# PhishDestroy domain threat record: faroprophitanza.shop

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/faroprophitanza.shop/
Machine-readable companion: https://phishdestroy.io/domain/faroprophitanza.shop/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-26 02:05:35 UTC
- Last availability or vendor check: 2026-10-27 23:05:05 UTC
- Stored record updated: 2026-10-27 23:22:28 UTC
- VirusTotal detections in the stored snapshot: 16/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored infrastructure

- Observed IP address: 172.67.215.241
- Registrar in stored WHOIS data: NETIM
- Last stored HTTP status: 200
- Registration date in stored WHOIS data: 2026-09-10 05:33:06 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a1016c-2f38-766c-bacd-8ce27814b823/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/faroprophitanza.shop
- Certificate Transparency search: https://crt.sh/?q=%25.faroprophitanza.shop
- Web Archive lookup: https://web.archive.org/web/*/https://faroprophitanza.shop/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
The captured screenshot shows a dark-themed landing page headed as an autonomous trading bot toolkit, with a form labeled Open your gateway requiring first name, last name, email address and phone number above a Create Account button. Beside it the page promoted AI-driven guidance, secured connections, real-time market insights and end-to-end encrypted connections, while a disclaimer banner stated the site functions solely as a marketing platform and does not provide trading, brokerage or investment services. PhishDestroy classified the domain as a fake crypto exchange and listed it on 2026-10-26, its first-seen date.

How the scam works
The form harvests contact details from visitors lured by promises of automated AI trading, building a lead list that operators use to continue the approach by email or phone. In this category of scam, the follow-up presents a polished trading interface and pressure to deposit cryptocurrency into a platform with no genuine brokerage behind it. Funds routed through such a venue would be outside the protection of any regulated exchange.

Evidence
The screenshot shows the Open your gateway form and its marketing claims; site inspection recorded ClientJS fingerprinting and a toggleTermsPopup handler, trackers for Cloudflare, Google Fonts and jsDelivr, and one distinct script SHA256 hash (ccf00d1923b0) for pivoting. The urlscan engine verdict marked the 2026-10-03 capture malicious with an ML score of 93, and Cloudflare Radar returned a malicious malware verdict on 2026-10-26. VirusTotal flagged the domain as malicious, with vendors such as Kaspersky, Sophos and BitDefender labelling it phishing. Google Safe Browsing did not flag it and Spamhaus did not list it on 2026-10-26, external blocklists recorded 0 entries while the PhishDestroy internal blocklist flagged it, AlienVault OTX held 1 pulse, and the page fetch ended at the same domain with no cross-site redirect.

Infrastructure
faroprophitanza.shop was registered through NETIM on 2026-09-10 and served behind the Cloudflare WAF. Notable weaknesses: DNSSEC unsigned, no SPF, DKIM or DMARC. CAA present; TLS 1.3, TLS_AES_256_GCM_SHA384, forward secrecy, ALPN h2; CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy and COOP present, COEP and CORP absent.

