# PhishDestroy domain threat record: expertmarketpro.live Content language: English Canonical HTML report: https://phishdestroy.io/domain/expertmarketpro.live/ Machine-readable companion: https://phishdestroy.io/domain/expertmarketpro.live/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-10-22 17:07:16 UTC - Last availability or vendor check: 2026-10-22 17:11:34 UTC - Stored record updated: 2026-10-22 18:30:22 UTC - VirusTotal detections in the stored snapshot: 3/92 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: no stored flag ## Stored classification - Targeted brand: binance ## Stored infrastructure - Observed IP address: 198.251.84.236 - Registrar in stored WHOIS data: Dynadot Inc - Last stored HTTP status: 200 - Registration date in stored WHOIS data: 2026-01-05 19:07:05 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a16497-0202-77c2-a6dc-0014b11eddec/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/expertmarketpro.live - Certificate Transparency search: https://crt.sh/?q=%25.expertmarketpro.live - Web Archive lookup: https://web.archive.org/web/*/https://expertmarketpro.live/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview PhishDestroy added expertmarketpro.live to its internal blocklist after an automated rule flagged a URLScan capture as malicious. The recorded page title reads "Expert Market Pro" and the meta description advertises a UK‑based investment company offering forex, cryptocurrencies, stocks and other assets. The domain was first seen by PhishDestroy on 2026-10-22, 289 days after its registration on 2026-01-05. How the scam works While no specific malicious behavior was observed on the page, domains of this type often operate as fraudulent investment fronts that lure visitors into depositing money or sharing personal data. Such schemes typically present professional‑looking branding, promise high returns, and may later request payments or credentials. Without concrete evidence of credential harvesting or wallet interaction, the risk remains that the site could be used to deceive users into financial loss. Evidence VirusTotal reported three detections on 2026-10-22, with one vendor (CRDF) labeling the domain malicious and two (alphaMountain.ai, Bfore.Ai PreCrime) marking it suspicious. Google Safe Browsing showed no flag on the same date. URLScan’s engine score was 100 with malicious tags, though its overall verdict was non‑malicious. OTX listed three pulses referencing the domain as of 2026-10-22. PhishDestroy’s internal blocklist marks the domain as malicious, while external blocklists returned zero hits on the check date. Infrastructure The domain was registered on 2026-01-05 through Dynadot Inc and resolves to IP 198.251.84.236, a server identified as belonging to FranTech Solutions in Luxembourg. TLS is provided by Let’s Encrypt, valid from 2026-10-17 to 2027-01-15, and the site uses LiteSpeed web server. Nameservers are ns113.my-control-panel.com and ns114.my-control-panel.com; DNSSEC is not enabled. Open ports include standard web, mail and database services. What to do Visitors should avoid entering credentials, payment details or personal information on the site; if any data was submitted, change related passwords and monitor accounts for unauthorized activity. Defenders should block the exact domain, review logs for any connections, and apply the PhishDestroy indicator to intrusion‑detection or web‑filtering systems. