social_tags": { "title": "Czisty | Premium AI Trading Platform | Official Website", "robots": "index, follow", "description": "Czisty delivers orchestrated AI-driven trading automation, providing configurable execution controls, live monitoring dashboards, and robust operational governance for premium automated trading.", "canonicalUrl": "https://czistyengine.shop/" }, "trackers": { "requests": 19, "trackers": [ { "name": "Cloudflare", "company": "Cloudflare", "country": "US", "category": "Hosting", "requests": 3 }, { "name": "Google Fonts", "company": "Google", "country": "US", "category": "Hosting", "requests": 1 }, { "name": "Google Static", "company": "Google", "country": "US", "category": "Hosting", "requests": 2 }, { "name": "jsDelivr", "company": "jsDelivr", "category": "Hosting", "requests": 3 } ] }, "mixed_content": { "no_sri": [ "https://cdn.jsdelivr.net/npm/intl-tel-input@23/build/js/intlTelInput.min.js" ], "third_party_scripts": 1 }, "status": { "up": true, "code": 200, "timings": { "dns": 9, "tls": 21, "wait": 27, "connect": 18, "download": 17 }, "response_ms": 92 }, "tls_connection": { "alpn": "h2", "cipher": "TLS_AES_128_GCM_SHA256", "protocol": "TLSv1.3", "versions": [ "TLSv1.2", "TLSv1.3" ], "authorized": true, "ocsp_stapled": true, "forward_secrecy": true }, "ports": { "open": [ 80, 443 ] }, "carbon": { "bytes": 43985, "co2_grams": 0.0016, "cleaner_than": 40 }, "dns_server": { "ns": [ { "ip": "173.245.58.210", "host": "nia.ns.cloudflare.com" }, { "ip": "172.64.35.63", "host": "mike.ns.cloudflare.com" } ], "zone": "czistyengine.shop" }, "location": { "ip": "185.62.58.129", "asn": "62370", "org": "Snel.com B.V.", "city": "Schiedam", "country": "NL" }, "ssl": { "issuer": "ZeroSSL GmbH / ZeroSSL ECC DV SSL CA 2", "subject": "czistyengine.shop" }, "dns": { "A": [ "185.62.58.129" ], "NS": [ "nia.ns.cloudflare.com", "mike.ns.cloudflare.com" ], "SOA": "{\"nsname\": \"mike.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2414116588, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}" }, "dnssec": { "ds": false, "rrsig": false, "dnskey": false }, "hsts": { "message": "Site does not serve any HSTS headers." }, "http_security": { "xFrameOptions": false, "referrerPolicy": "no-referrer-when-downgrade", "xXSSProtection": false, "permissionsPolicy": false, "xContentTypeOptions": false, "contentSecurityPolicy": false, "strictTransportPolicy": false, "crossOriginOpenerPolicy": false, "crossOriginEmbedderPolicy": false, "crossOriginResourcePolicy": false }, "get_ip": { "ip": "185.62.58.129", "family": 4 }, "redirects": { "chain": [ "https://czistyengine.shop" ] }, "linked_pages": { "internal_count": 38 }, "headers": { "headers": { "content-type": "text/html; charset=utf-8", "referrer-policy": "no-referrer-when-downgrade" } } } } ```