# PhishDestroy domain threat record: eliteforexfund.com

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/eliteforexfund.com/
Machine-readable companion: https://phishdestroy.io/domain/eliteforexfund.com/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-25 16:03:39 UTC
- Last availability or vendor check: 2026-10-25 16:14:49 UTC
- Stored record updated: 2026-10-25 19:30:50 UTC
- VirusTotal detections in the stored snapshot: 15/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: celer

## Stored infrastructure

- Observed IP address: 158.94.210.119
- Registrar in stored WHOIS data: Dynadot Inc
- Last stored HTTP status: 200
- Registration date in stored WHOIS data: 2026-07-22 09:54:41 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a173d6-03bb-76df-80af-b196b3b31fc4/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/eliteforexfund.com
- Certificate Transparency search: https://crt.sh/?q=%25.eliteforexfund.com
- Web Archive lookup: https://web.archive.org/web/*/https://eliteforexfund.com/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
PhishDestroy has placed eliteforexfund.com on its internal blocklist as a suspicious domain. The domain was first observed by PhishDestroy on 2026-10-25, 95 days after its registration on 2026-07-22. An HTTP request on that date returned a 200 status code and the recorded page title advertises an AI‑powered trading platform. Google Safe Browsing did not flag the site and no external blocklists reported it at the time of checking.

How the scam works
The available detections indicate that the site is associated with typical phishing or malware distribution tactics, but no specific malicious behavior was observed on the page itself. Such suspicious domains often lure visitors with financial or trading promises to harvest credentials, deliver malicious payloads, or redirect to further fraudulent services. Without concrete evidence of a particular scheme, the risk remains a general threat of credential or malware exposure.

Evidence
VirusTotal scanned the domain on 2026-10-23 and reported 15 detections from 92 engines, including 12 malicious and 3 suspicious labels from vendors such as BitDefender, G‑Data, and Fortinet. Google Safe Browsing checked on 2026-10-25 and returned no flag. urlscan.io captured the site on 2026-10-25; its engine analysis gave a malicious score of 87, though the overall verdict was not malicious. Cloudflare Radar on 2026-10-25 marked the URL as malicious with a malware category, and OTX listed six pulses referencing the domain.

Infrastructure
The domain was registered with Dynadot Inc on 2026-07-22 and was recorded at IP address 158.94.210.119, belonging to ASN 202412 (Omegatech LTD) in Amsterdam, NL. TLS was provided by Let’s Encrypt, valid from 2026-09-01 to 2026-11-30, and DNSSEC was not enabled. The recorded DNS showed a single A record and the page was delivered through Cloudflare's CDN.

What to do
Visitors should avoid entering any credentials or downloading files from the site; if credentials were entered, change passwords immediately and run anti‑malware scans. Defenders should block eliteforexfund.com at the network perimeter and monitor for connections to its IP address, adding the domain to internal blocklists. Continue to watch for updates from security vendors, as the current evidence reflects a suspicious classification rather than confirmed active compromise.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a173d6-03bb-76df-80af-b196b3b31fc4/
Cloudflare Radar report: https://radar.cloudflare.com/scan/fce5f018-8d63-42ee-8c3d-64c85e6311af
URLQuery report: https://urlquery.net/report/03e323c7-320f-4b2e-8fac-7ea92f8ba1a3
Stored capture screenshot: https://urlscan.io/screenshots/01a173d6-03bb-76df-80af-b196b3b31fc4.png
Cloudflare Radar screenshot (2026-10-25T16:10:45Z): https://screenshots.phishdestroy.io/cf/fce5f018-8d63-42ee-8c3d-64c85e6311af.png
URLQuery screenshot: https://screenshots.phishdestroy.io/uq/03e323c7-320f-4b2e-8fac-7ea92f8ba1a3.png
URLScan screenshot (2026-08-18T01:45:31Z): https://screenshots.phishdestroy.io/us/01a0128b-747c-70d0-9167-e9c35d23391c.png
URLScan capture report: https://urlscan.io/result/01a0128b-747c-70d0-9167-e9c35d23391c/
URLScan screenshot (2026-08-18T05:51:27Z): https://screenshots.phishdestroy.io/us/01a0136c-9c10-7733-a032-d89eb262a8a8.png
URLScan capture report: https://urlscan.io/result/01a0136c-9c10-7733-a032-d89eb262a8a8/
VirusTotal report: https://www.virustotal.com/gui/domain/eliteforexfund.com
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=eliteforexfund.com
Archived copy: https://web.archive.org/web/20261025160459/https://eliteforexfund.com/
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-25 16:47:29 UTC

