# PhishDestroy domain threat record: fagruviltrade.com

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/fagruviltrade.com/
Machine-readable companion: https://phishdestroy.io/domain/fagruviltrade.com/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-26 02:03:57 UTC
- Last availability or vendor check: 2026-10-26 02:03:57 UTC
- Stored record updated: 2026-10-26 04:30:13 UTC
- VirusTotal detections in the stored snapshot: 17/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored infrastructure

- Observed IP address: 158.94.210.119
- Registrar in stored WHOIS data: Dynadot Inc
- Last stored HTTP status: 200
- Registration date in stored WHOIS data: 2026-06-23 07:06:28 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a175f2-09f2-77c7-b655-372c857e1937/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/fagruviltrade.com
- Certificate Transparency search: https://crt.sh/?q=%25.fagruviltrade.com
- Web Archive lookup: https://web.archive.org/web/*/https://fagruviltrade.com/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
PhishDestroy listed fagruviltrade.com as a suspicious domain based on an intake reason citing 13 malicious VirusTotal detections. The domain was first observed by PhishDestroy on 2026-10-26 with an HTTP 200 response. The page title advertises "Fagruvil, la tua Piattaforma di Trading Intelligente", suggesting a trading platform claim.

How the scam works
The available evidence points to a generic phishing or fraud risk, but no specific mechanism such as credential harvesting or wallet draining was observed on the page. Sites that present themselves as trading platforms often aim to collect user credentials or convince visitors to deposit funds, yet this classification relies solely on vendor detections and reputation signals rather than concrete malicious behavior.

Evidence
VirusTotal (analysis on 2026-10-24) reported 13 malicious and 4 suspicious detections out of 92 engines, totaling 17 detections. Malicious labels came from vendors including alphaMountain.ai, BitDefender, CRDF, CyRadar, Forcepoint ThreatSeeker, G-Data, Kaspersky, Lionic, Netcraft, Seclookup, Sophos and SOCRadar. Google Safe Browsing checked on 2026-10-26 reported no warning. Spamhaus DBL listed the domain as spam on the same day. OTX recorded five pulses referencing the domain. URLScan captured on 2026-10-26 flagged the site as malicious with a 97‑score from its engines, while its overall verdict was non‑malicious. Cloudflare Radar on 2026-10-26 marked the URL as phishing and the domain as malware‑related.

Infrastructure
The domain was registered with Dynadot Inc on 2026-06-23 and was 124 days old at the time of observation. The recorded IP was 158.94.210.119, associated with ASN 202412 and organization Omegatech LTD in the Netherlands. TLS was provided by Let's Encrypt, valid from 2026-08-28 to 2026-11-26. Nameservers were ns1.dyna-ns.net and ns2.dyna-ns.net; DNSSEC was not enabled. Open ports observed included 22, 80 and 443.

