# PhishDestroy domain threat record: dominantainvest.com.ua

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/dominantainvest.com.ua/
Machine-readable companion: https://phishdestroy.io/domain/dominantainvest.com.ua/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-10 22:18:32 UTC
- Last availability or vendor check: 2026-10-23 10:35:08 UTC
- Stored record updated: 2026-10-23 18:21:13 UTC
- VirusTotal detections in the stored snapshot: 6/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored infrastructure

- Observed IP address: 194.180.10.31
- Registrar in stored WHOIS data: ТОВ "Інтернет Інвест"
- Last stored HTTP status: 200
- Registration date (registry RDAP, dominantainvest.com.ua): 2019-03-20 10:21:42 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a127e4-7b40-71de-be88-b32016d5f4a7/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/dominantainvest.com.ua
- Certificate Transparency search: https://crt.sh/?q=%25.dominantainvest.com.ua
- Web Archive lookup: https://web.archive.org/web/*/https://dominantainvest.com.ua/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
dominantainvest.com.ua presents itself as Dominanta Invest, a renovation and construction contractor in Chernivtsi. Its Ukrainian page title advertises repair and building work in that city. PhishDestroy classifies the site as an impersonation phishing page and first flagged it on 2026-10-11. It was still online and serving content on 2026-10-19. The page title shows an ordinary local construction business, while our classification is impersonation phishing.

How the scam works
An impersonation page borrows the name and look of a real business so that visitors trust it with money or personal details. For a building and renovation brand, the usual pressure points are estimates, contracts and upfront payments. A victim may be asked to pay an advance for materials, a booking deposit or an inspection fee. They may also be asked to submit identity, contact or card details through an enquiry form. Money sent this way goes to the operator rather than to any contractor, and the work never begins.

Evidence
On 2026-10-12, six of 92 VirusTotal engines flagged the domain: alphaMountain.ai, Forcepoint ThreatSeeker, Gridinsoft, Seclookup, SOCRadar and Sophos. That is a minority verdict, but it comes from six unrelated vendors that reached the same conclusion independently. The domain also appears in 34 AlienVault OTX threat pulses, which shows that other researchers have tracked it. Among public blocklists, only PhishDestroy currently lists it.

Infrastructure
The domain was registered on 2019-03-20 through the Ukrainian registrar ТОВ "Інтернет Інвест". That is more than seven years before PhishDestroy detected it, so this is not a freshly registered throwaway domain. A long-lived domain carries more credibility with visitors and with some filters. The site is hosted in Ukraine on the HOSTPRO LAB LLC network. Its Let's Encrypt certificate means the browser shows a padlock, but that only confirms the connection is encrypted, not that the business is genuine.

What to do
Do not pay deposits, advances or fees requested through this site, and do not sign anything it sends you. If you have already paid, contact your bank or card issuer at once to dispute the transaction, and report the case to the Ukrainian cyber police. If you entered card details, ask your bank to reissue the card. If you entered a password or any personal information, change that password and watch for follow-up calls or messages that use your data. Before hiring any contractor, verify the company through official registries and contact details you find independently. Security teams should block the domain at DNS and proxy level and check logs for users who submitted forms to it.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a127e4-7b40-71de-be88-b32016d5f4a7/
VirusTotal report: https://www.virustotal.com/gui/domain/dominantainvest.com.ua
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=dominantainvest.com.ua
Archived copy: https://web.archive.org/web/20261010221957/https://dominantainvest.com.ua/
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 09:27:26 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/SDVb0hvv/577367eb3009.png
  Captured: 2026-10-10 22:18:32 UTC
- URLScan capture: https://screenshots.phishdestroy.io/01a127e4-7b40-71de-be88-b32016d5f4a7.png
  Captured: 2026-10-10 22:18:32 UTC
  Source report: https://urlscan.io/result/01a127e4-7b40-71de-be88-b32016d5f4a7/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/b03ac7d1-bce2-4bc5-ba1d-b4218ecd4ebb.png
  Captured: 2026-10-12 11:34:44 UTC
  Source report: https://radar.cloudflare.com/scan/b03ac7d1-bce2-4bc5-ba1d-b4218ecd4ebb
  SHA-256: a3f6f860805d7c19a2ac6bb5972239ea122ea5ce2bceb0f24b47b2b3034b4e6e
- URLQuery: https://screenshots.phishdestroy.io/uq/1c72660f-b7ce-4db6-8782-87613de19e10.png
  Source report: https://urlquery.net/report/1c72660f-b7ce-4db6-8782-87613de19e10
  SHA-256: 21adb77a8d6c71076a5a40bfbb45052cc90938a0a64ff583e172868816d31e96
- URLScan · 2026-10-10: https://screenshots.phishdestroy.io/us/01a127bd-2889-74e5-8709-874a4411762f.png
  Captured: 2026-10-10 21:34:44 UTC
  Source report: https://urlscan.io/result/01a127bd-2889-74e5-8709-874a4411762f/
  SHA-256: b6e6343d55dccb48ca452b62a0bdee6145c762fdb6d22ec04f92de45e409f16a
- URLScan · 2026-10-10: https://screenshots.phishdestroy.io/us/01a127da-ea91-71ea-9535-0f930ee158dc.png
  Captured: 2026-10-10 22:07:20 UTC
  Source report: https://urlscan.io/result/01a127da-ea91-71ea-9535-0f930ee158dc/
  SHA-256: b6e6343d55dccb48ca452b62a0bdee6145c762fdb6d22ec04f92de45e409f16a