## Stored page captures

- Primary capture: https://urlscan.io/screenshots/01a173d6-03bb-76df-80af-b196b3b31fc4.png
  Captured: 2026-10-25 16:14:49 UTC
- URLScan capture 1: https://screenshots.phishdestroy.io/01a173d6-03bb-76df-80af-b196b3b31fc4.png
  Captured: 2026-10-25 16:14:49 UTC
  Source report: https://urlscan.io/result/01a173d6-03bb-76df-80af-b196b3b31fc4/
- URLScan capture 2: https://urlscan.io/screenshots/01a01893-abd6-770e-8f33-739ac4441bbe.png
  Captured: 2026-10-25 16:03:39 UTC
  Source report: https://urlscan.io/result/01a173d6-03bb-76df-80af-b196b3b31fc4/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/fce5f018-8d63-42ee-8c3d-64c85e6311af.png
  Captured: 2026-10-25 16:10:45 UTC
  Source report: https://radar.cloudflare.com/scan/fce5f018-8d63-42ee-8c3d-64c85e6311af
  SHA-256: de27552e905669bf2e92bd4230cc4f2613c49d7177fc9bf0ee52509311d78de8
- URLQuery: https://screenshots.phishdestroy.io/uq/03e323c7-320f-4b2e-8fac-7ea92f8ba1a3.png
  Source report: https://urlquery.net/report/03e323c7-320f-4b2e-8fac-7ea92f8ba1a3
  SHA-256: 5a1c8a5f4efe220ce067463640b87a59425eba7d265ad0e063189073a18b97b9
- URLScan · 2026-08-18: https://screenshots.phishdestroy.io/us/01a0128b-747c-70d0-9167-e9c35d23391c.png
  Captured: 2026-08-18 01:45:31 UTC
  Source report: https://urlscan.io/result/01a0128b-747c-70d0-9167-e9c35d23391c/
  SHA-256: 215e72e9f3edf192b475863957fdc2cced94fabf7fc10426cfa0c2f5d1c68635
- URLScan · 2026-08-18: https://screenshots.phishdestroy.io/us/01a0136c-9c10-7733-a032-d89eb262a8a8.png
  Captured: 2026-08-18 05:51:27 UTC
  Source report: https://urlscan.io/result/01a0136c-9c10-7733-a032-d89eb262a8a8/
  SHA-256: 215e72e9f3edf192b475863957fdc2cced94fabf7fc10426cfa0c2f5d1c68635