What to do
Visitors should avoid entering any credentials, personal data, or financial information on this site; if credentials were submitted, change the associated passwords immediately. No wallet‑related recommendations are permitted for this domain. Defenders should block fagruviltrade.com at the DNS or proxy level, monitor outbound connections to 158.94.210.119, and add the domain to internal blocklists. Review logs for any access attempts and apply standard phishing response procedures.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a175f2-09f2-77c7-b655-372c857e1937/
Cloudflare Radar report: https://radar.cloudflare.com/scan/7f8bc521-7c35-4c1e-a89f-3575ec74f2b7
URLQuery report: https://urlquery.net/report/4f31a1c8-584a-44fa-9666-527837154997
Stored capture screenshot: https://i.ibb.co/rBNVgbw/fc3bcbdba7a6.png
Cloudflare Radar screenshot (2026-10-26T02:41:09Z): https://screenshots.phishdestroy.io/cf/7f8bc521-7c35-4c1e-a89f-3575ec74f2b7.png
URLQuery screenshot: https://screenshots.phishdestroy.io/uq/4f31a1c8-584a-44fa-9666-527837154997.png
URLScan screenshot (2026-08-29T17:45:53Z): https://screenshots.phishdestroy.io/us/01a04ea0-a51e-71c5-9bdb-f4affb08491e.png
URLScan capture report: https://urlscan.io/result/01a04ea0-a51e-71c5-9bdb-f4affb08491e/
URLScan screenshot (2026-08-30T10:33:51Z): https://screenshots.phishdestroy.io/us/01a0523b-7a65-7089-80b9-d6e0d7cb7ad0.png
URLScan capture report: https://urlscan.io/result/01a0523b-7a65-7089-80b9-d6e0d7cb7ad0/
VirusTotal report: https://www.virustotal.com/gui/domain/fagruviltrade.com
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=fagruviltrade.com
Archived copy: https://web.archive.org/web/20261026020538/https://fagruviltrade.com/
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-26 03:42:12 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/rBNVgbw/fc3bcbdba7a6.png
  Captured: 2026-10-26 02:03:57 UTC
- URLScan capture: https://screenshots.phishdestroy.io/01a175f2-09f2-77c7-b655-372c857e1937.png
  Captured: 2026-10-26 02:03:57 UTC
  Source report: https://urlscan.io/result/01a175f2-09f2-77c7-b655-372c857e1937/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/7f8bc521-7c35-4c1e-a89f-3575ec74f2b7.png
  Captured: 2026-10-26 02:41:09 UTC
  Source report: https://radar.cloudflare.com/scan/7f8bc521-7c35-4c1e-a89f-3575ec74f2b7
  SHA-256: 6feea81456ae9eb07475debb071abcfbe99e69cbaffba466c6b8b0eb2657e0f4
- URLQuery: https://screenshots.phishdestroy.io/uq/4f31a1c8-584a-44fa-9666-527837154997.png
  Source report: https://urlquery.net/report/4f31a1c8-584a-44fa-9666-527837154997
  SHA-256: adf0390ef7c07a4852788ba399a830038ccde525e820b984ea3a2d0fecd2df2c
- URLScan · 2026-08-29: https://screenshots.phishdestroy.io/us/01a04ea0-a51e-71c5-9bdb-f4affb08491e.png
  Captured: 2026-08-29 17:45:53 UTC
  Source report: https://urlscan.io/result/01a04ea0-a51e-71c5-9bdb-f4affb08491e/
  SHA-256: 15bb50eaa4cb7b30b394e058a1ef85eb1c2b8d7af05d58935f426d48d307bc2c
- URLScan · 2026-08-30: https://screenshots.phishdestroy.io/us/01a0523b-7a65-7089-80b9-d6e0d7cb7ad0.png
  Captured: 2026-08-30 10:33:51 UTC
  Source report: https://urlscan.io/result/01a0523b-7a65-7089-80b9-d6e0d7cb7ad0/
  SHA-256: d13cd9cf98241dd3340b9173692b52476bfe1a409af1ade3b31dcc7339dadc3b

