# PhishDestroy domain threat record: dzekralvu-france.sbs Content language: English Canonical HTML report: https://phishdestroy.io/domain/dzekralvu-france.sbs/ Machine-readable companion: https://phishdestroy.io/domain/dzekralvu-france.sbs/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-10-25 12:08:51 UTC - Last availability or vendor check: 2026-10-25 12:32:21 UTC - Stored record updated: 2026-10-25 15:27:28 UTC - VirusTotal detections in the stored snapshot: 17/92 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: no stored flag ## Stored classification - Targeted brand: ethereum ## Stored infrastructure - Observed IP address: 188.114.97.3 - Registrar in stored WHOIS data: Dynadot Inc - Last stored HTTP status: 200 - Registration date in stored WHOIS data: 2026-09-01 09:16:50 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a1730b-e1ef-72f9-9e3b-0fb9546f0cb8/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/dzekralvu-france.sbs - Certificate Transparency search: https://crt.sh/?q=%25.dzekralvu-france.sbs - Web Archive lookup: https://web.archive.org/web/*/https://dzekralvu-france.sbs/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview PhishDestroy listed dzekralvu-france.sbs as a suspicious domain based on aggregated security signals. The recorded page title advertises a crypto platform for France in 2026, but no specific fraudulent behavior was observed. The domain was first seen by PhishDestroy on 2026-10-25 and returned an HTTP 200 response on that date. How the scam works A suspicious‑domain label indicates that the site could be used to impersonate legitimate services, lure users into providing credentials, or distribute malicious content. Because the page content did not reveal a credential form, wallet request, or malware download, the exact technique cannot be confirmed for this site. Evidence VirusTotal scanned the domain on 2026-10-18 and reported 17 detections from 92 engines, with 14 marked malicious and 3 suspicious. Google Safe Browsing checked on 2026-10-25 and did not flag the site. OTX listed three pulses referencing the domain as of 2026-10-25. Cloudflare Radar flagged the domain as phishing and malware on 2026-10-25, and urlscan.io recorded a malicious engine score of 100 but an overall non‑malicious verdict on the same day. Infrastructure The domain was registered with Dynadot Inc on 2026-09-01, giving it an age of 54 days at first sighting. The recorded IP address was 188.114.97.3 (and IPv6 2a06:98c1:3121::3) served through Cloudflare’s network. The TLS certificate, issued by Google Trust Services, was valid from 2026-09-01 to 2026-11-30. DNSSEC was not enabled and the authoritative nameservers were eoin.ns.cloudflare.com and paris.ns.cloudflare.com. What to do Visitors should avoid entering any credentials or personal information on the site; if they have already done so, they should change affected passwords and monitor accounts for unauthorized activity. Security teams should block the exact domain dzekralvu-france.sbs and monitor network logs for connections to its recorded IP addresses. Sharing this indicator with relevant threat‑intel platforms can help broader detection. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a1730b-e1ef-72f9-9e3b-0fb9546f0cb8/ Cloudflare Radar report: https://radar.cloudflare.com/scan/22da3831-9120-4d7b-9a10-0f781f29d410 Stored capture screenshot: https://i.ibb.co/Df2PbbZP/5afa9e4ff4bb.png Cloudflare Radar screenshot (2026-10-25T12:11:13Z): https://screenshots.phishdestroy.io/cf/22da3831-9120-4d7b-9a10-0f781f29d410.png URLScan screenshot (2026-09-17T21:15:40Z): https://screenshots.phishdestroy.io/us/01a0b139-719a-71ea-94af-61222853291a.png URLScan capture report: https://urlscan.io/result/01a0b139-719a-71ea-94af-61222853291a/ VirusTotal report: https://www.virustotal.com/gui/domain/dzekralvu-france.sbs Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=dzekralvu-france.sbs Archived copy: https://web.archive.org/web/20261025121100/https://dzekralvu-france.sbs/ Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-25 12:41:14 UTC ## Stored page captures - Primary capture: https://i.ibb.co/Df2PbbZP/5afa9e4ff4bb.png Captured: 2026-10-25 12:32:21 UTC - URLScan capture 1: https://urlscan.io/screenshots/01a1730b-e1ef-72f9-9e3b-0fb9546f0cb8.png Captured: 2026-10-25 12:32:21 UTC Source report: https://urlscan.io/result/01a1730b-e1ef-72f9-9e3b-0fb9546f0cb8/ - URLScan capture 2: https://screenshots.phishdestroy.io/01a0b3ef-7799-73e8-a290-87c5202ff8fb.png Captured: 2026-10-25 12:08:51 UTC Source report: https://urlscan.io/result/01a1730b-e1ef-72f9-9e3b-0fb9546f0cb8/ - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/22da3831-9120-4d7b-9a10-0f781f29d410.png Captured: 2026-10-25 12:11:13 UTC Source report: https://radar.cloudflare.com/scan/22da3831-9120-4d7b-9a10-0f781f29d410 SHA-256: b94a700092ec570d3a80cd1dc93de9594cd9552c6036787c736d691eb6f63580 - URLQuery: https://screenshots.phishdestroy.io/uq/948233ba-5ada-40f0-ba0d-00ea0a730fa3.png Source report: https://urlquery.net/report/948233ba-5ada-40f0-ba0d-00ea0a730fa3 SHA-256: d61b9a93504475de13fef2571c465395cb8620a267c62e8d67ca61ee86b68cdc - URLScan · 2026-09-17: https://screenshots.phishdestroy.io/us/01a0b139-719a-71ea-94af-61222853291a.png Captured: 2026-09-17 21:15:40 UTC Source report: https://urlscan.io/result/01a0b139-719a-71ea-94af-61222853291a/ SHA-256: 00666103db9c534064f3e0d7a520efd963f4b9ff1b9b0e8adbb7763cc33f6c44 - URLScan · 2026-09-18: https://screenshots.phishdestroy.io/us/01a0b3ef-7799-73e8-a290-87c5202ff8fb.png Captured: 2026-09-18 09:53:39 UTC Source report: https://urlscan.io/result/01a0b3ef-7799-73e8-a290-87c5202ff8fb/ SHA-256: 05ee5e7c3bc83599748225d057a6cac48820e4d9ae181d905190b3049bacac1b - URLScan · 2026-10-25: https://screenshots.phishdestroy.io/us/01a17312-af60-76da-8238-3f8e4dd462c9.png Captured: 2026-10-25 12:39:35 UTC Source report: https://urlscan.io/result/01a17312-af60-76da-8238-3f8e4dd462c9/ SHA-256: e01f24f5c1ccb263aa7c6703441a3b1be978746b395d3059e54dab7ce7a039e2 ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-25T12:40:48Z", "uuid": "01a1730b-e1ef-72f9-9e3b-0fb9546f0cb8", "scanned_at": "2026-10-25T12:32:08Z", "final_url": "https://dzekralvu-france.sbs/", "status": 200, "redirected": "https-only", "redirects": [ { "to": "https://dzekralvu-france.sbs/", "from": "http://dzekralvu-france.sbs/", "status": 307 } ], "ip": "2a06:98c1:3121::3", "domains": [ "cdn.jsdelivr.net", "cdnjs.cloudflare.com", "modernroomdesigns.com", "fonts.gstatic.com", "fonts.googleapis.com" ], "ips": [ "104.17.208.5", "172.67.222.66", "142.250.154.94", "188.114.97.3", "104.17.24.14", "2606:4700::6811:d005", "2a00:1450:4001:c15::5f", "2a06:98c1:3121::3" ], "asns": [ "13335", "15169" ], "countries": [ "US", "DE" ], "doc_hash": "00a0b5eee0665270d2de980f75b9313f5b9a8029f69d7e04f350519a64d9f5c9", "script_hashes": [ "4082edfaa0f4837bfa6ea5de436af8c395b7f6c65db26b87d2978143aab01885" ], "globals": [ "polylang", "_language", "_loader", "GEO_API_URL", "_phone_error", "_form_unknown_error", "__offerChatWidgetMounted", "intlTelInput" ], "cookies": [ "_subid", "csrftoken" ], "tls": { "san": [ "dzekralvu-france.sbs", "*.dzekralvu-france.sbs" ], "cipher": "AES_128_GCM", "issuer": "WE1", "subject": "dzekralvu-france.sbs", "protocol": "TLS 1.3", "valid_to": "2026-11-30T11:27:13Z", "valid_from": "2026-09-01T10:29:49Z" }, "domain_age_days": 54, "apex_age_days": 54, "tls_age_days": 54, "tls_valid_days": 90, "requests": 13, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 100, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "cloudflare", "content-type": "text/html; charset=utf-8", "x-frame-options": "DENY", "x-content-type-options": "nosniff", "referrer-policy": "same-origin", "cross-origin-opener-policy": "same-origin" } }, "cf": { "v": 1, "fetched_at": "2026-10-25T12:12:42Z", "uuid": "22da3831-9120-4d7b-9a10-0f781f29d410", "scanned_at": "2026-10-25T12:11:13Z", "final_url": "https://dzekralvu-france.sbs/", "status": 