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-25T16:22:43Z",
        "uuid": "01a173d6-03bb-76df-80af-b196b3b31fc4",
        "scanned_at": "2026-10-25T16:13:00Z",
        "final_url": "https://eliteforexfund.com/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://eliteforexfund.com/",
                "from": "http://eliteforexfund.com/",
                "status": 307
            }
        ],
        "ip": "158.94.210.119",
        "ips": [
            "158.94.210.119"
        ],
        "asns": [
            "202412"
        ],
        "countries": [
            "NL"
        ],
        "doc_hash": "f664c056c253157059f83cded8b1466f98793d6a64cfd43033efa8bfb60c1075",
        "script_hashes": [
            "8aa5f8f647356dcd4fc5dbbe0efd5bc0e8da74026bc61e24636e2e1f5749b0ce"
        ],
        "globals": [
            "__dclq",
            "__dclOrig",
            "__dclFlush",
            "__smsCheckBeforeSubmit",
            "__isSmsEnabled",
            "__isSmsVerified",
            "intlTelInput"
        ],
        "cookies": [
            "connect.sid"
        ],
        "tls": {
            "san": [
                "eliteforexfund.com"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "YE2",
            "subject": "eliteforexfund.com",
            "protocol": "TLS 1.3",
            "valid_to": "2026-11-30T15:30:21Z",
            "valid_from": "2026-09-01T15:30:22Z"
        },
        "domain_age_days": 1295,
        "apex_age_days": 1295,
        "tls_age_days": 54,
        "tls_valid_days": 89,
        "requests": 5,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 87,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "content-type": "text/html; charset=utf-8",
            "x-content-type-options": "nosniff",
            "referrer-policy": "same-origin"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-25T16:13:15Z",
        "uuid": "fce5f018-8d63-42ee-8c3d-64c85e6311af",
        "scanned_at": "2026-10-25T16:10:45Z",
        "final_url": "https://eliteforexfund.com/",
        "status": 200,
        "history": [
            {
                "url": "https://eliteforexfund.com/",
                "status": 200
            }
        ],
        "dom_hash": "4046abc5bcd94c17c8b2e4e4b0fa1b53b6d4a57a92e01a51aa75f04b2c87fd99",
        "doc_hash": "ea37b898eebd4fce5112cd49a68269ebea31bc2911dbc2e29d9fb5730c8b6a2c",
        "phishing_v2": [
            "phishing"
        ],
        "url_risks": [
            "Scam"
        ],
        "domain_risks": [
            "Malware",
            "Security threats",
            "CIPA Filter",
            "CIPA"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "eliteforexfund.com",
                "type": "A",
                "value": "158.94.210.119"
            }
        ],
        "dnssec_valid": false,
        "ip": "158.94.210.119",
        "verdict": {
            "tags": [
                "malware"
            ],
            "malicious": true,
            "categories": [
                "malware"
            ]
        },
        "whois": {
            "registrar": "Dynadot Inc",
            "created": "2026-07-22T11:54:41Z",
            "updated": "2026-08-13T12:24:21Z",
            "expires": "2027-07-22T11:54:41Z",
            "nameservers": [
                "ns1.dyna-ns.net",
                "ns2.dyna-ns.net"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-25T16:42:38Z",
        "analysis_at": "2026-10-23T15:58:09Z",
        "stats": {
            "timeout": 0,
            "harmless": 48,
            "malicious": 12,
            "suspicious": 3,
            "undetected": 29
        },
        "detections": {
            "DNS8": "suspicious",
            "VIPRE": "phishing",
            "G-Data": "phishing",
            "Lionic": "phishing",
            "Sophos": "phishing",
            "CyRadar": "phishing",
            "Fortinet": "spam",
            "Netcraft": "malicious",
            "SOCRadar": "phishing",
            "Kaspersky": "phishing",
            "Seclookup": "malicious",
            "Gridinsoft": "suspicious",
            "BitDefender": "phishing",
            "alphaMountain.ai": "phishing",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "categories": {
            "Google": "financial_services",
            "Sophos": "phishing and fraud"
        },
        "registrar": "Dynadot Inc",
        "created": "2026-07-22T11:54:41Z",
        "expires": "2027-07-22T11:54:41Z",
        "updated": "2026-08-13T12:24:21Z",
        "first_seen": "2023-11-02T14:42:15Z",
        "dns": [
            {
                "ttl": 300,
                "type": "NS",
                "value": "ns2.dyna-ns.net"
            },
            {
                "ttl": 300,
                "type": "NS",
                "value": "ns1.dyna-ns.net"
            },
            {
                "ttl": 300,
                "type": "SOA",
                "rname": "hostmaster.eliteforexfund.com",
                "value": "ns1.dyna-ns.net"
            },
            {
                "ttl": 60,
                "type": "A",
                "value": "54.215.31.113"
            }
        ],
        "dns_at": "2026-10-23T16:33:24Z",
        "jarm": "40d40d40d00000000043d43d00043d6aff5ab0f4fc31897186312c9e639319",
        "cert": {
            "san": [
                "eliteforexfund.com"
            ],
            "issuer": "Let's Encrypt / YE2",
            "serial": "56de319d3805c1b17b644680ddd031b312f",
            "sha256": "a7afcdcb124f1979faa971c02440462d4c4861ee1a0dba83d170c5276d22ef6a",
            "subject": "eliteforexfund.com",
            "valid_to": "2026-11-30T15:30:21Z",
            "valid_from": "2026-09-01T15:30:22Z"
        },
        "whois": {
            "registrar": "Dynadot Inc",
            "registrar_iana_id": "472",
            "registrar_url": "http://www.dynadot.com",
            "created": "2026-07-22T11:54:41Z",
            "updated": "2026-08-13T12:24:21Z",
            "expires": "2027-07-22T11:54:41Z",
            "status": [
                "clientTransferProhibited"
            ],
            "nameservers": [
                "ns1.dyna-ns.net",
                "ns2.dyna-ns.net"
            ],
            "dnssec": "unsigned"
        },
        "rdap": {
            "status": [
                "transfer prohibited"