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-26T02:08:49Z",
        "uuid": "01a175f2-09f2-77c7-b655-372c857e1937",
        "scanned_at": "2026-10-26T02:02:50Z",
        "final_url": "https://fagruviltrade.com/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://fagruviltrade.com/",
                "from": "http://fagruviltrade.com/",
                "status": 307
            }
        ],
        "ip": "158.94.210.119",
        "ips": [
            "158.94.210.119"
        ],
        "asns": [
            "202412"
        ],
        "countries": [
            "NL"
        ],
        "doc_hash": "2f734a6f3a650c4af3fbcd9e02e98ec3460b3f05fe5dcff15a3c9bea19ddc3c8",
        "script_hashes": [
            "8aa5f8f647356dcd4fc5dbbe0efd5bc0e8da74026bc61e24636e2e1f5749b0ce"
        ],
        "globals": [
            "__dclq",
            "__dclOrig",
            "__dclFlush",
            "__smsCheckBeforeSubmit",
            "__isSmsEnabled",
            "__isSmsVerified",
            "intlTelInput",
            "langSwitcher",
            "langBtn",
            "langDropdown",
            "mobileToggle",
            "mobileNav"
        ],
        "cookies": [
            "connect.sid"
        ],
        "tls": {
            "san": [
                "fagruviltrade.com"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "YE2",
            "subject": "fagruviltrade.com",
            "protocol": "TLS 1.3",
            "valid_to": "2026-11-26T15:56:54Z",
            "valid_from": "2026-08-28T15:56:55Z"
        },
        "domain_age_days": 124,
        "apex_age_days": 124,
        "tls_age_days": 58,
        "tls_valid_days": 89,
        "requests": 5,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 97,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "content-type": "text/html; charset=utf-8",
            "x-content-type-options": "nosniff",
            "referrer-policy": "same-origin"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-26T02:45:12Z",
        "uuid": "7f8bc521-7c35-4c1e-a89f-3575ec74f2b7",
        "scanned_at": "2026-10-26T02:41:09Z",
        "final_url": "https://fagruviltrade.com/",
        "status": 200,
        "history": [
            {
                "url": "https://fagruviltrade.com/",
                "status": 200
            }
        ],
        "dom_hash": "8d818b8e51c675e534d87340c104663e97f31ad17a943dff255f232c80b68bf8",
        "doc_hash": "6076064f04870ce3065ff6c8026f459edaf7768f26de20b7125362adb5457104",
        "phishing_v2": [
            "phishing"
        ],
        "url_risks": [
            "Scam"
        ],
        "domain_risks": [
            "Malware",
            "Security threats",
            "Scam",
            "CIPA Filter",
            "CIPA"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "fagruviltrade.com",
                "type": "A",
                "value": "158.94.210.119"
            }
        ],
        "dnssec_valid": false,
        "ip": "158.94.210.119",
        "verdict": {
            "tags": [
                "malware"
            ],
            "malicious": true,
            "categories": [
                "malware"
            ]
        },
        "whois": {
            "registrar": "Dynadot Inc",
            "created": "2026-06-23T09:06:28Z",
            "updated": "2026-08-13T12:46:23Z",
            "expires": "2027-06-23T09:06:28Z",
            "nameservers": [
                "ns1.dyna-ns.net",
                "ns2.dyna-ns.net"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-26T03:39:57Z",
        "analysis_at": "2026-10-23T23:52:37Z",
        "stats": {
            "timeout": 0,
            "harmless": 44,
            "malicious": 13,
            "suspicious": 4,
            "undetected": 31
        },
        "detections": {
            "CRDF": "malicious",
            "DNS8": "suspicious",
            "ESET": "suspicious",
            "VIPRE": "phishing",
            "G-Data": "phishing",
            "Lionic": "phishing",
            "Sophos": "phishing",
            "CyRadar": "phishing",
            "Fortinet": "spam",
            "Netcraft": "malicious",
            "SOCRadar": "phishing",
            "Kaspersky": "phishing",
            "Seclookup": "malicious",
            "Gridinsoft": "suspicious",
            "BitDefender": "phishing",
            "alphaMountain.ai": "phishing",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "categories": {
            "Sophos": "phishing and fraud",
            "alphaMountain.ai": "Phishing (alphaMountain.ai)",
            "Forcepoint ThreatSeeker": "phishing and other frauds"
        },
        "registrar": "Dynadot Inc",
        "created": "2026-06-23T09:06:28Z",
        "expires": "2027-06-23T09:06:28Z",
        "updated": "2026-08-13T12:46:23Z",
        "first_seen": "2026-06-23T09:31:57Z",
        "dns": [
            {
                "ttl": 300,
                "type": "NS",
                "value": "ns2.dyna-ns.net"
            },
            {
                "ttl": 300,
                "type": "NS",
                "value": "ns1.dyna-ns.net"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "158.94.210.119"
            },
            {
                "ttl": 300,
                "type": "SOA",
                "rname": "hostmaster.fagruviltrade.com",
                "value": "ns1.dyna-ns.net"
            }
        ],
        "dns_at": "2026-10-23T23:52:54Z",
        "jarm": "40d40d40d00000000043d43d00043d6aff5ab0f4fc31897186312c9e639319",
        "cert": {
            "san": [
                "fagruviltrade.com"
            ],
            "issuer": "Let's Encrypt / YE2",
            "serial": "660bb4537ca3cbf1e79e09f799454579b8a",
            "sha256": "12fb7b070f27cf68ef3093e27a276157e6b7fc59c0bf0fc80d5a1b42470923c9",
            "subject": "fagruviltrade.com",
            "valid_to": "2026-11-26T15:56:54Z",
            "valid_from": "2026-08-28T15:56:55Z"
        },
        "whois": {
            "registrar": "Dynadot Inc",
            "registrar_iana_id": "472",
            "registrar_url": "http://www.dynadot.com",
            "created": "2026-06-23T09:06:28Z",
            "updated": "2026-08-13T12:46:23Z",
            "expires": "2027-06-23T09:06:28Z",
            "status": [
                "clientTransferProhibited"
