# PhishDestroy domain threat record: elon-finance.com

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/elon-finance.com/
Machine-readable companion: https://phishdestroy.io/domain/elon-finance.com/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-22 13:05:22 UTC
- Last availability or vendor check: 2026-10-22 13:12:23 UTC
- Stored record updated: 2026-10-22 16:30:28 UTC
- VirusTotal detections in the stored snapshot: 4/92
- Independent public blocklist matches in the stored snapshot: 2
- Matching public blocklists: MetaMask, SEAL
- Google Safe Browsing stored result: no stored flag

## Stored infrastructure

- Observed IP address: 104.21.50.225
- Registrar in stored WHOIS data: Global Domain Group LLC
- Last stored HTTP status: 200
- Registration date (registry RDAP, elon-finance.com): 2026-10-18 22:49:17 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a163bc-954a-7490-a7c1-3fe3910ba77a/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/elon-finance.com
- Certificate Transparency search: https://crt.sh/?q=%25.elon-finance.com
- Web Archive lookup: https://web.archive.org/web/*/https://elon-finance.com/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
PhishDestroy added elon-finance.com to its internal blocklist on 2026-10-22 after an intake review flagged the domain because VirusTotal reported three malicious detections. The recorded page title claims an "Elon Musk — Official ETH and BTC Reward Program," suggesting a fake reward scheme. An HTTP 200 response was observed on the same date, confirming the site was reachable at that time.

How the scam works
Impersonation of a well‑known public figure is a common phishing tactic that lures visitors into believing they can claim cryptocurrency rewards, often to harvest login credentials or persuade users to send funds. While the page itself was not examined for malicious forms, the classification reflects the risk of credential or crypto‑asset theft typical of such schemes.

Evidence
VirusTotal scanned the domain on 2026-10-22 and returned four detections, with three vendors (DNS8, Gridinsoft, SOCRadar) marking it malicious and one (alphaMountain.ai) marking it suspicious. Google Safe Browsing checked the same day and did not flag the URL. URLScan captured the site on 2026-10-22, assigning a malicious verdict with a score of 100 and categorising it as phishing. External blocklists MetaMask and SEAL also listed the domain, and PhishDestroy’s internal list marks it as blocked.

Infrastructure
The domain was registered on 2026-10-18 through Global Domain Group LLC, and the registration record shows a client‑transfer‑prohibited status. Hosting is provided by Cloudflare, with recorded IP addresses 104.21.50.225 and 172.67.167.165, and the site presented a Let’s Encrypt TLS certificate valid until 2027-01-19. No DNSSEC signatures were observed.

What to do
Visitors should avoid entering any personal data, wallet addresses, or credentials on the site; if such information was submitted, change passwords immediately and monitor associated accounts for unauthorized activity. Defenders should block elon-finance.com at the network perimeter, add the recorded IPs to threat‑intel feeds, and review logs for any connections to the domain. Continue to monitor reputable blocklists for updates on this indicator.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a163bc-954a-7490-a7c1-3fe3910ba77a/
Cloudflare Radar report: https://radar.cloudflare.com/scan/982bae39-7635-421f-9bc3-717c8f54c60f
URLQuery report: https://urlquery.net/report/b239b981-e8bb-4798-bc27-93964d67088e
Stored capture screenshot: https://i.ibb.co/nNW7NGpV/f215a98c275b.png
Cloudflare Radar screenshot (2026-10-22T13:10:18Z): https://screenshots.phishdestroy.io/cf/982bae39-7635-421f-9bc3-717c8f54c60f.png
URLQuery screenshot: https://screenshots.phishdestroy.io/uq/b239b981-e8bb-4798-bc27-93964d67088e.png
URLScan screenshot (2026-10-21T21:57:25Z): https://screenshots.phishdestroy.io/us/01a16077-ff6a-7786-afcc-fb53528f87f9.png
URLScan capture report: https://urlscan.io/result/01a16077-ff6a-7786-afcc-fb53528f87f9/
URLScan screenshot (2026-10-21T21:57:26Z): https://screenshots.phishdestroy.io/us/01a16078-003e-7598-92ba-bc5260cb2e30.png
URLScan capture report: https://urlscan.io/result/01a16078-003e-7598-92ba-bc5260cb2e30/
URLScan screenshot (2026-10-21T22:19:08Z): https://screenshots.phishdestroy.io/us/01a1608b-dfc3-75ce-ba7d-2628c9e5e248.png
URLScan capture report: https://urlscan.io/result/01a1608b-dfc3-75ce-ba7d-2628c9e5e248/
VirusTotal report: https://www.virustotal.com/gui/domain/elon-finance.com
