# PhishDestroy domain threat record: ferninvest-bury.digital Content language: English Canonical HTML report: https://phishdestroy.io/domain/ferninvest-bury.digital/ Machine-readable companion: https://phishdestroy.io/domain/ferninvest-bury.digital/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: unknown - First observed by PhishDestroy: 2026-10-26 20:44:13 UTC - Stored record updated: 2026-10-26 21:10:49 UTC - VirusTotal detections in the stored snapshot: 17/92 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: no stored flag ## Stored infrastructure - Observed IP address: 185.62.56.63 - Registrar in stored WHOIS data: NICENIC INTERNATIONAL GROUP CO., LIMITED - Last stored HTTP status: 200 - Registration date in stored WHOIS data: 2026-03-12 17:52:18 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a09b0e-d9fc-7168-8629-2fc89b233103/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/ferninvest-bury.digital - Certificate Transparency search: https://crt.sh/?q=%25.ferninvest-bury.digital - Web Archive lookup: https://web.archive.org/web/*/https://ferninvest-bury.digital/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview PhishDestroy added ferninvest-bury.digital to its internal blocklist on 2026-10-26 following an intake that highlighted twelve VirusTotal vendors labeling the domain as malicious. A recorded page title read “Fern Invest Bury — Premium AI Trading Automation & Bot Orchestration” and the HTTP response was 200 on that date. This listing reflects PhishDestroy's assessment and does not constitute proof of any specific wrongdoing. How the scam works The available evidence does not reveal a concrete attack vector; instead, the domain is flagged as generally suspicious, a category that often includes sites that lure visitors with false investment or trading offers to harvest credentials or install unwanted software. Such pages typically request personal or financial information under the guise of AI‑driven trading services, but no specific credential‑collection form or malware was observed on this page. Evidence VirusTotal (analysis 2026-10-21) reported 12 malicious and 5 suspicious detections from 92 engines, with vendors such as BitDefender, Kaspersky and Sophos marking it as phishing or malicious. Google Safe Browsing (checked 2026-10-26) did not flag the domain. urlscan.io captured the site on 2026-09-13; its machine‑learning engine gave a malicious score of 99, though the overall verdict was clean. Cloudflare Radar (scan 2026-10-26) classified the domain as malicious and associated it with malware and phishing tags. OTX listed one pulse referencing the domain, and PhishDestroy's internal blocklist marks it true while external blocklists showed no entries on the check date. Infrastructure The domain was registered on 2026-03-12 through NICENIC INTERNATIONAL GROUP CO., LIMITED. The domain was observed to resolve to 185.62.56.63, which was associated with Snel.com B.V. in the Netherlands. TLS was provided by ZeroSSL ECC DV SSL CA 2, valid from 2026-07-21 to 2026-10-19. Cloudflare name servers (roan.ns.cloudflare.com, ximena.ns.cloudflare.com) are in use, and the site served content over HTTPS with TLS 1.3. What to do Visitors should avoid entering any credentials, personal data or financial information on the site and, if such data was submitted, change associated passwords immediately. Security teams should block the exact domain, monitor outbound traffic for connections to 185.62.56.63, and review logs for any user interaction with ferninvest-bury.digital. No further action is required for the certificate or DNS records beyond standard monitoring. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a09b0e-d9fc-7168-8629-2fc89b233103/ Cloudflare Radar report: https://radar.cloudflare.com/scan/5bbc5557-2764-452e-bb58-59243dc99bbd Stored capture screenshot: https://urlscan.io/screenshots/01a09b0e-d9fc-7168-8629-2fc89b233103.png Cloudflare Radar screenshot (2026-10-26T20:52:45Z): https://screenshots.phishdestroy.io/cf/5bbc5557-2764-452e-bb58-59243dc99bbd.png URLScan screenshot (2026-09-03T12:44:19Z): https://screenshots.phishdestroy.io/us/01a0674c-5a6a-71ef-a8bc-620680b47985.png URLScan capture report: https://urlscan.io/result/01a0674c-5a6a-71ef-a8bc-620680b47985/ URLScan screenshot (2026-10-26T20:51:47Z): https://screenshots.phishdestroy.io/us/01a179fb-a29f-732e-aee6-11c82075bdbc.png URLScan capture report: https://urlscan.io/result/01a179fb-a29f-732e-aee6-11c82075bdbc/ VirusTotal report: https://www.virustotal.com/gui/domain/ferninvest-bury.digital Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=ferninvest-bury.digital Archived copy: https://web.archive.org/web/20261026204524/https://ferninvest-bury.digital/ Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-26 20:55:55 UTC ## Stored page captures - Primary capture: https://urlscan.io/screenshots/01a09b0e-d9fc-7168-8629-2fc89b233103.png Captured: 2026-10-26 20:44:13 UTC - URLScan capture 1: https://screenshots.phishdestroy.io/01a09b0e-d9fc-7168-8629-2fc89b233103.png Source report: https://urlscan.io/result/01a09b0e-d9fc-7168-8629-2fc89b233103/ - URLScan · 2026-09-03: https://screenshots.phishdestroy.io/us/01a0674c-5a6a-71ef-a8bc-620680b47985.png Captured: 2026-09-03 12:44:19 UTC Source report: https://urlscan.io/result/01a0674c-5a6a-71ef-a8bc-620680b47985/ SHA-256: c6e622e38b0544f7fd35e955c0827e546586f7f4622ef6d58eda52b3d50b8eda - URLScan · 2026-10-26: https://screenshots.phishdestroy.io/us/01a179fb-a29f-732e-aee6-11c82075bdbc.png Captured: 2026-10-26 20:51:47 UTC Source report: https://urlscan.io/result/01a179fb-a29f-732e-aee6-11c82075bdbc/ SHA-256: 233eb1a58748ac98325b0a2fe017d3d1f01a514af0cb9c50b7f4ae68c89b126d - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/5bbc5557-2764-452e-bb58-59243dc99bbd.png Captured: 2026-10-26 20:52:45 UTC Source report: https://radar.cloudflare.com/scan/5bbc5557-2764-452e-bb58-59243dc99bbd SHA-256: 156f9c096f2f226b8bbfcb01bf984dbca4558dee4643a2903ef92b93ddfffed0 ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-26T20:55:17Z", "uuid": "01a09b0e-d9fc-7168-8629-2fc89b233103", "scanned_at": "2026-09-13T13:57:22Z", "final_url": "https://ferninvest-bury.digital/", "status": 200, "redirected": "https-only", "redirects": [ { "to": "https://ferninvest-bury.digital/", "from": "http://ferninvest-bury.digital/", "status": 307 } ], "ip": "185.62.56.63", "ptr": "s46060.hosted-by-snel.com", "domains": [ "cdn.jsdelivr.net", "cdnjs.cloudflare.com", "fonts.gstatic.com", "www.cloudflare.com", "fonts.googleapis.com" ], "ips": [ "104.17.207.5", "142.251.110.94", "104.16.123.96", "2606:4700::6811:d005", "104.17.24.14", "2a00:1450:4001:c1f::5f", "185.62.56.63" ], "asns": [ "13335", "15169", "62370" ], "countries": [ "US", "DE", "NL" ], "doc_hash": "4a9524adeb6dfdb4c0945453272e5c1ad2f83f4b1f2c8bb87fbb9879b06bbd9a", "script_hashes": [ "dcffb692e1e6bda024f7830b7f5a3fa758c06ede0ac195daebf2c9fe01442f3f" ], "globals": [ "toggleTermsPopup", "intlTelInput", "ClientJS", "__visitorCountry" ], "storage_keys": [ "t_cfp" ], "tls": { "san": [ "ferninvest-bury.digital" ], "cipher": "AES_128_GCM", "issuer": "ZeroSSL ECC DV SSL CA 2", "subject": "ferninvest-bury.digital", "protocol": "TLS 