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-20T18:33:32Z",
        "uuid": "01a127e4-7b40-71de-be88-b32016d5f4a7",
        "scanned_at": "2026-10-10T22:17:38Z",
        "final_url": "https://dominantainvest.com.ua/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://dominantainvest.com.ua/",
                "from": "http://dominantainvest.com.ua/",
                "status": 307
            }
        ],
        "ip": "194.180.10.31",
        "ptr": "skm354.hostsila.org",
        "domains": [
            "maps.googleapis.com",
            "fonts.gstatic.com",
            "maps.gstatic.com",
            "www.google-analytics.com",
            "www.google.com",
            "maps.google.com",
            "fonts.googleapis.com",
            "www.googletagmanager.com"
        ],
        "ips": [
            "172.217.119.4",
            "142.251.14.94",
            "142.251.110.101",
            "142.251.13.94",
            "142.251.150.119",
            "142.251.110.100",
            "142.251.14.95",
            "142.251.110.97",
            "194.180.10.31"
        ],
        "asns": [
            "15169",
            "196645"
        ],
        "countries": [
            "US",
            "UA"
        ],
        "link_domains": [
            "www.facebook.com",
            "www.instagram.com"
        ],
        "social": [
            "https://www.facebook.com/dominanta.invest.7",
            "https://www.instagram.com/dominanta.in"
        ],
        "doc_hash": "590c459e8e9035f08ff751962fefb9b62740182e98efb2c76f4a0fe94e065c5b",
        "script_hashes": [
            "23eb134e746f1e5c265c5d33d045af48c444617adaa281fb993d6070bdc04c9f",
            "19d1a0ae5cfcadd8a4f467f3be1d283308a0f72804578754278589c372f1ca47",
            "1335a0d587b65743db0803cb446054203c7195239a6dd0939eb9b35037b02806",
            "afacce23cb4feaaaef37997f8439819d8f827df4951f3ff02704c9f16fb7f53a",
            "9810aee7e6d57d8cceaa96322b88e6df46710194689ae12b284149148cabc2f3",
            "533e264cc615ee4601da8d2c1dee4a8987319e53d4d7162272f067fbbf250020",
            "ff4bd34aa98a0214833619d3d751838db015722dfbbec15cd14dadc66cd67869",
            "51b3ee4b981dbbd0e2ea54b2fafd15f7ef6bfebb165cb4a6fdd7cd8e6f343024",
            "eab347af732bc8b6dff914e54ff3e5dec6a84e8aa8315c2f9b64c17978f80fae",
            "21e7807a82534521cd9606996f4b6a54583fed61fed16779343048ffc05499e0"
        ],
        "globals": [
            "em_version",
            "em_track_user",
            "em_no_track_reason",
            "disableStrs",
            "__gtagTrackerIsOptedOut",
            "__gtagTrackerOptout",
            "gaOptout",
            "__gtagDataLayer",
            "__gtagTracker",
            "dataLayer",
            "ExactMetricsDualTracker",
            "gtag",
            "__gaTracker",
            "_wpemojiSettings",
            "ExactMetrics",
            "ExactMetricsObject",
            "exactmetrics_frontend",
            "jQuery",
            "EvEmitter",
            "imagesLoaded",
            "elementorModules",
            "Sticky",
            "ElementorProFrontendConfig",
            "elementorProFrontend",
            "DialogsManager",
            "Waypoint",
            "Swiper",
            "elementorFrontendConfig",
            "elementorFrontend",
            "waypointContextKey",
            "google_tag_data",
            "google_tag_manager",
            "GoogleAnalyticsObject",
            "ga",
            "gaplugins",
            "gaGlobal",
            "gaData"
        ],
        "cookies": [
            "_ga",
            "_gid",
            "_gat_gtag_UA_139628207_1"
        ],
        "storage_keys": [
            "elementor"
        ],
        "tls": {
            "san": [
                "dominantainvest.com.ua",
                "mail.dominantainvest.com.ua",
                "www.dominantainvest.com.ua"
            ],
            "cipher": "AES_256_GCM",
            "issuer": "YR2",
            "subject": "dominantainvest.com.ua",
            "protocol": "TLS 1.3",
            "valid_to": "2026-12-26T02:28:19Z",
            "valid_from": "2026-09-27T02:28:20Z"
        },
        "domain_age_days": 2728,
        "apex_age_days": 2728,