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=elon-finance.com
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-22 13:45:59 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/nNW7NGpV/f215a98c275b.png
  Captured: 2026-10-22 13:12:23 UTC
- URLScan capture 1: https://screenshots.phishdestroy.io/01a163bc-954a-7490-a7c1-3fe3910ba77a.png
  Captured: 2026-10-22 13:12:23 UTC
  Source report: https://urlscan.io/result/01a163bc-954a-7490-a7c1-3fe3910ba77a/
- URLScan capture 2: https://urlscan.io/screenshots/01a1608b-dfc3-75ce-ba7d-2628c9e5e248.png
  Captured: 2026-10-22 13:05:22 UTC
  Source report: https://urlscan.io/result/01a163bc-954a-7490-a7c1-3fe3910ba77a/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/982bae39-7635-421f-9bc3-717c8f54c60f.png
  Captured: 2026-10-22 13:10:18 UTC
  Source report: https://radar.cloudflare.com/scan/982bae39-7635-421f-9bc3-717c8f54c60f
  SHA-256: b3a78f79f14ad13fad9ca426ff9692452062f51523d517319da9a4fe5a86692e
- URLQuery: https://screenshots.phishdestroy.io/uq/b239b981-e8bb-4798-bc27-93964d67088e.png
  Source report: https://urlquery.net/report/b239b981-e8bb-4798-bc27-93964d67088e
  SHA-256: fb87741312066e14397b56964fd15484159f06656e98250b622e934df5fba823
- URLScan · 2026-10-21: https://screenshots.phishdestroy.io/us/01a16077-ff6a-7786-afcc-fb53528f87f9.png
  Captured: 2026-10-21 21:57:25 UTC
  Source report: https://urlscan.io/result/01a16077-ff6a-7786-afcc-fb53528f87f9/
  SHA-256: fec06f7ffb88e3ea78f617f2fff70e0525d256ef78047a3b023f04844673e8e5
- URLScan · 2026-10-21: https://screenshots.phishdestroy.io/us/01a16078-003e-7598-92ba-bc5260cb2e30.png
  Captured: 2026-10-21 21:57:26 UTC
  Source report: https://urlscan.io/result/01a16078-003e-7598-92ba-bc5260cb2e30/
  SHA-256: fec06f7ffb88e3ea78f617f2fff70e0525d256ef78047a3b023f04844673e8e5
- URLScan · 2026-10-21: https://screenshots.phishdestroy.io/us/01a1608b-dfc3-75ce-ba7d-2628c9e5e248.png
  Captured: 2026-10-21 22:19:08 UTC
  Source report: https://urlscan.io/result/01a1608b-dfc3-75ce-ba7d-2628c9e5e248/
  SHA-256: f542e47f3f92077522c561a2a7e04e388e70ae671350ea39ce03db0867f3fb0e

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-22T13:17:29Z",
        "uuid": "01a163bc-954a-7490-a7c1-3fe3910ba77a",
        "scanned_at": "2026-10-22T13:11:14Z",
        "final_url": "https://elon-finance.com/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://elon-finance.com/",
                "from": "http://elon-finance.com/",
                "status": 307
            }
        ],
        "ip": "172.67.167.165",
        "domains": [
            "fonts.gstatic.com",
            "fonts.googleapis.com"
        ],
        "ips": [
            "142.251.20.94",
            "142.251.14.95",
            "172.67.167.165"
        ],
        "asns": [
            "15169",
            "13335"
        ],
        "countries": [
            "US"
        ],
        "link_domains": [
            "wnn-news.com",
            "account.bbc.com",
            "www.bbc.com",
            "www.google.com",
            "shop.bbc.com",
            "www.britbox.com",
            "www.bbc.co.uk",
            "advertising.bbcstudios.com",
            "help.bbc.com"
        ],
        "doc_hash": "b784c9a6a9273a86ae0c9e9bf32a02a10f935f3fe48e8cc86e0e8c7213ad934e",
        "cookies": [
            "__ddg1_",
            "__ddg10_",
            "__ddg8_",
            "__ddg9_"
        ],
        "tls": {
            "san": [
                "*.elon-finance.com",
                "elon-finance.com"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "YE1",
            "subject": "elon-finance.com",
            "protocol": "QUIC",
            "valid_to": "2027-01-19T19:12:18Z",
            "valid_from": "2026-10-21T19:12:19Z"
        },
        "domain_age_days": 574,
        "apex_age_days": 574,
        "tls_age_days": 0,
        "tls_valid_days": 89,
        "requests": 12,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 40,
                "malicious": true
            },
            "overall": {
                "tags": [
                    "phishing"
                ],
                "score": 100,
                "brands": [
                    "genericnews"
                ],
                "malicious": true,
                "categories": [
                    "phishing"
                ]
            },
            "urlscan": {
                "tags": [
                    "phishing"
                ],
                "score": 100,
                "brands": [
                    "Generic News"
                ],
                "malicious": true,