            ],
            "events": {
                "expiration": "2027-07-22T11:54:41Z",
                "last changed": "2026-09-01T05:41:02Z",
                "registration": "2026-07-22T11:54:41Z",
                "registrar expiration": "2027-07-22T11:54:41Z",
                "last update of RDAP database": "2026-10-16T07:25:56Z"
            }
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-25T16:13:31Z",
        "mail_config": {
            "mx": [
                "parkmail.dynadot.com"
            ],
            "spf_lookups": 0
        },
        "caa_records": {
            "domain": "eliteforexfund.com"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_by": [
                "CloudFlare Family"
            ],
            "blocked_count": 1
        },
        "archives": {
            "last": "2026-10-25T16:04:59Z",
            "first": "2023-10-30T21:37:32Z",
            "changes": 2,
            "days_archived": 3,
            "scans_per_day": 0,
            "avg_page_bytes": 17173
        },
        "robots_txt": {
            "agents": [
                "*"
            ],
            "present": true,
            "sitemaps": [
                "https://eliteforexfund.com/sitemap.xml"
            ]
        },
        "sitemap": {
            "present": true,
            "url_count": 5
        },
        "social_tags": {
            "title": "Smarter Trading Outcomes with AI-Powered Trading Platform — Elite Forex Fund",
            "robots": "index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1",
            "description": "Adaptive Intelligence & Sovereign Execution — Elite Forex Fund helps active forex traders automate complex market workflows and accelerate portfolio performance.",
            "canonicalUrl": "https://eliteforexfund.com/"
        },
        "trackers": {
            "requests": 38,
            "trackers": [
                {
                    "name": "Cloudflare",
                    "company": "Cloudflare",
                    "country": "US",
                    "category": "Hosting",
                    "requests": 1
                },
                {
                    "name": "jsDelivr",
                    "company": "jsDelivr",
                    "category": "Hosting",
                    "requests": 4
                }
            ]
        },
        "mixed_content": {
            "third_party_scripts": 0
        },
        "status": {
            "up": true,
            "code": 200,
            "timings": {
                "dns": 520,
                "tls": 92,
                "wait": 89,
                "connect": 69,
                "download": 206
            },
            "response_ms": 976
        },
        "tls_connection": {
            "alpn": "h2",
            "cipher": "TLS_AES_128_GCM_SHA256",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                22,
                80,
                443
            ]
        },
        "carbon": {
            "bytes": 103892,
            "co2_grams": 0.0038,
            "cleaner_than": 21
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "162.159.27.158",
                    "host": "ns1.dyna-ns.net"
                },
                {
                    "ip": "162.159.24.5",
                    "host": "ns2.dyna-ns.net"
                }
            ],
            "zone": "eliteforexfund.com"
        },
        "cookies": {
            "cookies": [
                {
                    "name": "cf-c",
                    "http_only": true,
                    "same_site": "Lax"
                },
                {
                    "name": "__cf_clicked"
                },
                {
                    "name": "ph_phc_t6w4wzJE2sbz4ro8LmZZTssm5go3KD6mP7QsqcDQRSp6_posthog",
                    "secure": true,
                    "same_site": "Lax"
                }
            ]
        },
        "location": {
            "ip": "158.94.210.119",
            "asn": "202412",
            "org": "Omegatech LTD",
            "city": "Amsterdam",
            "country": "NL"
        },
        "ssl": {
            "issuer": "Let's Encrypt / YE2",
            "subject": "eliteforexfund.com"
        },
        "dns": {
            "A": [
                "158.94.210.119"
            ],
            "MX": [
                "{\"exchange\": \"parkmail.dynadot.com\", \"priority\": 0}"
            ],
            "NS": [
                "ns2.dyna-ns.net",
                "ns1.dyna-ns.net"
            ],
            "SOA": "{\"nsname\": \"ns1.dyna-ns.net\", \"hostmaster\": \"hostmaster.eliteforexfund.com\", \"serial\": 2026092801, \"refresh\": 16384, \"retry\": 2048, \"expire\": 1209600, \"minttl\": 300}"
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "hsts": {
            "message": "Site does not serve any HSTS headers."
        },
        "http_security": {
            "xFrameOptions": false,
            "referrerPolicy": "same-origin",
            "xXSSProtection": false,
            "permissionsPolicy": false,
            "xContentTypeOptions": "nosniff",
            "contentSecurityPolicy": false,
            "strictTransportPolicy": false,
            "crossOriginOpenerPolicy": false,
            "crossOriginEmbedderPolicy": false,
            "crossOriginResourcePolicy": false
        },
        "get_ip": {
            "ip": "158.94.210.119",
            "family": 4
        },
        "redirects": {
            "chain": [
                "https://eliteforexfund.com"
            ]
        },
        "linked_pages": {
            "internal_count": 30
        },
        "whois": {
            "registrar": "Dynadot Inc",
            "created": "2026-07-22T11:54:41Z",
            "updated": "2026-08-13T12:24:21Z",
            "expires": "2027-07-22T11:54:41Z",
            "status": [
                "clientTransferProhibited https://icann.org/epp"
            ],
            "nameservers": [
                "ns1.dyna-ns.net",
                "ns2.dyna-ns.net"
            ]
        },
        "headers": {
            "headers": {
                "content-type": "text/html; charset=utf-8",
                "x-content-type-options": "nosniff",
                "referrer-policy": "same-origin"
            }
        }
    }
}
```