200, "history": [ { "url": "https://dzekralvu-france.sbs/", "status": 200 } ], "dom_hash": "07b45216939690a9cb143b76c6de93886d6892956d24588956b6eedccbd977ec", "doc_hash": "d008f1881f4be45505c761294450fcaae29c5f8302dc5e12d080961b4f68aaad", "phishing_v2": [ "phishing" ], "domain_risks": [ "Malware", "Security threats", "CIPA Filter", "CIPA" ], "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "dzekralvu-france.sbs", "type": "A", "value": "188.114.97.0" }, { "name": "dzekralvu-france.sbs", "type": "A", "value": "188.114.96.0" }, { "name": "dzekralvu-france.sbs", "type": "AAAA", "value": "2a06:98c1:3120::" }, { "name": "dzekralvu-france.sbs", "type": "AAAA", "value": "2a06:98c1:3121::" } ], "dnssec_valid": false, "ip": "188.114.97.0", "verdict": { "tags": [ "malware" ], "malicious": true, "categories": [ "malware" ] }, "whois": { "registrar": "Dynadot Inc", "created": "2026-09-01T11:16:50Z", "updated": "2026-09-06T11:17:07Z", "expires": "2027-09-01T23:59:59Z", "nameservers": [ "eoin.ns.cloudflare.com", "paris.ns.cloudflare.com" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-25T12:40:25Z", "analysis_at": "2026-10-18T04:42:50Z", "stats": { "timeout": 0, "harmless": 43, "malicious": 14, "suspicious": 3, "undetected": 32 }, "detections": { "CRDF": "malicious", "DNS8": "suspicious", "ESET": "suspicious", "VIPRE": "phishing", "G-Data": "phishing", "Lionic": "phishing", "Sophos": "phishing", "CyRadar": "phishing", "Webroot": "malicious", "Fortinet": "malware", "SOCRadar": "phishing", "Kaspersky": "phishing", "Seclookup": "malicious", "Gridinsoft": "suspicious", "BitDefender": "phishing", "alphaMountain.ai": "phishing", "Forcepoint ThreatSeeker": "phishing" }, "reputation": 0, "tags": [ "dga" ], "categories": { "alphaMountain.ai": "Phishing, Newly Registered (alphaMountain.ai)" }, "registrar": "Dynadot Inc", "created": "2026-09-01T11:16:50Z", "expires": "2027-09-01T23:59:59Z", "updated": "2026-09-06T11:17:07Z", "first_seen": "2026-09-01T12:22:58Z", "dns": [ { "ttl": 300, "type": "AAAA", "value": "2606:4700:3033::ac43:d9e0" }, { "ttl": 300, "type": "A", "value": "104.21.78.76" }, { "ttl": 300, "type": "A", "value": "172.67.217.224" }, { "ttl": 21600, "type": "NS", "value": "eoin.ns.cloudflare.com" }, { "ttl": 300, "type": "AAAA", "value": "2606:4700:3030::6815:4e4c" }, { "ttl": 1800, "type": "SOA", "rname": "dns.cloudflare.com", "value": "eoin.ns.cloudflare.com" }, { "ttl": 21600, "type": "NS", "value": "paris.ns.cloudflare.com" } ], "dns_at": "2026-10-18T04:48:10Z", "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c", "cert": { "san": [ "dzekralvu-france.sbs", "*.dzekralvu-france.sbs" ], "issuer": "Google Trust Services / WE1", "serial": "32ac9647f3009f8c0ec1bd35e4c39669", "sha256": "c3ada920101c9a360f0d11d551c16fd50e63437abdb3b5136fe9a325bc9359af", "subject": "dzekralvu-france.sbs", "valid_to": "2026-11-30T11:27:13Z", "valid_from": "2026-09-01T10:29:49Z" }, "whois": { "registrar": "Dynadot Inc", "registrar_iana_id": "472", "registrar_url": "http://www.dynadot.com", "created": "2026-09-01T11:16:50Z", "updated": "2026-09-06T11:17:07Z", "expires": "2027-09-01T23:59:59Z", "status": [ "clientTransferProhibited", "serverTransferProhibited" ], "nameservers": [ "eoin.ns.cloudflare.com", "paris.ns.cloudflare.com" ], "dnssec": "unsigned" } }, "webcheck": { "v": 1, "fetched_at": "2026-10-25T12:12:57Z", "mail_config": { "spf_lookups": 0 }, "caa_records": { "domain": "dzekralvu-france.sbs" }, "block_lists": { "resolvers": 12, "blocked_by": [ "CloudFlare Family" ], "blocked_count": 1 }, "archives": { "last": "2026-10-25T12:11:00Z", "first": "2026-10-25T12:11:00Z", "changes": 0, "days_archived": 1, "avg_page_bytes": 19364 }, "robots_txt": { "agents": [ "*" ], "present": true, "sitemaps": [ "https://dzekralvu-france.sbs/sitemap.xml" ] }, "sitemap": { "present": true, "url_count": 10 }, "social_tags": { "ogUrl": "https://dzekralvu-france.sbs/", "title": "Dzekralvu™: Votre plateforme crypto officielle en France - 2026", "ogType": "website", "robots": "index, follow, max-image-preview:large, max-snippet:-1, max-video-preview:-1", "ogImage": "https://dzekralvu-france.sbs/static/template_18/zeongrow/image.png", "ogTitle": "Dzekralvu™: Votre plateforme crypto officielle en France - 2026", "ogSiteName": "Dzekralvu", "themeColor": "#f4f6fb", "description": "Découvrez Dzekralvu™, l'Officiel site dédié à la crypto en France en 2026. Profitez d'une plateforme de trading sécurisée et fiable pour vos investissements.", "twitterCard": "summary_large_image", "canonicalUrl": "https://dzekralvu-france.sbs/", "ogDescription": "Découvrez Dzekralvu™, l'Officiel site dédié à la crypto en France en 2026. Profitez d'une plateforme de trading sécurisée et fiable pour vos investissements." }, "trackers": { "requests": 10, "trackers": [ { "name": "Cloudflare", "company": "Cloudflare", "country": "US", "category": "Hosting", "requests": 1 }, { "name": "Google Fonts", "company": "Google", "country": "US", "category": "Hosting", "requests": 1 }, { "name": "Google Static", "company": "Google", "country": "US", "category": "Hosting", "requests": 1 }, { "name": "jsDelivr", "company": "jsDelivr", "category": "Hosting", "requests": 3 } ] }, "mixed_content": { "no_sri": [ "https://cdn.jsdelivr.net/npm/intl-tel-input@23.0.12/build/js/intlTelInput.min.js" ], "third_party_scripts": 1 }, "status": { "up": true, "code": 200, "timings": { "dns": 7, "tls": 30, "wait": 242, "connect": 11, "download": 14 }, "response_ms": 304 }, "tls_connection": { "alpn": "h2", "cipher": "TLS_AES_256_GCM_SHA384", "protocol": "TLSv1.3", "versions": [ "TLSv1", "TLSv1.1", "TLSv1.2", "TLSv1.3" ], "authorized": true, "forward_secrecy": true }, "ports": { "open": [ 80, 443, 8080 ] }, "carbon": { "bytes": 75689, "co2_grams": 0.0028, "cleaner_than": 28 }, "dns_server": { "ns": [ { "ip": "172.64.35.86", "host": "eoin.ns.cloudflare.com" }, { "ip": "172.64.34.113", "host": "paris.ns.cloudflare.com" } ], "zone": "dzekralvu-france.sbs" }, "cookies": { "cookies": [ { "name": "_subid", "session": true }, { "name": "csrftoken", "same_site": "Lax" } ] }, "location": { "ip": "2a06:98c1:3121::3", "asn": "13335", "org": "CloudFLARENET-EU", "city": "London", "country": "GB" }, "ssl": { "issuer": "Google Trust Services / WE1", "subject": "dzekralvu-france.sbs" }, "dns": { "A": [ "188.114.97.3", "188.114.96.3" ], "NS": [ "paris.ns.cloudflare.com", "eoin.ns.cloudflare.com" ], "SOA": "{\"nsname\": \"eoin.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2415143466, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}", "AAAA": [ "2a06:98c1:3121::3", "2a06:98c1:3120::3" ] }, "dnssec": { "ds": false, "rrsig": false, "dnskey": false }, "hsts": { "message": "Site does not serve any HSTS headers." }, "http_security": { "xFrameOptions": "DENY", "referrerPolicy": "same-origin", "xXSSProtection": false, "permissionsPolicy": false, "xContentTypeOptions": "nosniff", "contentSecurityPolicy": false, "strictTransportPolicy": false, "crossOriginOpenerPolicy": "same-origin", "crossOriginEmbedderPolicy": false, "crossOriginResourcePolicy": false }, "firewall": { "waf": "Cloudflare", "has_waf": true }, "get_ip": { "ip": "2a06:98c1:3120::3", "family": 6 }, "redirects": { "chain": [ "https://dzekralvu-france.sbs" ] }, "linked_pages": { "internal_count": 10 }, "whois": { "registrar": "Dynadot Inc", "created": "2026-09-01T11:16:50Z", "updated": "2026-09-06T11:17:07Z", "expires": "2027-09-01T23:59:59Z", "status": [ "serverTransferProhibited https://icann.org/epp", "clientTransferProhibited https://icann.org/epp" ], "nameservers": [ "eoin.ns.cloudflare.com", "paris.ns.cloudflare.com" ] }, "headers": { "headers": { "server": "cloudflare", "content-type": "text/html; charset=utf-8", "x-frame-options": "DENY", "x-content-type-options": "nosniff", "referrer-policy": "same-origin", "cross-origin-opener-policy": "same-origin" } } } } ```