What to do
If you submitted the form's details, treat any follow-up message as unverified, change any password you reused on the genuine service where you hold an account, and enable two-factor authentication there. If you connected a wallet or sent funds after contacting this site, review and revoke those connections in your wallet. Defenders should block faroprophitanza.shop in DNS and web filters and check for its form fields in submitted lead records.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a1016c-2f38-766c-bacd-8ce27814b823/
Cloudflare Radar report: https://radar.cloudflare.com/scan/a1cf553c-ad86-4859-86b4-0ccb5bf57d0f
Stored capture screenshot: https://urlscan.io/screenshots/01a1016c-2f38-766c-bacd-8ce27814b823.png
Cloudflare Radar screenshot (2026-10-26T02:09:42Z): https://screenshots.phishdestroy.io/cf/a1cf553c-ad86-4859-86b4-0ccb5bf57d0f.png
URLScan screenshot (2026-09-28T11:49:36Z): https://screenshots.phishdestroy.io/us/01a0e7d9-2fa3-7014-8359-49fd92cf0e64.png
URLScan capture report: https://urlscan.io/result/01a0e7d9-2fa3-7014-8359-49fd92cf0e64/
URLScan screenshot (2026-09-28T12:00:51Z): https://screenshots.phishdestroy.io/us/01a0e7e3-8137-7416-89d5-96e4e5b73a5b.png
URLScan capture report: https://urlscan.io/result/01a0e7e3-8137-7416-89d5-96e4e5b73a5b/
URLScan screenshot (2026-09-29T11:29:51Z): https://screenshots.phishdestroy.io/us/01a0eced-83f8-7616-b763-a6122cbdcfee.png
URLScan capture report: https://urlscan.io/result/01a0eced-83f8-7616-b763-a6122cbdcfee/
URLScan screenshot (2026-10-02T12:07:15Z): https://screenshots.phishdestroy.io/us/01a0fc82-d89f-71ff-b828-f7355e73d476.png
URLScan capture report: https://urlscan.io/result/01a0fc82-d89f-71ff-b828-f7355e73d476/
URLScan screenshot (2026-10-02T18:29:20Z): https://screenshots.phishdestroy.io/us/01a0fde0-a9f0-745d-9f6d-719b14283c3a.png
URLScan capture report: https://urlscan.io/result/01a0fde0-a9f0-745d-9f6d-719b14283c3a/
VirusTotal report: https://www.virustotal.com/gui/domain/faroprophitanza.shop
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=faroprophitanza.shop
Archived copy: https://web.archive.org/web/20261026020747/https://faroprophitanza.shop/
Revoke token approvals: https://revoke.cash/
Report crypto fraud (Chainabuse): https://www.chainabuse.com/report
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-26 20:43:47 UTC

## Stored page captures

- Primary capture: https://urlscan.io/screenshots/01a1016c-2f38-766c-bacd-8ce27814b823.png
  Captured: 2026-10-26 02:05:35 UTC
- URLScan · 2026-09-28: https://screenshots.phishdestroy.io/us/01a0e7d9-2fa3-7014-8359-49fd92cf0e64.png
  Captured: 2026-09-28 11:49:36 UTC
  Source report: https://urlscan.io/result/01a0e7d9-2fa3-7014-8359-49fd92cf0e64/
  SHA-256: e97e0dbd0065bd31ffab7a213688b6d7aaf605fb013257cc8c83c770970decc7
- URLScan · 2026-09-28: https://screenshots.phishdestroy.io/us/01a0e7e3-8137-7416-89d5-96e4e5b73a5b.png
  Captured: 2026-09-28 12:00:51 UTC
  Source report: https://urlscan.io/result/01a0e7e3-8137-7416-89d5-96e4e5b73a5b/
  SHA-256: c3e108e23302d69bb02a0c0c0088c0f222498a1e4612b38da522dd846c07043e
- URLScan · 2026-09-29: https://screenshots.phishdestroy.io/us/01a0eced-83f8-7616-b763-a6122cbdcfee.png
  Captured: 2026-09-29 11:29:51 UTC
  Source report: https://urlscan.io/result/01a0eced-83f8-7616-b763-a6122cbdcfee/
  SHA-256: 9c98ef4bcdc8bbfcc6f185ac83cec8b7cc473613f32b57e8b46690e958cb2c60
- URLScan · 2026-10-02: https://screenshots.phishdestroy.io/us/01a0fc82-d89f-71ff-b828-f7355e73d476.png
  Captured: 2026-10-02 12:07:15 UTC
  Source report: https://urlscan.io/result/01a0fc82-d89f-71ff-b828-f7355e73d476/
  SHA-256: 2f707a3143d1bc88e9d8ba297580997ada8b1079b28856ce8ecd0d087648e4d6
- URLScan · 2026-10-02: https://screenshots.phishdestroy.io/us/01a0fde0-a9f0-745d-9f6d-719b14283c3a.png
  Captured: 2026-10-02 18:29:20 UTC
  Source report: https://urlscan.io/result/01a0fde0-a9f0-745d-9f6d-719b14283c3a/
  SHA-256: 346e2870757cf03077beafa9b62db065830e020f645da73da893e21b33980769
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/a1cf553c-ad86-4859-86b4-0ccb5bf57d0f.png
  Captured: 2026-10-26 02:09:42 UTC
  Source report: https://radar.cloudflare.com/scan/a1cf553c-ad86-4859-86b4-0ccb5bf57d0f
  SHA-256: 03fdeefb5a50645c7b6f959ea78655f342fdf07c1b2ba48d2f28fd62f8cc7459