            ],
            "nameservers": [
                "ns1.dyna-ns.net",
                "ns2.dyna-ns.net"
            ],
            "dnssec": "unsigned"
        },
        "rdap": {
            "status": [
                "transfer prohibited"
            ],
            "events": {
                "expiration": "2027-06-23T09:06:28Z",
                "last changed": "2026-08-28T08:49:22Z",
                "registration": "2026-06-23T09:06:28Z",
                "registrar expiration": "2027-06-23T09:06:28Z",
                "last update of RDAP database": "2026-10-16T07:18:10Z"
            }
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-26T02:29:13Z",
        "mail_config": {
            "spf_lookups": 0
        },
        "caa_records": {
            "domain": "fagruviltrade.com"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_by": [
                "CloudFlare Family"
            ],
            "blocked_count": 1
        },
        "archives": {
            "last": "2026-10-26T02:05:38Z",
            "first": "2026-10-09T13:55:42Z",
            "changes": 1,
            "days_archived": 2,
            "scans_per_day": 0.06,
            "avg_page_bytes": 17801
        },
        "robots_txt": {
            "agents": [
                "*"
            ],
            "present": true,
            "sitemaps": [
                "https://fagruviltrade.com/sitemap.xml"
            ]
        },
        "sitemap": {
            "present": true,
            "url_count": 5
        },
        "social_tags": {
            "title": "Fagruvil, la tua Piattaforma di Trading Intelligente",
            "robots": "index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1",
            "description": "Stabilità e precisione in ogni mercato. Fagruvil offre un sistema di trading algoritmico con oltre 60 mercati attivi e continuità operativa 24/7.",
            "canonicalUrl": "https://fagruviltrade.com/"
        },
        "trackers": {
            "requests": 46,
            "trackers": [
                {
                    "name": "Cloudflare",
                    "company": "Cloudflare",
                    "country": "US",
                    "category": "Hosting",
                    "requests": 1
                },
                {
                    "name": "jsDelivr",
                    "company": "jsDelivr",
                    "category": "Hosting",
                    "requests": 2
                }
            ]
        },
        "mixed_content": {
            "third_party_scripts": 0
        },
        "status": {
            "up": true,
            "code": 200,
            "timings": {
                "dns": 408,
                "tls": 121,
                "wait": 88,
                "connect": 71,
                "download": 141
            },
            "response_ms": 829
        },
        "tls_connection": {
            "alpn": "h2",
            "cipher": "TLS_AES_128_GCM_SHA256",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                22,
                80,
                443
            ]
        },
        "carbon": {
            "bytes": 90382,
            "co2_grams": 0.0033,
            "cleaner_than": 24
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "162.159.26.92",
                    "host": "ns1.dyna-ns.net"
                },
                {
                    "ip": "162.159.24.5",
                    "host": "ns2.dyna-ns.net"
                }
            ],
            "zone": "fagruviltrade.com"
        },
        "cookies": {
            "cookies": [
                {
                    "name": "cf-c",
                    "http_only": true,
                    "same_site": "Lax"
                },
                {
                    "name": "__cf_clicked"
                },
                {
                    "name": "ph_phc_t6w4wzJE2sbz4ro8LmZZTssm5go3KD6mP7QsqcDQRSp6_posthog",
                    "secure": true,
                    "same_site": "Lax"
                }
            ]
        },
        "location": {
            "ip": "158.94.210.119",
            "asn": "202412",
            "org": "Omegatech LTD",
            "city": "Amsterdam",
            "country": "NL"
        },
        "ssl": {
            "issuer": "Let's Encrypt / YE2",
            "subject": "fagruviltrade.com"
        },
        "dns": {
            "A": [
                "158.94.210.119"
            ],
            "NS": [
                "ns2.dyna-ns.net",
                "ns1.dyna-ns.net"
            ],
            "SOA": "{\"nsname\": \"ns1.dyna-ns.net\", \"hostmaster\": \"hostmaster.fagruviltrade.com\", \"serial\": 2026082801, \"refresh\": 16384, \"retry\": 2048, \"expire\": 1209600, \"minttl\": 300}"
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "hsts": {
            "message": "Site does not serve any HSTS headers."
        },
        "http_security": {
            "xFrameOptions": false,
            "referrerPolicy": "same-origin",
            "xXSSProtection": false,
            "permissionsPolicy": false,
            "xContentTypeOptions": "nosniff",
            "contentSecurityPolicy": false,
            "strictTransportPolicy": false,
            "crossOriginOpenerPolicy": false,
            "crossOriginEmbedderPolicy": false,
            "crossOriginResourcePolicy": false
        },
        "get_ip": {
            "ip": "158.94.210.119",
            "family": 4
        },
        "redirects": {
            "chain": [
                "https://fagruviltrade.com"
            ]
        },
        "linked_pages": {
            "internal_count": 28
        },
        "whois": {
            "registrar": "Dynadot Inc",
            "created": "2026-06-23T09:06:28Z",
            "updated": "2026-08-13T12:46:23Z",
            "expires": "2027-06-23T09:06:28Z",
            "status": [
                "clientTransferProhibited https://icann.org/epp"
            ],
            "nameservers": [
                "ns1.dyna-ns.net",
                "ns2.dyna-ns.net"
            ]
        },
        "headers": {
            "headers": {
                "content-type": "text/html; charset=utf-8",
                "x-content-type-options": "nosniff",
                "referrer-policy": "same-origin"
            }
        }
    }
}
```