                "categories": [
                    "phishing"
                ]
            }
        },
        "headers": {
            "server": "cloudflare",
            "content-type": "text/html"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-22T13:16:03Z",
        "uuid": "982bae39-7635-421f-9bc3-717c8f54c60f",
        "scanned_at": "2026-10-22T13:10:18Z",
        "final_url": "https://elon-finance.com/",
        "status": 200,
        "history": [
            {
                "url": "https://elon-finance.com/",
                "status": 200
            }
        ],
        "dom_hash": "0c450eae4a15985dc1c1f53e1b588f473b635452a4b134975275ec8fe4965836",
        "doc_hash": "67ce686bf92ed76ac71a5916c95fb8bfd87b80bfc3ebd1cf3ecbd0f411e59e50",
        "phishing_v2": [
            "phishing"
        ],
        "url_risks": [
            "Scam"
        ],
        "domain_risks": [
            "Scam",
            "Security threats",
            "CIPA Filter",
            "CIPA"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "elon-finance.com",
                "type": "A",
                "value": "104.21.50.225"
            },
            {
                "name": "elon-finance.com",
                "type": "A",
                "value": "172.67.167.165"
            },
            {
                "name": "elon-finance.com",
                "type": "AAAA",
                "value": "2606:4700:3036::6815:32e1"
            },
            {
                "name": "elon-finance.com",
                "type": "AAAA",
                "value": "2606:4700:3036::ac43:a7a5"
            }
        ],
        "dnssec_valid": false,
        "ip": "104.21.50.225",
        "whois": {
            "registrar": "Global Domain Group LLC",
            "created": "2026-10-18T22:49:17Z",
            "updated": "2026-10-18T22:49:30Z",
            "expires": "2027-10-18T22:49:17Z",
            "nameservers": [
                "aspen.ns.cloudflare.com",
                "harlan.ns.cloudflare.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-22T13:41:34Z",
        "analysis_at": "2026-10-21T22:26:16Z",
        "stats": {
            "timeout": 0,
            "harmless": 56,
            "malicious": 3,
            "suspicious": 1,
            "undetected": 32
        },
        "detections": {
            "DNS8": "phishing",
            "SOCRadar": "phishing",
            "Gridinsoft": "phishing",
            "alphaMountain.ai": "spam"
        },
        "reputation": 0,
        "categories": {
            "alphaMountain.ai": "Spam, Suspicious, Newly Registered (alphaMountain.ai)"
        },
        "created": "2025-03-26T00:00:00Z",
        "updated": "2026-03-29T00:00:00Z",
        "first_seen": "2025-03-26T17:48:41Z",
        "dns": [
            {
                "ttl": 21600,
                "type": "NS",
                "value": "colette.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "104.21.50.225"
            },
            {
                "ttl": 1800,
                "type": "SOA",
                "rname": "dns.cloudflare.com",
                "value": "colette.ns.cloudflare.com"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "watson.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "172.67.167.165"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3036::6815:32e1"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3036::ac43:a7a5"
            }
        ],
        "dns_at": "2026-10-21T22:40:56Z",
        "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c",
        "cert": {
            "san": [
                "*.elon-finance.com",
                "elon-finance.com"
            ],
            "issuer": "Let's Encrypt / YE1",
            "serial": "6d90a806bece8dc34b22ec89605725e3f1b",
            "sha256": "3ae1c3c6dc1e5647c16aeae44aa786ae694b9e6c0a01f0a62dd11d0fcd18b90e",
            "subject": "elon-finance.com",
            "valid_to": "2027-01-19T19:12:18Z",
            "valid_from": "2026-10-21T19:12:19Z"
        },
        "whois": [],
        "rdap": {
            "status": [
                "transfer prohibited"
            ],
            "events": {
                "expiration": "2027-10-18T22:49:17Z",
                "last changed": "2026-10-18T22:49:30Z",
                "registration": "2026-10-18T22:49:17Z",
                "registrar expiration": "2027-10-18T22:49:17Z",
                "last update of RDAP database": "2026-10-18T22:51:01Z"
            },
            "registrar": "Global Domain Group LLC",
            "registrar_iana_id": "3956"
