# PhishDestroy domain threat record: finance-global.ltd Content language: English Canonical HTML report: https://phishdestroy.io/domain/finance-global.ltd/ Machine-readable companion: https://phishdestroy.io/domain/finance-global.ltd/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-10-26 09:40:01 UTC - Last availability or vendor check: 2026-10-26 09:46:24 UTC - Stored record updated: 2026-10-26 11:00:07 UTC - VirusTotal detections in the stored snapshot: 2/92 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: no stored flag ## Stored classification - Targeted brand: Google ## Stored infrastructure - Observed IP address: 23.153.104.2 - Registrar in stored WHOIS data: Dynadot Inc - Last stored HTTP status: 200 - Registration date in stored WHOIS data: 2025-03-22 15:21:29 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a17799-5b8d-76a5-a889-bf11a8e037a3/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/finance-global.ltd - Certificate Transparency search: https://crt.sh/?q=%25.finance-global.ltd - Web Archive lookup: https://web.archive.org/web/*/https://finance-global.ltd/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview PhishDestroy listed finance-global.ltd as a suspicious domain. The domain was first seen by PhishDestroy on 2026-10-26 and a page fetched that day returned HTTP 200 with the title “Google Translate Example”. How the scam works The current classification does not point to a concrete fraud technique; the site could be used for phishing, fake‑investment offers, or other social‑engineering attacks, but no specific behavior was observed. The page title references Google Translate and the brand name Google, which alone does not prove affiliation or impersonation. Evidence VirusTotal scanned the domain on 2026-10-26 and reported two malicious detections out of 92 engines, with LevelBlue labeling it as phishing and Netcraft as malicious. Google Safe Browsing checked the same day and did not flag the URL. urlscan.io captured the site on 2026-09-26; its machine‑learning engine assigned a high malicious score (99) while the overall verdict was clean. PhishDestroy’s internal blocklist contains the domain, external blocklists queried on 2026-10-26 returned no hits, and OTX listed zero pulses. Infrastructure The domain was registered on 2025-03-22 through Dynadot Inc with a transfer‑prohibited status and an expiration date of 2027-03-22. The recorded IP was 23.153.104.2, which the RDAP data listed under Aquiryn LLC in the United States, and the TLS certificate observed was issued by Let’s Encrypt and was valid through 2026-12-24. Nameservers were ns1.my-control-panel.com and ns2.my-control-panel.com, and the server reported open ports including 21, 25, 53, 80, 443 and several mail ports. What to do Visitors should avoid submitting credentials, personal data, or financial information to this site and should change any passwords used there. Organizations can block finance-global.ltd at the DNS or firewall level and monitor logs for traffic to the recorded IP address. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a0dc11-73d9-771e-8163-b2a59172427c/ Cloudflare Radar report: https://radar.cloudflare.com/scan/775faddc-b9a3-4871-881a-15d6f9edf8c7 Stored capture screenshot: https://urlscan.io/screenshots/01a0dc11-73d9-771e-8163-b2a59172427c.png URLScan screenshot (2026-10-26T09:41:53Z): https://screenshots.phishdestroy.io/us/01a17796-12b9-7661-8ed5-e815ff035a24.png URLScan capture report: https://urlscan.io/result/01a17796-12b9-7661-8ed5-e815ff035a24/ URLScan screenshot (2026-10-26T09:42:32Z): https://screenshots.phishdestroy.io/us/01a17793-cf5b-725d-8f24-ad40ca81e4aa.png URLScan capture report: https://urlscan.io/result/01a17793-cf5b-725d-8f24-ad40ca81e4aa/ VirusTotal report: https://www.virustotal.com/gui/domain/finance-global.ltd Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=finance-global.ltd Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-26 09:44:42 UTC ## Stored page captures - Primary capture: https://i.ibb.co/3HHZvRD/db36c6ef586d.png Captured: 2026-10-26 09:46:24 UTC - URLScan capture 1: https://urlscan.io/screenshots/01a17799-5b8d-76a5-a889-bf11a8e037a3.png Captured: 2026-10-26 09:46:24 UTC Source report: https://urlscan.io/result/01a17799-5b8d-76a5-a889-bf11a8e037a3/ - URLScan capture 2: https://screenshots.phishdestroy.io/01a0dc11-73d9-771e-8163-b2a59172427c.png Captured: 2026-10-26 09:40:01 UTC Source report: https://urlscan.io/result/01a17799-5b8d-76a5-a889-bf11a8e037a3/ - URLQuery: https://screenshots.phishdestroy.io/uq/8d39162c-e4dc-4209-a84e-585bbdc122b7.png Source report: https://urlquery.net/report/8d39162c-e4dc-4209-a84e-585bbdc122b7 SHA-256: 99eecc848759e07c5a8f11b8afbd7be85d8da63b2ad323f27fac1fecc0940f57 - URLScan · 2026-09-26: https://screenshots.phishdestroy.io/us/01a0dc11-73d9-771e-8163-b2a59172427c.png Captured: 2026-09-26 04:55:51 UTC Source report: https://urlscan.io/result/01a0dc11-73d9-771e-8163-b2a59172427c/ SHA-256: 217df8296edc6d806f86a299c51a00b42054262e940a4f60137164c52bafeead - URLScan · 2026-10-26: https://screenshots.phishdestroy.io/us/01a17796-12b9-7661-8ed5-e815ff035a24.png Captured: 2026-10-26 09:41:53 UTC Source report: https://urlscan.io/result/01a17796-12b9-7661-8ed5-e815ff035a24/ SHA-256: bab6c84e4021251f111e16b89dada026968509519c72b3755cd14a29bb7d8b73 - URLScan · 2026-10-26: https://screenshots.phishdestroy.io/us/01a17793-cf5b-725d-8f24-ad40ca81e4aa.png Captured: 2026-10-26 09:42:32 UTC Source report: https://urlscan.io/result/01a17793-cf5b-725d-8f24-ad40ca81e4aa/ SHA-256: 3d41b6336e21cec8c5aaff35c131e5c03cb6a97ee25514e2caf7f92b01a31340 - URLScan · 2026-10-26: https://screenshots.phishdestroy.io/us/01a1779a-653d-77ae-a5bd-901eb482dd41.png Captured: 2026-10-26 09:46:34 UTC Source report: https://urlscan.io/result/01a1779a-653d-77ae-a5bd-901eb482dd41/ SHA-256: 82c1509d74531426496bfbffb530ac408310e97f919e6d941d50da2a12521f57 ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-26T09:49:02Z", "uuid": "01a17799-5b8d-76a5-a889-bf11a8e037a3", "scanned_at": "2026-10-26T09:45:24Z", "final_url": "https://finance-global.ltd/", "status": 200, "ip": "23.153.104.2", "ptr": "c1-1.my-control-panel.com", "domains": [ "lcw.nyc3.cdn.digitaloceanspaces.com", "app.wabi-app.com", "widget-v3.smartsuppcdn.com", "www.gstatic.com", "www.google-analytics.com", "fonts.gstatic.com", "use.fontawesome.com", "fonts.googleapis.com", "http-api.livecoinwatch.com", "www.googletagmanager.com", "rss.app", "websocket-visitors.smartsupp.com", "ipinfo.io", "translate-pa.googleapis.com", "bootstrap.smartsuppchat.com", "code.jquery.com", "www.smartsuppchat.com", "cdnjs.cloudflare.com", "static.cryptohopper.com", "translate.googleapis.com", "www.cryptohopper.com", "translate.google.com", "code.tidio.co" ], "ips": [ "34.117.59.81", "142.251.13.94", "142.251.127.139", "172.217.117.4", "142.250.154.94", "18.184.200.240", "172.64.145.29", "172.67.142.245", "151.101.1.155", "142.251.20.95", "45.55.123.31", "212.102.56.179", "188.166.132.112", "104.17.24.14", "142.251.13.97" ], "asns": [ "396982", "15169", "16509", "13335", "54113", "14061", "60068", "32561" ], "countries": [ "US", "DE", "NL" ], "link_domains": [ "translate.google.com", "www.livecoinwatch.com" ], "doc_hash": "8379b0ab6c525162d96356762c4e1cbeb2e7c70582ea477066e9e578015da6c3", "script_hashes": [ "4fe68fa216176e6d1f4580e924bafecc9f519984ecc06b1a840a08b0d88c95de", "7c646feb97233a7955d4efb770ad8491d3103d2aadaacc06dc4fa8a09282a493", "5dc1ae0b875dc0d78dbc5532226f5f31b762b4d1229984f605d27bf895ab6807", "5ce2781d02621714fe62ae6c622fefea756b2942a3cee526bb1de3616b577222", "89cd357bf201405db4298a1c4edf666a1f87967748d0c23a493e1dce847c7274", "668b046d12db350ccba6728890476b3efee53b2f42dbb84743e5e9f1ae0cc404", "57b09de93d35121f15901a26d5852b21f68cc42d274d64729504c343555721bf", "08422329086b39073c4180151d154afe98b17720aeea6055db65a5f747544552", "0428589934613b6ff3bc5c58e04e024a8d7aefa799fc26a499b5cbdbb919f0a3", "ffcd48a4e8915cd63f49bf3a51eb02a52077204c5157d359459257725f35033c" ], "globals": [ "googleTranslateElementInit", "_DumpException", "google", "default_tr", "_F_toggles_default_tr", "$", "jQuery", "spop", "myFunction", "mcp", "addCommas", "hex2rgb", "commarize", "rgb2hex", "isBrightness", "realtimeUpdate", "domain", "createPostData", "rawurlencode", "depp", "bootstrap", "jQuery112405459806356050976", "Stellar", "jQueryBridget", "EvEmitter", "getSize", "matchesSelector", "fizzyUIUtils", "Outlayer", "Isotope", "Masonry", "Color", "Chart", "ClipboardJS", "_self", "Prism", "initMap", "_0xe86e", "_handlers", "country_list" ], "cookies": [ "PHPSESSID", "_ga_RJD0MXEEV1", "_ga", "_gid", "_gat_gtag_UA_115538286_1" ], "tls": { "san": [ "*.finance-global.ltd", "finance-global.ltd" ], "cipher": "AES_128_GCM", "issuer": "YR1", "subject": "*.finance-global.ltd", "protocol": "TLS 1.3", "valid_to": "2026-12-24T13:31:37Z", "valid_from": "2026-09-25T13:31:38Z" }, "domain_age_days": 582, "apex_age_days": 582, "tls_age_days": 30, "tls_valid_days": 89, "requests": 142, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 91, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "LiteSpeed", "content-type": "text/html; charset=UTF-8", "x-powered-by": "PHP/7.4.33" } }, "cf": { "v": 1, "fetched_at": "2026-10-26T09:49:04Z", "uuid": "775faddc-b9a3-4871-881a-15d6f9edf8c7", "scanned_at": "2026-10-26T09:42:35Z" }, "vt": { "v": 1, "fetched_at": "2026-10-26T09:42:10Z", "analysis_at": "2026-10-26T09:38:22Z", "stats": { "timeout": 0, "harmless": 54, "malicious": 2, "suspicious": 0, "undetected": 36 }, "detections": { "Netcraft": "malicious", "LevelBlue": "phishing" }, "reputation": 0, "created": "2025-03-22T00:00:00Z", "updated": "2025-03-23T00:00:00Z", "first_seen": "2025-03-22T18:28:42Z", "dns": [ { "ttl": 14400, "type": "TXT", "value": "v=spf1 +a +mx +ip4:192.168.168.2 +ip4:23.153.104.2 ~all" }, { "ttl": 21600, "type": "SOA", "rname": "admin.my-control-panel.com", "value": "ns1.my-control-panel.com" }, { "ttl": 14400, "type": "A", "value": "23.153.104.2" }, { "ttl": 14400, "type": "MX", "value": "finance-global.ltd", "priority": 0 }, { "ttl": 21600, "type": "NS", "value": "ns1.my-control-panel.com" }, { "ttl": 21600, "type": "NS", "value": "ns2.my-control-panel.com" } ], "dns_at": "2026-10-26T09:39:27Z", "jarm": "29d29d00029d29d00042d43d00041d598ac0c1012db967bb1ad0ff2491b3ae", "cert": { "san": [ "*.finance-global.ltd", "finance-global.ltd" ], "issuer": "Let's Encrypt / YR1", "serial": "5fdbf4a01ad125458b2e70f5d6a96799023", "sha256": "dcc71e6e3648d503ba5020094fa5b8bfdd06fd0c5f90f8c6de6fd0caddaab82d", "subject": "*.finance-global.ltd", "valid_to": "2026-12-24T13:31:37Z", "valid_from": "2026-09-25T13:31:38Z" }, "whois": [], "rdap": { "status": [ "transfer prohibited" ], "events": { "expiration": "2027-03-22T16:21:29Z", "last