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-26T02:08:46Z",
        "uuid": "01a1016c-2f38-766c-bacd-8ce27814b823",
        "scanned_at": "2026-10-03T11:00:55Z",
        "final_url": "https://faroprophitanza.shop/",
        "status": 200,
        "ip": "172.67.215.241",
        "domains": [
            "cdnjs.cloudflare.com",
            "cdn.jsdelivr.net",
            "fonts.googleapis.com",
            "static.cloudflareinsights.com"
        ],
        "ips": [
            "151.101.1.229",
            "142.251.45.202",
            "104.17.24.14",
            "172.67.215.241"
        ],
        "asns": [
            "54113",
            "15169",
            "13335"
        ],
        "countries": [
            "US"
        ],
        "doc_hash": "e61a2bdebf494d1f445b3296f5d5dd3e71727b1d6b42eeb231a4bfb65bf0f49c",
        "script_hashes": [
            "ccf00d1923b0131a10e0c6d26f95e5dee6ebf8621a27e83c5a2f68a2e0093142"
        ],
        "globals": [
            "LANG_MSGS",
            "ClientJS",
            "_ev045hjl",
            "toggleTermsPopup",
            "__cfQR",
            "__cfRLUnblockHandlers",
            "__lgT0"
        ],
        "cookies": [
            "entry_url"
        ],
        "tls": {
            "san": [
                "faroprophitanza.shop"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "WE1",
            "subject": "faroprophitanza.shop",
            "protocol": "QUIC",
            "valid_to": "2026-12-10T10:06:15Z",
            "valid_from": "2026-09-11T09:06:19Z"
        },
        "domain_age_days": 22,
        "apex_age_days": 22,
        "tls_age_days": 22,
        "tls_valid_days": 90,
        "requests": 18,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 93,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "cloudflare",
            "content-type": "text/html; charset=utf-8",
            "strict-transport-security": "max-age=15552000; includeSubDomains; preload",
            "content-security-policy": "script-src 'self' 'unsafe-inline' 'unsafe-eval' https://static.cloudflare.com https://cdn.jsdelivr.net; frame-ancestors 'self'; connect-src 'self' https://cloudflareinsights.com; style-src 'self' 'uns",
            "x-frame-options": "SAMEORIGIN",
            "x-content-type-options": "nosniff",
            "referrer-policy": "no-referrer-when-downgrade",
            "permissions-policy": "camera=(), microphone=(), geolocation=()",
            "cross-origin-opener-policy": "same-origin"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-26T02:12:05Z",
        "uuid": "a1cf553c-ad86-4859-86b4-0ccb5bf57d0f",
        "scanned_at": "2026-10-26T02:09:42Z",
        "final_url": "https://faroprophitanza.shop/",
        "status": 200,
        "history": [
            {
                "url": "https://faroprophitanza.shop/",
                "status": 200
            }
        ],
        "dom_hash": "520d999fd4f35fd02ab290c42eafe19195635d8d9cbca3387c7c2ebbf4fca498",
        "doc_hash": "04416a08a0f3f62941df3cbe902779180b206a642a404fa012c1834baf1a3557",
        "phishing_v2": [
            "phishing"
        ],
        "domain_risks": [
            "Malware",
            "Security threats",
            "CIPA Filter",
            "CIPA"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "faroprophitanza.shop",
                "type": "A",
                "value": "104.21.16.212"
            },
            {
                "name": "faroprophitanza.shop",
                "type": "A",
                "value": "172.67.215.241"
            },
            {
                "name": "faroprophitanza.shop",
                "type": "AAAA",
                "value": "2606:4700:3030::6815:10d4"
            },
            {
                "name": "faroprophitanza.shop",
                "type": "AAAA",
                "value": "2606:4700:3033::ac43:d7f1"
            }
        ],
        "dnssec_valid": false,
        "ip": "104.21.16.212",
        "verdict": {
            "tags": [
                "malware"
            ],
            "malicious": true,
            "categories": [
                "malware"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-26T02:08:19Z",
        "analysis_at": "2026-10-18T16:39:37Z",
        "stats": {
            "timeout": 0,
            "harmless": 44,
            "malicious": 13,
            "suspicious": 3,
            "undetected": 32
        },
        "detections": {
            "CRDF": "malicious",
            "DNS8": "suspicious",