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-22T13:17:41Z",
        "mail_config": {
            "spf_lookups": 0
        },
        "caa_records": {
            "domain": "elon-finance.com"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_count": 0
        },
        "archives": {
            "last": "2026-10-22T13:10:11Z",
            "first": "2025-03-27T21:56:08Z",
            "changes": 1,
            "days_archived": 3,
            "scans_per_day": 0,
            "avg_page_bytes": 11735
        },
        "social_tags": {
            "ogUrl": "https://www.bbc.com/news/articles/c58jzyer1kr0o",
            "title": "Elon Musk — Official ETH and BTC Reward Program",
            "ogType": "article",
            "robots": "noindex, nofollow, noarchive, nosnippet",
            "ogImage": "Screenshot_1.png",
            "ogTitle": "Elon Musk — Official ETH and BTC Reward Program",
            "themeColor": "#ffffff",
            "description": "Elon Musk and Tesla host an exclusive crypto giveaway event for BTC and ETH enthusiasts.",
            "twitterCard": "summary_large_image",
            "canonicalUrl": "https://www.bbc.com/news/articles/c58jzyer1kr0o",
            "ogDescription": "Elon Musk and Tesla host an exclusive crypto giveaway event for BTC and ETH enthusiasts."
        },
        "trackers": {
            "requests": 12,
            "trackers": [
                {
                    "name": "BBC",
                    "company": "BBC",
                    "category": "Hosting",
                    "requests": 1
                },
                {
                    "name": "Google Fonts",
                    "company": "Google",
                    "country": "US",
                    "category": "Hosting",
                    "requests": 1
                },
                {
                    "name": "Google Static",
                    "company": "Google",
                    "country": "US",
                    "category": "Hosting",
                    "requests": 5
                }
            ]
        },
        "mixed_content": {
            "third_party_scripts": 0
        },
        "status": {
            "up": true,
            "code": 200,
            "timings": {
                "dns": 11,
                "tls": 33,
                "wait": 1373,
                "connect": 8,
                "download": 59
            },
            "response_ms": 1484
        },
        "tls_connection": {
            "alpn": "h2",
            "cipher": "TLS_AES_256_GCM_SHA384",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1",
                "TLSv1.1",
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                80,
                443,
                8080
            ]
        },
        "carbon": {
            "bytes": 162529,
            "co2_grams": 0.0059,
            "cleaner_than": 11
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "162.159.44.23",
                    "host": "watson.ns.cloudflare.com"
                },
                {
                    "ip": "108.162.194.28",
                    "host": "colette.ns.cloudflare.com"
                }
            ],
            "zone": "elon-finance.com"
        },
        "cookies": {
            "cookies": [
                {
                    "name": "__ddg1_",
                    "http_only": true
                },
                {
                    "name": "__ddg10_"
                },
                {
                    "name": "__ddg8_"
                },
                {
                    "name": "__ddg9_"
                }
            ]
        },
        "location": {
            "ip": "2606:4700:3036::ac43:a7a5",
            "asn": "13335",
            "org": "Cloudflare, Inc.",
            "city": "Toronto",
            "country": "CA"
        },
        "ssl": {
            "issuer": "Let's Encrypt / YE1",
            "subject": "elon-finance.com"
        },
        "dns": {
            "A": [
                "172.67.167.165",
                "104.21.50.225"
            ],
            "NS": [
                "watson.ns.cloudflare.com",
                "colette.ns.cloudflare.com"
            ],
            "SOA": "{\"nsname\": \"colette.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2418121191, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}",
            "AAAA": [
                "2606:4700:3036::6815:32e1",
                "2606:4700:3036::ac43:a7a5"
            ]
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "hsts": {
            "message": "Site does not serve any HSTS headers."