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a16497-0202-77c2-a6dc-0014b11eddec/ Cloudflare Radar report: https://radar.cloudflare.com/scan/98d26f54-359d-4c7f-a713-94871ed6307a Stored capture screenshot: https://i.ibb.co/B5mXtMqs/fb84931f30da.png Cloudflare Radar screenshot (2026-10-22T17:09:40Z): https://screenshots.phishdestroy.io/cf/98d26f54-359d-4c7f-a713-94871ed6307a.png URLScan screenshot (2026-10-22T17:09:51Z): https://screenshots.phishdestroy.io/us/01a16497-0202-77c2-a6dc-0014b11eddec.png VirusTotal report: https://www.virustotal.com/gui/domain/expertmarketpro.live Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=expertmarketpro.live Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-22 17:43:34 UTC ## Stored page captures - Primary capture: https://i.ibb.co/B5mXtMqs/fb84931f30da.png Captured: 2026-10-22 17:11:34 UTC - URLScan capture 1: https://screenshots.phishdestroy.io/01a16497-0202-77c2-a6dc-0014b11eddec.png Captured: 2026-10-22 17:11:34 UTC Source report: https://urlscan.io/result/01a16497-0202-77c2-a6dc-0014b11eddec/ - URLScan capture 2: https://urlscan.io/screenshots/01a16196-f524-74d8-9191-d8d39afa2d80.png Captured: 2026-10-22 17:07:16 UTC Source report: https://urlscan.io/result/01a16497-0202-77c2-a6dc-0014b11eddec/ - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/98d26f54-359d-4c7f-a713-94871ed6307a.png Captured: 2026-10-22 17:09:40 UTC Source report: https://radar.cloudflare.com/scan/98d26f54-359d-4c7f-a713-94871ed6307a SHA-256: 85a9498ac0685367cf3c51f4d967a26ca6f680bd1d3e169c95e28a4fc4f62473 - URLQuery: https://screenshots.phishdestroy.io/uq/90078823-1575-410d-9d8e-59a6b5160246.png Source report: https://urlquery.net/report/90078823-1575-410d-9d8e-59a6b5160246 SHA-256: a6d832e08f68ae6f814684e40bbacce984d8a6dc8daa8c0052b935cf67af2d7b - URLScan · 2026-10-22: https://screenshots.phishdestroy.io/us/01a16196-f524-74d8-9191-d8d39afa2d80.png Captured: 2026-10-22 03:11:03 UTC Source report: https://urlscan.io/result/01a16196-f524-74d8-9191-d8d39afa2d80/ SHA-256: 109c79afff85e910faa5f1eb4425cdace39bf47a4db8e258992511953bcf7b5c ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-22T17:23:08Z", "uuid": "01a16497-0202-77c2-a6dc-0014b11eddec", "scanned_at": "2026-10-22T17:09:51Z", "final_url": "https://expertmarketpro.live/", "status": 200, "redirected": "https-only", "redirects": [ { "to": "https://expertmarketpro.live/", "from": "http://expertmarketpro.live/", "status": 307 } ], "ip": "198.251.84.236", "ptr": "d7.my-control-panel.com", "domains": [ "www.youtube.com", "code.jivosite.com", "coin-images.coingecko.com", "fonts.gstatic.com", "jnn-pa.googleapis.com", "googleads.g.doubleclick.net", "www.cryptocompare.com", "static.getbutton.io", "cdn.gtranslate.net", "use.fontawesome.com", "i.ytimg.com", "www.google.com", "static.doubleclick.net", "widgets.cryptocompare.com", "api.coingecko.com", "node-sb1-az2-23.jivosite.com", "fonts.googleapis.com", "widgets.coingecko.com", "code.tidio.co" ], "ips": [ "142.251.20.119", "172.217.117.4", "142.251.157.119", "192.178.183.149", "142.251.20.156", "104.18.31.136", "172.67.142.173", "172.67.74.247", "142.251.157.4", "20.126.215.223", "104.20.41.132", "142.251.20.94", "5.252.32.145", "192.178.183.95", "104.18.4.118" ], "asns": [ "15169", "13335", "8075", "59796", "201589", "53667" ], "countries": [ "US", "NL", "SK", "AM", "LU" ], "link_domains": [ "www.blockchain.com", "www.cryptocompare.com", "wa.me", "getbutton.io" ], "social": [ "https://wa.me/12495203228" ], "doc_hash": "30aca182f1d8b933dedc08cdd982a176674b5a21fae64dfe63f57233f15be127", "script_hashes": [ "160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef", "587c080125b135d29a931ed371e50ffc1a9641831c1087de2cd74532815f4560", "eb795deda8983fa5310627c9584cf3f3b95d272567113500059018b3941cb267", "23fc25133ed072cdf7dae575213067b1da3c6843b2a0e489c8b7fc984c60ce6b", "1fd8c0cfffd02e40cecbf9f313d1b86988a342d90bb7d16f1a67544f0064ea0b", "f2beb92898142c10e2661c03c9d7d6ac4931df2c95fe0ac6b06cda7a4a1b9e02", "96abf166b3cbb5f7df525d86fdeeeccea4af3c120b19bc26b0613530a94e8b44", "186e4c2c470e3c1c76997b7a4dfd0f618b38311582e0578db05ccada6fd43c6c", "f5118c2117300dcd406002417f201608dc046ee26b0680d4c1c93ecd01d7cc2d" ], "globals": [ "$", "jQuery", "__jivoOnError", "__hasStorage", "jivo_magic_var", "__jivoBundleOnLoad", "__jivoBundleInit", "jivo_init", "jivo_destroy", "Popper", "bootstrap", "moment", "EvEmitter", "imagesLoaded", "gtranslateSettings", "__core-js_shared__", "core", "nav", "functionConfirm", "scripts", "embedder", "baseUrl", "jivo_config", "doGTranslate", "setImmediate", "clearImmediate", "GBBTN", "WhWidgetSendButton", "fabric", "saveAs", "XLSX", "XLS", "cccCurrentTheme", "cccCreateCSSSelector", "cccglobal_data", "cccupdating", "cccloading_counter", "cccfsym", "ccctsym", "cccscale" ], "cookies": [ "XSRF-TOKEN", "royal_trades_option_session", "__Secure-YNID", "YSC", "__Secure-ROLLOUT_TOKEN", "VISITOR_INFO1_LIVE", "VISITOR_PRIVACY_METADATA", "__cf_bm" ], "storage_keys": [ "testLocalStorage", "jv_loader_info_vTdpvGQPYB", "jv_temp_sess_enter_ts_vTdpvGQPYB", "jv_temp_sess_vi_presence_vTdpvGQPYB", "jv_temp_visits_count_vTdpvGQPYB", "jv_store_vTdpvGQPYB_client", "jv_sync_vTdpvGQPYB", "jv_history_vTdpvGQPYB" ], "tls": { "san": [ "*.expertmarketpro.live", "expertmarketpro.live" ], "cipher": "AES_128_GCM", "issuer": "YE1", "subject": "*.expertmarketpro.live", "protocol": "TLS 1.3", "valid_to": "2027-01-15T10:05:11Z", "valid_from": "2026-10-17T10:05:12Z" }, "domain_age_days": 289, "apex_age_days": 289, "tls_age_days": 5, "tls_valid_days": 89, "requests": 92, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 100, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "LiteSpeed", "content-type": "text/html; charset=UTF-8" } }, "cf": { "v": 1, "fetched_at": "2026-10-22T17:10:55Z", "uuid": "98d26f54-359d-4c7f-a713-94871ed6307a", "scanned_at": "2026-10-22T17:09:40Z", "final_url": "https://expertmarketpro.live/", "status": 200, "history": [ { "url": "https://expertmarketpro.live/", "status": 200 } ], "dom_hash": "6c6f2143fd5771d550ddf3e6a4d3b39f4b79f9fcdfa23c41ba4d3fdfea94c614", "doc_hash": "30aca182f1d8b933dedc08cdd982a176674b5a21fae64dfe63f57233f15be127", "phishing_v2": [ "phishing" ], "url_risks": [ "Scam" ], "domain_risks": [ "Scam", "Security threats", "Brokerage & Investing", "Business & Economy", "CIPA Filter", "CIPA" ], "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "expertmarketpro.live", "type": "A", "value": "198.251.84.236" } ], "dnssec_valid": false, "ip": "198.251.84.236" }, "vt": { "v": 1, "fetched_at": "2026-10-22T17:42:20Z", "analysis_at": "2026-08-10T06:59:07Z", "stats": { "timeout": 0, "harmless": 53, "malicious": 1, "suspicious": 2, "undetected": 36 }, "detections": { "CRDF": "malicious", "alphaMountain.ai": "suspicious", "Bfore.Ai PreCrime": "suspicious" }, "reputation": 0, "created": "2026-01-05T00:00:00Z", "updated": "2026-01-05T00:00:00Z", "first_seen": "2026-01-05T20:58:17Z", "dns": [ { "ttl": 3600, "type": "A", "value": "198.251.84.236" }, { "ttl": 3600, "type": "NS", "value": "ns113.my-control-panel.com" }, { "ttl": 3600, "type": "SOA", "rname": "hostmaster.expertmarketpro.live", "value": "ns113.my-control-panel.com" }, { "ttl": 3600, "type": "TXT", "value": "v=spf1 a mx ip4:198.251.84.236 ip4:198.251.84.236 ~all" }, { "ttl": 3600, "type": "NS", "value": "ns114.my-control-panel.com" }, { "ttl": 3600, "type": "MX", "value": "mail.expertmarketpro.live", "priority": 10 } ], "dns_at": "2026-07-11T02:21:11Z", "jarm": "27d27d27d00027d00042d43d00041dba951fb796b4b956c9799ba19149e94a", "cert": { "san": [ "*.expertmarketpro.live", "expertmarketpro.live" ], "issuer": "Let's Encrypt / YE1", "serial": "617344bd48a5812468a0f5df0fa957c0851", "sha256": "4f5b50d4e13c6790a91627edc230a333ac48f9df712af7e4279984b3e01b7615", "subject": "*.expertmarketpro.live", "valid_to": "2026-08-30T04:10:24Z", "valid_from": "2026-06-01T04:10:25Z" }, "rdap": { "status": [ "client transfer prohibited" ], "events": { "expiration": "2027-01-05T20:07:05Z", "last changed": "2026-01-10T20:07:57Z", "registration": "2026-01-05T20:07:05Z", "last update of RDAP database": "2026-08-10T07:32:39Z" }, "registrar": "Dynadot Inc", "registrar_iana_id": "472" } }, "webcheck": { "v": 