        "tls_age_days": 13,
        "tls_valid_days": 89,
        "requests": 68,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 45,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "nginx",
            "content-type": "text/html; charset=UTF-8",
            "x-powered-by": "PHP/7.4.33"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-20T18:45:02Z",
        "uuid": "b03ac7d1-bce2-4bc5-ba1d-b4218ecd4ebb",
        "scanned_at": "2026-10-12T11:34:44Z",
        "final_url": "https://dominantainvest.com.ua/",
        "status": 200,
        "history": [
            {
                "url": "https://dominantainvest.com.ua/",
                "status": 200
            }
        ],
        "dom_hash": "aaf41f5bd23f092517c7b64319c83d0151e1712f81adfbf793aed056975a2ef4",
        "doc_hash": "4bcc3e02f4286161569522eb205b91271cf80924cdd940240fab7f489f8983c6",
        "domain_risks": [
            "Business",
            "Business & Economy"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "dominantainvest.com.ua",
                "type": "A",
                "value": "194.180.10.31"
            }
        ],
        "dnssec_valid": false,
        "ip": "194.180.10.31",
        "whois": {
            "registrar": "ua.imena",
            "created": "2019-03-20T10:21:42Z",
            "updated": "2026-04-02T08:06:05Z",
            "expires": "2027-03-20T10:21:42Z",
            "nameservers": [
                "master.hostsila.com",
                "slave.hostsila.net"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-21T02:38:42Z",
        "analysis_at": "2026-10-16T10:47:48Z",
        "stats": {
            "timeout": 0,
            "harmless": 51,
            "malicious": 4,
            "suspicious": 3,
            "undetected": 34
        },
        "detections": {
            "Sophos": "malware",
            "SOCRadar": "phishing",
            "URLQuery": "suspicious",
            "Seclookup": "malicious",
            "Gridinsoft": "suspicious",
            "alphaMountain.ai": "malicious",
            "Forcepoint ThreatSeeker": "suspicious"
        },
        "reputation": 0,
        "categories": {
            "Sophos": "spyware and malware",
            "BitDefender": "porn",
            "alphaMountain.ai": "Malicious (alphaMountain.ai)",
            "Forcepoint ThreatSeeker": "compromised websites"
        },
        "popularity": {
            "Alexa": 528362,
            "Statvoo": 528362,
            "Majestic": 125835
        },
        "registrar": "ua.imena",
        "expires": "2027-03-20T10:21:42Z",
        "first_seen": "2023-10-05T12:48:51Z",
        "dns": [
            {
                "ttl": 21600,
                "type": "NS",
                "value": "slave3.hostsila.net"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "slave.hostsila.net"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "master.hostsila.com"
            },
            {
                "ttl": 14400,
                "type": "MX",
                "value": "dominantainvest.com.ua",
                "priority": 0
            },
            {
                "ttl": 14400,
                "type": "A",
                "value": "194.180.10.31"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "slave2.hostsila.com"
            },
            {
                "ttl": 21600,
                "type": "SOA",
                "rname": "avk74.ukr.net",
                "value": "master.hostsila.com"
            }
        ],
        "dns_at": "2026-10-16T10:48:03Z",
        "jarm": "29d29d15d29d29d00042d42d000000df133019600a83abfb096ff3e86cd79d",
        "cert": {
            "san": [
                "dominantainvest.com.ua",
                "mail.dominantainvest.com.ua",
                "www.dominantainvest.com.ua"
            ],
            "issuer": "Let's Encrypt / YR2",
            "serial": "61e7524c89625627390b2a49c90c635a6e4",
            "sha256": "6cea3359bb5dd4be6471ff1ae311b1e3e942fd03ff3300d82728ccec3148bc34",
            "subject": "dominantainvest.com.ua",
            "valid_to": "2026-12-26T02:28:19Z",
            "valid_from": "2026-09-27T02:28:20Z"
        },
        "whois": {
            "registrar": "ua.imena"
        }
    }
}
```