        },
        "http_security": {
            "xFrameOptions": false,
            "referrerPolicy": false,
            "xXSSProtection": false,
            "permissionsPolicy": false,
            "xContentTypeOptions": false,
            "contentSecurityPolicy": false,
            "strictTransportPolicy": false,
            "crossOriginOpenerPolicy": false,
            "crossOriginEmbedderPolicy": false,
            "crossOriginResourcePolicy": false
        },
        "firewall": {
            "waf": "Cloudflare",
            "has_waf": true
        },
        "get_ip": {
            "ip": "2606:4700:3036::ac43:a7a5",
            "family": 6
        },
        "redirects": {
            "chain": [
                "https://elon-finance.com"
            ]
        },
        "tech_stack": {
            "technologies": [
                "Fourthwall",
                "React",
                "styled-components",
                "Cxense",
                "Integral Ad Science",
                "Google Font API",
                "Cloudflare",
                "PWA",
                "Open Graph",
                "HTTP/3"
            ]
        },
        "linked_pages": {
            "external": [
                "https://wnn-news.com/",
                "https://www.bbc.com/sport",
                "https://www.bbc.com/health",
                "https://www.bbc.com/news",
                "https://www.bbc.com/business",
                "https://www.bbc.com/technology",
                "https://www.bbc.com/culture",
                "https://www.bbc.com/arts",
                "https://www.bbc.com/travel",
                "https://www.bbc.com/future-planet",
                "https://www.bbc.com/audio",
                "https://www.bbc.com/video",
                "https://www.bbc.com/live",
                "https://www.bbc.com/weather",
                "https://www.bbc.com/usingthebbc/cookies/how-can-i-change-my-bbc-cookie-settings/",
                "https://account.bbc.com/register",
                "https://account.bbc.com/signin",
                "https://www.bbc.com/newsletters",
                "https://www.google.com/preferences/source",
                "https://www.bbc.com/news/articles/crlw4ng79wzo",
                "https://wnn-news.com/news/articles/cp9edjpvplpo",
                "https://www.bbc.com/news/topics/c77jz3md4rdt",
                "https://www.bbc.com/news/topics/cm8m1lj59z3t",
                "https://www.bbc.com/news/topics/c7rmrr2w79xt",
                "https://shop.bbc.com/"
            ],
            "external_count": 81,
            "internal_count": 3
        },
        "whois": {
            "registrar": "Global Domain Group LLC",
            "created": "2026-10-18T22:49:17Z",
            "updated": "2026-10-21T20:08:42Z",
            "expires": "2027-10-18T22:49:17Z",
            "status": [
                "clientTransferProhibited https://icann.org/epp"
            ],
            "nameservers": [
                "colette.ns.cloudflare.com",
                "watson.ns.cloudflare.com"
            ]
        },
        "headers": {
            "headers": {
                "server": "cloudflare",
                "content-type": "text/html"
            }
        }
    }
}
```