1.3", "valid_to": "2026-10-19T23:59:59Z", "valid_from": "2026-07-21T00:00:00Z" }, "domain_age_days": 184, "apex_age_days": 184, "tls_age_days": 54, "tls_valid_days": 90, "requests": 21, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 99, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "content-type": "text/html; charset=utf-8", "referrer-policy": "no-referrer-when-downgrade" } }, "cf": { "v": 1, "fetched_at": "2026-10-26T20:55:19Z", "uuid": "5bbc5557-2764-452e-bb58-59243dc99bbd", "scanned_at": "2026-10-26T20:52:45Z", "final_url": "https://ferninvest-bury.digital/", "status": 200, "history": [ { "url": "https://ferninvest-bury.digital/", "status": 200 } ], "dom_hash": "35c7761d95c216393ccb36f30688fe34f59e2e45517e05fc7ac17f1fc75886f5", "doc_hash": "8271bf168c4e163122dca88ae20e70abcce3a5aa2e69507e071d707eea9ffa8f", "phishing_v2": [ "phishing" ], "domain_risks": [ "Malware", "Security threats", "CIPA Filter", "CIPA" ], "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "ferninvest-bury.digital", "type": "A", "value": "185.62.56.63" } ], "dnssec_valid": false, "ip": "185.62.56.63", "verdict": { "tags": [ "malware" ], "malicious": true, "categories": [ "malware" ] }, "whois": { "registrar": "NICENIC INTERNATIONAL GROUP CO., LIMITED", "created": "2026-03-12T18:52:18Z", "updated": "2026-08-12T07:57:43Z", "expires": "2027-03-12T18:52:18Z", "nameservers": [ "roan.ns.cloudflare.com", "ximena.ns.cloudflare.com" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-26T20:51:12Z", "analysis_at": "2026-10-21T18:01:45Z", "stats": { "timeout": 0, "harmless": 42, "malicious": 12, "suspicious": 5, "undetected": 33 }, "detections": { "CRDF": "malicious", "DNS8": "suspicious", "ESET": "suspicious", "VIPRE": "phishing", "G-Data": "phishing", "Lionic": "phishing", "Sophos": "phishing", "CyRadar": "phishing", "Webroot": "malicious", "Fortinet": "spam", "SOCRadar": "phishing", "Kaspersky": "phishing", "Seclookup": "malicious", "Gridinsoft": "suspicious", "BitDefender": "phishing", "alphaMountain.ai": "spam", "Forcepoint ThreatSeeker": "phishing" }, "reputation": 0, "created": "2026-03-12T00:00:00Z", "updated": "2026-03-13T00:00:00Z", "first_seen": "2026-03-13T05:55:17Z", "dns": [ { "ttl": 21600, "type": "NS", "value": "roan.ns.cloudflare.com" }, { "ttl": 1800, "type": "SOA", "rname": "dns.cloudflare.com", "value": "roan.ns.cloudflare.com" }, { "ttl": 300, "type": "A", "value": "185.62.56.63" }, { "ttl": 21600, "type": "NS", "value": "ximena.ns.cloudflare.com" } ], "dns_at": "2026-10-21T18:07:18Z", "jarm": "40d40d40d00000000043d43d00043d6aff5ab0f4fc31897186312c9e639319", "cert": { "san": [ "ferninvest-bury.digital" ], "issuer": "ZeroSSL GmbH / ZeroSSL ECC DV SSL CA 2", "serial": "4a035e02af25d4caf7134e9434070eee", "sha256": "4d9be96e487edbbd0f1d7ec3686ad3e86fa45a44bdf8b573093df3859f0fc086", "subject": "ferninvest-bury.digital", "valid_to": "2026-12-18T23:59:59Z", "valid_from": "2026-09-19T00:00:00Z" }, "whois": [], "rdap": { "status": [ "client delete prohibited", "client transfer prohibited" ], "events": { "expiration": "2027-03-12T16:00:00Z", "registration": "2026-03-12T16:00:00Z", "registrar expiration": "2027-03-12T16:00:00Z", "last update of RDAP database": "2026-03-12T16:00:00Z" }, "registrar": "NICENIC INTERNATIONAL GROUP CO., LIMITED", "registrar_iana_id": "3765" } }, "webcheck": { "v": 1, "fetched_at": "2026-10-26T20:55:34Z", "mail_config": { "spf_lookups": 0 }, "caa_records": { "domain": "ferninvest-bury.digital" }, "block_lists": { "resolvers": 12, "blocked_by": [ "CloudFlare Family" ], "blocked_count": 1 }, "archives": { "last": "2026-10-26T13:59:40Z", "first": "2026-10-26T13:59:40Z", "changes": 