            "ESET": "suspicious",
            "VIPRE": "phishing",
            "G-Data": "phishing",
            "Lionic": "phishing",
            "Sophos": "phishing",
            "CyRadar": "phishing",
            "Fortinet": "phishing",
            "SOCRadar": "phishing",
            "Kaspersky": "phishing",
            "Seclookup": "malicious",
            "Gridinsoft": "suspicious",
            "BitDefender": "phishing",
            "alphaMountain.ai": "phishing",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "first_seen": "2026-09-11T10:33:17Z",
        "dns": [
            {
                "ttl": 300,
                "type": "A",
                "value": "172.67.215.241"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3033::ac43:d7f1"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "104.21.16.212"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "margaret.ns.cloudflare.com"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "terry.ns.cloudflare.com"
            },
            {
                "ttl": 1800,
                "type": "SOA",
                "rname": "dns.cloudflare.com",
                "value": "margaret.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3030::6815:10d4"
            }
        ],
        "dns_at": "2026-10-18T16:44:55Z",
        "jarm": "27d40d40d00040d00042d43d00041df04c41293ba84f6efe3a613b22f983e6",
        "cert": {
            "san": [
                "faroprophitanza.shop"
            ],
            "issuer": "Google Trust Services / WE1",
            "serial": "6ed75c325511064413372e394630f574",
            "sha256": "4bd454a3e908554e5a1b303dac87037e96e9f51a7d94c2c05865b4f8b497327c",
            "subject": "faroprophitanza.shop",
            "valid_to": "2026-12-10T10:06:15Z",
            "valid_from": "2026-09-11T09:06:19Z"
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-26T02:12:22Z",
        "mail_config": {
            "spf_lookups": 0
        },
        "caa_records": {
            "domain": "faroprophitanza.shop"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_by": [
                "CloudFlare Family"
            ],
            "blocked_count": 1
        },
        "archives": {
            "last": "2026-10-26T02:07:47Z",
            "first": "2026-09-11T13:35:48Z",
            "changes": 1,
            "days_archived": 2,
            "scans_per_day": 0.02,
            "avg_page_bytes": 40791
        },
        "robots_txt": {
            "agents": [
                "*"
            ],
            "present": true,
            "sitemaps": [
                "https://faroprophitanza.shop/sitemap.xml"
            ]
        },
        "sitemap": {
            "present": true,
            "url_count": 140
        },
        "social_tags": {
            "ogUrl": "https://faroprophitanza.shop/",
            "title": "Faro Prophitanza | AI Trading Platform | Official Gateway",
            "ogType": "website",
            "robots": "index, follow",
            "ogTitle": "Faro Prophitanza | AI-Powered Trading Intelligence",
            "ogSiteName": "Faro Prophitanza",
            "themeColor": "#0D1117",
            "description": "Faro Prophitanza delivers AI-driven trading support, automated bot tools, real-time market insights, and secure account access for modern traders.",
            "twitterCard": "summary",
            "canonicalUrl": "https://faroprophitanza.shop/",
            "ogDescription": "Faro Prophitanza delivers AI-driven trading support, automated bot tools, real-time market insights, and secure account access for modern traders."
        },
        "trackers": {
            "requests": 18,
            "trackers": [
                {
                    "name": "Cloudflare",
                    "company": "Cloudflare",
                    "country": "US",
                    "category": "Hosting",
                    "requests": 8
                },
                {
                    "name": "Google Fonts",
                    "company": "Google",
                    "country": "US",
                    "category": "Hosting",
                    "requests": 1
                },
                {
                    "name": "jsDelivr",
                    "company": "jsDelivr",
                    "category": "Hosting",
                    "requests": 1
                }
            ]
        },
        "mixed_content": {
            "no_sri": [
                "https://static.cloudflare.com/beacon.min.js",
                "https://challenges.cloudflare.com/turnstile/v0/api.js",