1, "fetched_at": "2026-10-22T17:11:18Z", "mail_config": { "mx": [ "mail.expertmarketpro.live" ], "spf": "v=spf1 a mx ip4:198.251.84.236 ip4:198.251.84.236 ~all", "spf_lookups": 2 }, "caa_records": { "domain": "expertmarketpro.live" }, "block_lists": { "resolvers": 12, "blocked_count": 0 }, "archives": { "last": "2026-10-22T17:09:07Z", "first": "2026-10-22T17:09:07Z", "changes": 0, "days_archived": 1, "avg_page_bytes": 14010 }, "robots_txt": { "agents": [ "*" ], "present": true }, "social_tags": { "title": "Expert Market Pro", "ogType": "website", "ogImage": "https://expertmarketpro.live/storage/app/public/photos/7sZOeQ2RhM4dc5U6KClPDkEWhTTtQ5S2b8H6NrK1.jpg", "ogTitle": "Trading With Expert Market Pro", "keywords": "Expert Market Pro", "ogSiteName": "Expert Market Pro", "themeColor": "#4D7DE6", "description": "Expert Market Pro LIMITED???\nINVEST IN A LEADING\nTRADE AND INVESTMENT\nCOMPANY, OPERATING IN\nTHE UK. \nSERVICES INCLUDE: FOREX TRADING\nCRYPTOCURRENCIES, STOCKS & COMMODITIES INVESTMENTS. OIL & GAS, REAL ESTATE INVESTMENTS, MARKET\nRESEARCH AND ANALYSIS:\nASSISTING BOTH INDIVIDUALS & COMPANIES INVEST IN", "ogDescription": "Expert Market Pro LIMITED???\nINVEST IN A LEADING\nTRADE AND INVESTMENT\nCOMPANY, OPERATING IN\nTHE UK. \nSERVICES INCLUDE: FOREX TRADING\nCRYPTOCURRENCIES, STOCKS & COMMODITIES INVESTMENTS. OIL & GAS, REAL ESTATE INVESTMENTS, MARKET\nRESEARCH AND ANALYSIS:\nASSISTING BOTH INDIVIDUALS & COMPANIES INVEST IN" }, "mixed_content": { "no_sri": [ "https://code.jivosite.com/widget/vTdpvGQPYB", "https://cdn.gtranslate.net/widgets/latest/popup.js", "https://widgets.coingecko.com/coingecko-coin-price-marquee-widget.js", "https://code.tidio.co/ggsggsgggg" ], "third_party_scripts": 4 }, "status": { "up": true, "code": 200, "timings": { "dns": 138, "tls": 100, "wait": 2078, "connect": 67, "download": 161 }, "response_ms": 2544 }, "tls_connection": { "alpn": "h2", "cipher": "TLS_AES_256_GCM_SHA384", "protocol": "TLSv1.3", "versions": [ "TLSv1.2", "TLSv1.3" ], "authorized": true, "forward_secrecy": true }, "ports": { "open": [ 21, 25, 53, 80, 110, 143, 443, 587, 993, 995, 3306 ] }, "carbon": { "bytes": 49643, "co2_grams": 0.0018, "cleaner_than": 37 }, "dns_server": { "ns": [ { "ip": "198.251.84.236", "host": "ns114.my-control-panel.com" }, { "ip": "198.251.84.236", "host": "ns113.my-control-panel.com" } ], "zone": "expertmarketpro.live" }, "location": { "ip": "198.251.84.236", "asn": "53667", "org": "FranTech Solutions", "city": "Luxembourg", "country": "LU" }, "ssl": { "issuer": "Let's Encrypt / YE1", "subject": "*.expertmarketpro.live" }, "dns": { "A": [ "198.251.84.236" ], "MX": [ "{\"exchange\": \"mail.expertmarketpro.live\", \"priority\": 10}" ], "NS": [ "ns113.my-control-panel.com", "ns114.my-control-panel.com" ], "SOA": "{\"nsname\": \"ns113.my-control-panel.com\", \"hostmaster\": \"hostmaster.expertmarketpro.live\", \"serial\": 2026101705, \"refresh\": 3600, \"retry\": 3600, \"expire\": 1209600, \"minttl\": 1800}", "TXT": [ "v=spf1 a mx ip4:198.251.84.236 ip4:198.251.84.236 ~all" ] }, "dnssec": { "ds": false, "rrsig": false, "dnskey": false }, "hsts": { "message": "Site does not serve any HSTS headers." }, "http_security": { "xFrameOptions": false, "referrerPolicy": false, "xXSSProtection": false, "permissionsPolicy": false, "xContentTypeOptions": false, "contentSecurityPolicy": false, "strictTransportPolicy": false, "crossOriginOpenerPolicy": false, "crossOriginEmbedderPolicy": false, "crossOriginResourcePolicy": false }, "get_ip": { "ip": "198.251.84.236", "family": 4 }, "redirects": { "chain": [ "https://expertmarketpro.live" ] }, "linked_pages": { "external": [ "https://www.blockchain.com/" ], "external_count": 1, "internal_count": 13 }, "headers": { "headers": { "server": "LiteSpeed", "content-type": "text/html", "x-frame-options": "SAMEORIGIN" } } } } ```