changed": "2026-02-26T22:44:21Z", "registration": "2025-03-22T16:21:29Z", "registrar expiration": "2027-03-22T16:21:29Z", "last update of RDAP database": "2026-10-23T10:24:22Z" }, "registrar": "DYNADOT LLC", "registrar_iana_id": "472" } }, "webcheck": { "v": 1, "fetched_at": "2026-10-26T09:44:21Z", "mail_config": { "mx": [ "finance-global.ltd" ], "spf": "v=spf1 +a +mx +ip4:192.168.168.2 +ip4:23.153.104.2 ~all", "dkim": [ "default" ], "dmarc": true, "dkim_bits": 2048, "spf_lookups": 2 }, "caa_records": { "domain": "finance-global.ltd" }, "block_lists": { "resolvers": 12, "blocked_count": 0 }, "archives": { "last": "2026-10-26T09:41:26Z", "first": "2025-03-22T19:51:21Z", "changes": 2, "days_archived": 3, "scans_per_day": 0, "avg_page_bytes": 966 }, "robots_txt": { "agents": [ "*" ], "present": true, "sitemaps": [ "https://capital-exchange.net/sitemap.xml", "https://capital-exchange.net/sitemap_1.xml" ] }, "social_tags": { "title": "Google Translate Example", "keywords": "Bitcoin mining, scrypt mining, Eth, investment, cloud mining, X11, hosted mining, Bitcoin Investment", "description": "Bitcoin is the currency of the future & finance-global.ltd is the largest investment company. Invest in digital currency, RealEstate, Metal, Agriculture, Energy, get started today!" }, "mixed_content": { "no_sri": [ "https://translate.google.com/translate_a/element.js", "https://www.cryptohopper.com/widgets/js/script", "https://app.wabi-app.com/widget/js/wabi.js", "https://code.tidio.co/ln4b68v25nqkrofferoxfw6zgldfakwv.js" ], "third_party_scripts": 4 }, "status": { "up": true, "code": 200, "timings": { "dns": 1535, "tls": 356, "wait": 1466, "connect": 52, "download": 681 }, "response_ms": 4090 }, "tls_connection": { "alpn": "h2", "cipher": "TLS_AES_256_GCM_SHA384", "protocol": "TLSv1.3", "versions": [ "TLSv1.2", "TLSv1.3" ], "authorized": true, "forward_secrecy": true }, "ports": { "open": [ 21, 25, 53, 80, 110, 143, 443, 587, 993, 995, 3306 ] }, "carbon": { "bytes": 83222, "co2_grams": 0.003, "cleaner_than": 26 }, "dns_server": { "ns": [ { "ip": "198.251.88.162", "host": "ns2.my-control-panel.com" }, { "ip": "23.153.104.2", "host": "ns1.my-control-panel.com" } ], "zone": "finance-global.ltd" }, "location": { "ip": "23.153.104.2", "asn": "32561", "org": "Aquiryn LLC", "country": "US" }, "ssl": { "issuer": "Let's Encrypt / YR1", "subject": "*.finance-global.ltd" }, "dns": { "A": [ "23.153.104.2" ], "MX": [ "{\"exchange\": \"finance-global.ltd\", \"priority\": 0}" ], "NS": [ "ns2.my-control-panel.com", "ns1.my-control-panel.com" ], "SOA": "{\"nsname\": \"ns1.my-control-panel.com\", \"hostmaster\": \"admin.my-control-panel.com\", \"serial\": 2026092501, \"refresh\": 3600, \"retry\": 1800, \"expire\": 1209600, \"minttl\": 86400}", "TXT": [ "v=spf1 +a +mx +ip4:192.168.168.2 +ip4:23.153.104.2 ~all" ] }, "dnssec": { "ds": false, "rrsig": false, "dnskey": false }, "hsts": { "message": "Site does not serve any HSTS headers." }, "http_security": { "xFrameOptions": false, "referrerPolicy": false, "xXSSProtection": false, "permissionsPolicy": false, "xContentTypeOptions": false, "contentSecurityPolicy": false, "strictTransportPolicy": false, "crossOriginOpenerPolicy": false, "crossOriginEmbedderPolicy": false, "crossOriginResourcePolicy": false }, "get_ip": { "ip": "23.153.104.2", "family": 4 }, "redirects": { "chain": [ "https://finance-global.ltd" ] }, "linked_pages": { "internal_count": 11 }, "headers": { "headers": { "server": "LiteSpeed", "content-type": "text/html; charset=UTF-8", "x-powered-by": "PHP/7.4.33" } } } } ```