                "https://cdn.jsdelivr.net/npm/clientjs@0.2.1/dist/client.min.js"
            ],
            "third_party_scripts": 3
        },
        "status": {
            "up": true,
            "code": 200,
            "timings": {
                "dns": 18,
                "tls": 13,
                "wait": 138,
                "connect": 22,
                "download": 11
            },
            "response_ms": 202
        },
        "tls_connection": {
            "alpn": "h2",
            "cipher": "TLS_AES_256_GCM_SHA384",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                80,
                443,
                8080
            ]
        },
        "carbon": {
            "bytes": 134329,
            "co2_grams": 0.0049,
            "cleaner_than": 16
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "172.64.34.107",
                    "host": "margaret.ns.cloudflare.com"
                },
                {
                    "ip": "172.64.33.237",
                    "host": "terry.ns.cloudflare.com"
                }
            ],
            "zone": "faroprophitanza.shop"
        },
        "cookies": {
            "cookies": [
                {
                    "name": "entry_url",
                    "secure": true,
                    "same_site": "Lax"
                }
            ]
        },
        "location": {
            "ip": "2606:4700:3033::ac43:d7f1",
            "asn": "13335",
            "org": "Cloudflare, Inc.",
            "city": "Toronto",
            "country": "CA"
        },
        "ssl": {
            "issuer": "Google Trust Services / WE1",
            "subject": "faroprophitanza.shop"
        },
        "dns": {
            "A": [
                "104.21.16.212",
                "172.67.215.241"
            ],
            "NS": [
                "margaret.ns.cloudflare.com",
                "terry.ns.cloudflare.com"
            ],
            "SOA": "{\"nsname\": \"margaret.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2418086644, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}",
            "AAAA": [
                "2606:4700:3030::6815:10d4",
                "2606:4700:3033::ac43:d7f1"
            ]
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "hsts": {
            "header": "max-age=63072000; includeSubDomains; preload",
            "message": "Site is compatible with the HSTS preload list!",
            "compatible": true
        },
        "http_security": {
            "xFrameOptions": "SAMEORIGIN",
            "referrerPolicy": "strict-origin-when-cross-origin",
            "xXSSProtection": false,
            "permissionsPolicy": "camera=(), microphone=(), geolocation=()",
            "xContentTypeOptions": "nosniff",
            "contentSecurityPolicy": "connect-src 'self' https://cloudflareinsights.com https://challenges.cloudflare.com; style-src 'self' 'unsafe-inline' ht",
            "strictTransportPolicy": "max-age=63072000; includeSubDomains; preload",
            "crossOriginOpenerPolicy": "same-origin",
            "crossOriginEmbedderPolicy": false,
            "crossOriginResourcePolicy": false
        },
        "firewall": {
            "waf": "Cloudflare",
            "has_waf": true
        },
        "get_ip": {
            "ip": "2606:4700:3033::ac43:d7f1",
            "family": 6
        },
        "redirects": {
            "chain": [
                "https://faroprophitanza.shop"
            ]
        },
        "linked_pages": {
            "internal_count": 11
        },
        "headers": {
            "headers": {
                "server": "cloudflare",
                "content-type": "text/html; charset=utf-8",
                "strict-transport-security": "max-age=63072000; includeSubDomains; preload",
                "content-security-policy": "connect-src 'self' https://cloudflareinsights.com https://challenges.cloudflare.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://cdnjs.cloudflare.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://static.cloudflare.com https://cdn.jsdelivr.net https://challenges.c",
                "x-frame-options": "SAMEORIGIN",
                "x-content-type-options": "nosniff",
                "referrer-policy": "strict-origin-when-cross-origin",
                "permissions-policy": "camera=(), microphone=(), geolocation=()",
                "cross-origin-opener-policy": "same-origin"
            }
        }
    }
}
```