0, "days_archived": 1, "avg_page_bytes": 13532 }, "robots_txt": { "agents": [ "*" ], "present": true, "sitemaps": [ "https://ferninvest-bury.digital/sitemap.xml" ] }, "sitemap": { "present": true, "url_count": 175 }, "social_tags": { "ogUrl": "https://ferninvest-bury.digital/", "title": "Fern Invest Bury — Premium AI Trading Automation & Bot Orchestration", "ogType": "website", "robots": "index, follow", "ogTitle": "Fern Invest Bury — Premium AI Trading Automation & Bot Orchestration", "ogSiteName": "Fern Invest Bury", "themeColor": "#0d1118", "description": "Fern Invest Bury delivers enterprise-grade automation for trading pipelines, featuring AI-driven guidance, bot orchestration, and robust tools for precise execution across assets.", "twitterCard": "summary", "canonicalUrl": "https://ferninvest-bury.digital/", "ogDescription": "Experience AI-powered trading assistance and automated bot workflows crafted for precise execution, real-time monitoring, and scalable control." }, "trackers": { "requests": 20, "trackers": [ { "name": "Cloudflare", "company": "Cloudflare", "country": "US", "category": "Hosting", "requests": 7 }, { "name": "Google Fonts", "company": "Google", "country": "US", "category": "Hosting", "requests": 1 }, { "name": "Google Static", "company": "Google", "country": "US", "category": "Hosting", "requests": 2 }, { "name": "jsDelivr", "company": "jsDelivr", "category": "Hosting", "requests": 3 } ] }, "mixed_content": { "no_sri": [ "https://cdn.jsdelivr.net/npm/intl-tel-input@23/build/js/intlTelInput.min.js" ], "third_party_scripts": 1 }, "status": { "up": true, "code": 200, "timings": { "dns": 18, "tls": 29, "wait": 19, "connect": 23, "download": 70 }, "response_ms": 159 }, "tls_connection": { "alpn": "h2", "cipher": "TLS_AES_128_GCM_SHA256", "protocol": "TLSv1.3", "versions": [ "TLSv1.2", "TLSv1.3" ], "authorized": true, "ocsp_stapled": true, "forward_secrecy": true }, "ports": { "open": [ 80, 443 ] }, "carbon": { "bytes": 48587, "co2_grams": 0.0018, "cleaner_than": 38 }, "dns_server": { "ns": [ { "ip": "162.159.38.10", "host": "ximena.ns.cloudflare.com" }, { "ip": "173.245.59.226", "host": "roan.ns.cloudflare.com" } ], "zone": "ferninvest-bury.digital" }, "location": { "ip": "185.62.56.63", "asn": "62370", "org": "Snel.com B.V.", "city": "Schiedam", "country": "NL" }, "ssl": { "issuer": "ZeroSSL GmbH / ZeroSSL ECC DV SSL CA 2", "subject": "ferninvest-bury.digital" }, "dns": { "A": [ "185.62.56.63" ], "NS": [ "roan.ns.cloudflare.com", "ximena.ns.cloudflare.com" ], "SOA": "{\"nsname\": \"roan.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2418470356, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}" }, "dnssec": { "ds": false, "rrsig": false, "dnskey": false }, "hsts": { "message": "Site does not serve any HSTS headers." }, "http_security": { "xFrameOptions": false, "referrerPolicy": "no-referrer-when-downgrade", "xXSSProtection": false, "permissionsPolicy": false, "xContentTypeOptions": false, "contentSecurityPolicy": false, "strictTransportPolicy": false, "crossOriginOpenerPolicy": false, "crossOriginEmbedderPolicy": false, "crossOriginResourcePolicy": false }, "get_ip": { "ip": "185.62.56.63", "family": 4 }, "redirects": { "chain": [ "https://ferninvest-bury.digital" ] }, "tech_stack": { "technologies": [ "Cloudflare", "Cloudflare Turnstile", "ClientJS", "Priority Hints", "jsDelivr", "Google Font API", "Font Awesome", "cdnjs", "Open Graph", "HTTP/3" ] }, "linked_pages": { "internal_count": 11 }, "headers": { "headers": { "content-type": "text/html; charset=utf-8", "referrer-policy": "no-referrer-when-downgrade" } } } } ```