# PhishDestroy domain threat record: fernyn-gainstead.live Content language: English Canonical HTML report: https://phishdestroy.io/domain/fernyn-gainstead.live/ Machine-readable companion: https://phishdestroy.io/domain/fernyn-gainstead.live/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: unknown - First observed by PhishDestroy: 2026-10-26 20:44:21 UTC - Stored record updated: 2026-10-26 21:10:49 UTC - VirusTotal detections in the stored snapshot: 14/92 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: no stored flag ## Stored classification - Targeted brand: ethereum ## Stored infrastructure - Observed IP address: 188.114.96.1 - Registrar in stored WHOIS data: Dynadot Inc - Last stored HTTP status: 200 - Registration date in stored WHOIS data: 2026-10-06 07:03:11 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a11636-ad78-7783-b5d5-e31297b42478/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/fernyn-gainstead.live - Certificate Transparency search: https://crt.sh/?q=%25.fernyn-gainstead.live - Web Archive lookup: https://web.archive.org/web/*/https://fernyn-gainstead.live/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview PhishDestroy listed fernyn-gainstead.live as a suspicious domain based on vendor detections and automated analysis. The recorded page title advertises an "AI‑Powered Trading Platform" for South Africa clients. The domain was first seen by PhishDestroy on 2026-10-26 with an HTTP 200 response recorded on that date. How the scam works A suspicious domain may be used to lure visitors into providing credentials, installing malware, or interacting with fraudulent financial services, but no specific malicious behavior was observed on this page. The title suggests a fake trading service that could entice users to deposit funds or share personal data. Without concrete evidence of phishing forms or malicious scripts, the risk remains generic to typical fraudulent or malware‑distribution tactics. Evidence VirusTotal scanned the domain on 2026-10-23 and reported 10 malicious and 4 suspicious detections out of 92 engines, with vendors such as alphaMountain.ai, BitDefender, CRDF, Emsisoft, Forcepoint ThreatSeeker, G‑Data, Kaspersky, SOCRadar, Sophos and VIPRE marking it malicious. Google Safe Browsing checked the domain on 2026-10-26 and did not flag it. urlscan captured the site on 2026-10-07 and gave an overall clean verdict, though its engine score flagged it as malicious. Cloudflare Radar scanned the site on 2026-10-26 and labeled it malicious under the malware category. OTX listed one pulse referencing the domain on 2026-10-26. PhishDestroy’s internal blocklist includes the domain, while external blocklists showed no matches on the check date. Infrastructure The domain was registered on 2026-10-06 through Dynadot Inc, giving it an age of one day at first sighting. Hosting is provided via Cloudflare with recorded IPs in the 188.114.96.x range and IPv6 addresses, and the TLS certificate issued by Let’s Encrypt is valid until 2027-01-04. DNSSEC is not enabled and the site runs behind Cloudflare’s WAF, with no HSTS header observed. What to do Visitors should avoid entering any credentials, personal information, or financial details on the site and should change passwords on any accounts where the same credentials may have been used. Organizations should block the exact domain at network perimeters, monitor DNS queries for the domain, and review access logs for any connections. Continue to follow PhishDestroy updates for any changes in the domain’s status. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a11636-ad78-7783-b5d5-e31297b42478/ Cloudflare Radar report: https://radar.cloudflare.com/scan/5981b5ed-b35e-4547-8476-2145105d787c Stored capture screenshot: https://urlscan.io/screenshots/01a11636-ad78-7783-b5d5-e31297b42478.png Cloudflare Radar screenshot (2026-10-26T20:52:35Z): https://screenshots.phishdestroy.io/cf/5981b5ed-b35e-4547-8476-2145105d787c.png URLScan screenshot (2026-10-06T18:15:42Z): https://screenshots.phishdestroy.io/us/01a1126d-9b97-75ed-9e48-cfd166cd39e1.png URLScan capture report: https://urlscan.io/result/01a1126d-9b97-75ed-9e48-cfd166cd39e1/ URLScan screenshot (2026-10-26T20:52:20Z): https://screenshots.phishdestroy.io/us/01a179fc-2d1d-75de-a042-a42eda193506.png URLScan capture report: https://urlscan.io/result/01a179fc-2d1d-75de-a042-a42eda193506/ VirusTotal report: https://www.virustotal.com/gui/domain/fernyn-gainstead.live Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=fernyn-gainstead.live Archived copy: https://web.archive.org/web/20261026204525/https://fernyn-gainstead.live/ Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-26 20:55:12 UTC ## Stored page captures - Primary capture: https://urlscan.io/screenshots/01a11636-ad78-7783-b5d5-e31297b42478.png Captured: 2026-10-26 20:44:21 UTC - URLScan capture 1: https://screenshots.phishdestroy.io/01a11636-ad78-7783-b5d5-e31297b42478.png Source report: https://urlscan.io/result/01a11636-ad78-7783-b5d5-e31297b42478/ - URLScan · 2026-10-06: https://screenshots.phishdestroy.io/us/01a1126d-9b97-75ed-9e48-cfd166cd39e1.png Captured: 2026-10-06 18:15:42 UTC Source report: https://urlscan.io/result/01a1126d-9b97-75ed-9e48-cfd166cd39e1/ SHA-256: ca763be40ed93a3270fdeddc438fa7c83a3ef371c44b3e5e8327f95ded440ae5 - URLScan · 2026-10-26: https://screenshots.phishdestroy.io/us/01a179fc-2d1d-75de-a042-a42eda193506.png Captured: 2026-10-26 20:52:20 UTC Source report: https://urlscan.io/result/01a179fc-2d1d-75de-a042-a42eda193506/ SHA-256: e4c6d53222f3946e2e87bd7e77c39c7aba4ac9a8c38be449b411e08516bdc39d - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/5981b5ed-b35e-4547-8476-2145105d787c.png Captured: 2026-10-26 20:52:35 UTC Source report: https://radar.cloudflare.com/scan/5981b5ed-b35e-4547-8476-2145105d787c SHA-256: b09e3ab65ea8fd4ad9bf393df2b9e64f00207113025e1e49801eb33c9fbd7219 ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-26T20:54:32Z", "uuid": "01a11636-ad78-7783-b5d5-e31297b42478", "scanned_at": "2026-10-07T11:54:12Z", "final_url": "https://fernyn-gainstead.live/", "status": 200, "redirected": "https-only", "redirects": [ { "to": "https://fernyn-gainstead.live/", "from": "http://fernyn-gainstead.live/", "status": 307 } ], "ip": "172.67.160.5", "domains": [ "cdnedge.io", "cdn.jsdelivr.net", "static.cloudflareinsights.com" ], "ips": [ "104.16.79.73", "172.67.221.102", "104.17.208.5", "172.67.160.5" ], "asns": [ "13335" ], "doc_hash": "48e8aa1bee2b68d1beff9877b2b4e641c89c0a22d98066decea1f9077c47a979", "script_hashes": [ "a628e2e0432e63e81cce6e990e98dbbd4ba9953bdeb7dc3929e40f3fcb23e516", "dc997fce7d250808113181e2ce8d8ba0b9a443bc781410a6ba9e9a19b1610821", "15a60ba80a89cb35bb9968d40f7ab1fc090059834b33fcf84f38529a41776518" ], "globals": [ "APP_LANG", "OFFER_CURRENCY_SYMBOL", "OFFER_LOCALE", "defaultLang", "intlTelInputGlobals", "intlTelInput", "intlTelInputUtils", "getLeadCookieName", "getLeadCookieDays", "hasLeadCookie", "setLeadCookie", "showAlreadyRegistered", "getFieldWrap", "clearFieldError", "setFieldError", "showFormMessage", "hideFormMessage", "validateNativeFields", "validatePhone", "focusInvalidField", "getThanksPageUrl", "integrationBaseUrl", "resolveVisitorPhoneCountry", "syncPhoneCountryHidden", "refreshFormToken", "ensureFormToken", "setupFormValidation", "LazyLoad", "toggleSeo", "toggleAccordion", "__cfBeacon", "forms", "L", "phoneErrorMap", "initConnectors", "initMobuleMenu", "initLangFlags", "initLazyLoad", "initInitials", "initTrading" ], "cookies": [ "PHPSESSID", "fernyngainstead_keitaro_subid" ], "tls": { "san": [ "*.fernyn-gainstead.live", "fernyn-gainstead.live" ], "cipher": "AES_128_GCM", "issuer": "YE2", "subject": "fernyn-gainstead.live", "protocol": "TLS 1.3", "valid_to": "2027-01-04T08:20:36Z", "valid_from": "2026-10-06T08:20:37Z" }, "domain_age_days": 1, "apex_age_days": 1, "tls_age_days": 1, "tls_valid_days": 89, "requests": 40, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 98, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "cloudflare", "content-type": "text/html; charset=UTF-8" } }, "cf": { "v": 1, "fetched_at": "2026-10-26T20:54:35Z", "uuid": "5981b5ed-b35e-4547-8476-2145105d787c", "scanned_at": "2026-10-26T20:52:35Z", "final_url": "https://fernyn-gainstead.live/", "status": 200, "history": [ { "url": "https://fernyn-gainstead.live/", "status": 200 } ], "dom_hash": "bdec05fa7a7c8c5b634d067c901916d1f3e4015af395882d5b95c6a9efb66523", "doc_hash": "29724544470f8618835f9e6e818c07d7f4b6d1a24e0a9bdafb90dae54b63083e", "phishing_v2": [ "phishing" ], "domain_risks": [ "Malware", "Security threats", "Newly Seen Domains", "Security Risks", "CIPA Filter", "CIPA" ], "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "fernyn-gainstead.live", "type": "A", "value": "188.114.96.3" }, { "name": "fernyn-gainstead.live", "type": "A", "value": "188.114.97.3" }, { "name": "fernyn-gainstead.live", "type": "AAAA", "value": "2a06:98c1:3121::3" }, { "name": "fernyn-gainstead.live", "type": "AAAA", "value": "2a06:98c1:3120::3" } ], "dnssec_valid": false, "ip": "188.114.96.3", "verdict": { "tags": [ "malware" ], "malicious": true, "categories": [ "malware" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-26T20:51:13Z", "analysis_at": "2026-10-23T14:39:15Z", "stats": { "timeout": 0, "harmless": 47, "malicious": 10, "suspicious": 4, "undetected": 31 }, "detections": { "CRDF": "malicious", "DNS8": "suspicious", "ESET": "suspicious", "VIPRE": "phishing", "G-Data": "malware", "Sophos": "phishing", "Emsisoft": "malware", "Fortinet": "spam", "SOCRadar": "phishing", "Kaspersky": "phishing", "Gridinsoft": "suspicious", "BitDefender": "phishing", "alphaMountain.ai": "phishing", "Forcepoint ThreatSeeker": "phishing" }, "reputation": 0, "tags": [ "dga" ], "first_seen": "2026-10-06T18:04:01Z", "dns": [ { "ttl": 1800, "type": "SOA", "rname": "dns.cloudflare.com", "value": "bradley.ns.cloudflare.com" }, { "ttl": 300, "type": "A", "value": "172.67.160.5" }, { "ttl": 21600, "type": "NS", "value": "bradley.ns.cloudflare.com" }, { "ttl": 300, "type": "AAAA", "value": "2606:4700:3033::ac43:a005" }, { "ttl": 300, "type": "A", "value": "104.21.14.158" }, { "ttl": 21600, "type": "NS", "value": "delilah.ns.cloudflare.com" }, { "ttl": 300, "type": "AAAA", "value": "2606:4700:3035::6815:e9e" } ], "dns_at": "2026-10-23T14:42:14Z", "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c", "cert": { "san": [ "*.fernyn-gainstead.live", "fernyn-gainstead.live" ], "issuer": "Let's Encrypt / YE2", "serial": "692de08bfea06bc2db30c38bc702e9b2c06", "sha256": "254f3e4b7844e3f6aad124ad1ef67f035f646706641a77f78c7315c7f80e28e4", "subject": "fernyn-gainstead.live", "valid_to": "2027-01-04T08:20:36Z", "valid_from": "2026-10-06T08:20:37Z" }, "rdap": { "status": [ "transfer prohibited" ], "events": { "expiration": "2027-10-06T09:03:11Z", "last changed": "2026-10-07T06:22:12Z", "registration": "2026-10-06T09:03:11Z", "registrar expiration": "2027-10-06T09:03:11Z", "last update of RDAP database": "2026-10-16T07:45:30Z" }, "registrar": "DYNADOT LLC", "registrar_iana_id": "472" } }, "webcheck": { "v": 1, "fetched_at": "2026-10-26T20:54:54Z", "mail_config": { "spf_lookups": 0 }, "caa_records": { "domain": "fernyn-gainstead.live" }, "block_lists": { "resolvers": 12, "blocked_by": [ "CloudFlare Family" ], "blocked_count": 1 }, "archives": { "last": "2026-10-26T20:45:25Z", "first": "2026-10-06T10:42:07Z", "changes": 1, "days_archived": 2, "scans_per_day": 0.05, "avg_page_bytes": 14297 }, "robots_txt": { "agents": [ "*" ], "present": true, "sitemaps": [ "https://fernyn-gainstead.live/sitemap.xml" ] }, "sitemap": { "present": true, "url_count": 9 }, "social_tags": { "ogUrl": "https://fernyn-gainstead.live/", "title": "Fernyn Gainstead | Premier AI-Powered Trading Platform", "author": "Fernyn Gainstead", "ogType": "website", "robots": "index, follow, max-image-preview:large, max-snippet:-1, max-video-preview:-1", "ogImage": "https://fernyn-gainstead.live/static/img/platform/fernyngainstead-trading-platform-mobile.webp", "ogTitle": "Fernyn Gainstead | Premier AI-Powered Trading Platform", "ogSiteName": "Fernyn Gainstead", "themeColor": "#0d7377", "description": "Engage with crypto, forex, and global markets via Fernyn Gainstead's AI-powered analytics and intuitive platform tailored for South Africa clients.", "twitterCard": "summary_large_image", "canonicalUrl": "https://fernyn-gainstead.live/", "ogDescription": "Engage with crypto, forex, and global markets via Fernyn Gainstead's AI-powered analytics and intuitive platform tailored for South Africa clients." }, "trackers": { "requests": 33, "trackers": [ { "name": "jsDelivr", "company": "jsDelivr", "category": "Hosting", "requests": 4 } ] }, "mixed_content": { "no_sri": [ "https://cdnedge.io/js/750393b117602e986a9151abcb87eabf/app.min.js", "https://cdn.jsdelivr.net/npm/intl-tel-input@18.5.3/build/js/intlTelInput.min.js", "https://cdn.jsdelivr.net/npm/intl-tel-input@18.5.3/build/js/utils.js" ], "third_party_scripts": 3 }, "status": { "up": true, "code": 200, "timings": { "dns": 1, "tls": 21, "wait": 646, "connect": 20, "download": 82 }, "response_ms": 770 }, "tls_connection": { "alpn": "h2", "cipher": "TLS_AES_256_GCM_SHA384", "protocol": "TLSv1.3", "versions": [ "TLSv1", "TLSv1.1", "TLSv1.2", "TLSv1.3" ], "authorized": true, "forward_secrecy": true }, "ports": { "open": [ 80, 443, 8080 ] }, "carbon": { "bytes": 119988, "co2_grams": 0.0044, "cleaner_than": 18 }, "dns_server": { "ns": [ { "ip": "108.162.194.99", "host": "delilah.ns.cloudflare.com" }, { "ip": "108.162.195.35", "host": "bradley.ns.cloudflare.com" } ], "zone": "fernyn-gainstead.live" }, "cookies": { "cookies": [ { "name": "PHPSESSID", "session": true }, { "name": "fernyngainstead_keitaro_subid", "http_only": true, "same_site": "Lax" } ] }, "location": { "ip": "2a06:98c1:3120::3", "asn": "13335", "org": "CloudFLARENET-EU", "city": "London", "country": "GB" }, "ssl": { "issuer": "Let's Encrypt / YE2", "subject": "fernyn-gainstead.live" }, "dns": { "A": [ "188.114.97.3", "188.114.96.3" ], "NS": [ "bradley.ns.cloudflare.com", "delilah.ns.cloudflare.com" ], "SOA": "{\"nsname\": \"bradley.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2416771447, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}", "AAAA": [ "2a06:98c1:3121::3", "2a06:98c1:3120::3" ] }, "dnssec": { "ds": false, "rrsig": false, "dnskey": false }, "hsts": { "message": "Site does not serve any HSTS headers." }, "http_security": { "xFrameOptions": false, "referrerPolicy": false, "xXSSProtection": false, "permissionsPolicy": false, "xContentTypeOptions": false, "contentSecurityPolicy": false, "strictTransportPolicy": false, "crossOriginOpenerPolicy": false, "crossOriginEmbedderPolicy": false, "crossOriginResourcePolicy": false }, "firewall": { "waf": "Cloudflare", "has_waf": true }, "get_ip": { "ip": "2a06:98c1:3121::3", "family": 6 }, "redirects": { "chain": [ "https://fernyn-gainstead.live" ] }, "linked_pages": { "internal_count": 9 }, "headers": { "headers": { "server": "cloudflare", "content-type": "text/html; charset=UTF-8" } } } } ```