# PhishDestroy domain threat record: finance-loanadvisors.ch

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/finance-loanadvisors.ch/
Machine-readable companion: https://phishdestroy.io/domain/finance-loanadvisors.ch/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-09-13 15:12:25 UTC
- Last availability or vendor check: 2026-10-22 10:26:16 UTC
- Stored record updated: 2026-10-22 15:45:08 UTC
- VirusTotal detections in the stored snapshot: 5/91
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored infrastructure

- Observed IP address: 198.251.81.14
- Registrar in stored WHOIS data: REGISTRAR_NOT_FOUND
- Registrar country in stored WHOIS data: DE
- Registration date (registry RDAP, finance-loanadvisors.ch): 2026-09-03 12:00:00 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a09b52-9c92-75f4-95e5-5368f04065c8/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/finance-loanadvisors.ch
- Certificate Transparency search: https://crt.sh/?q=%25.finance-loanadvisors.ch
- Web Archive lookup: https://web.archive.org/web/*/https://finance-loanadvisors.ch/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
finance-loanadvisors.ch is an impersonation phishing site. Its name presents it as a Swiss-flavoured loan advisory service, aimed at people looking for credit or financial guidance. PhishDestroy first flagged it on 2026-09-13, and it was still online with live content on 2026-10-19. The page currently returns a "403 Forbidden" title, while our classification is an impersonation phishing page.

How the scam works
Fake loan-advisor sites borrow the look and language of legitimate lenders or brokers to appear trustworthy. Visitors are usually asked to fill in an application with their name, address, income, bank details and copies of identity documents. Applicants may then be told the loan is approved but must first pay a processing, insurance or guarantee fee. That money never comes back, no loan is issued, and the submitted documents can be reused for identity fraud.

Evidence
Five of 91 VirusTotal engines flagged the domain when it was checked on 2026-09-26: alphaMountain.ai, CRDF, Forcepoint ThreatSeeker, Gridinsoft and SOCRadar. That is a modest count, but it comes from unrelated vendors that reached the same conclusion independently. The domain also appears in four AlienVault OTX threat pulses, and it is listed on the PhishDestroy blocklist.

Infrastructure
The domain was registered on 2026-09-03 and drew PhishDestroy's attention just ten days later. Short-lived domains like this are typical of fraud campaigns that move to a new address once they are blocked. The site is hosted in the United States on FranTech Solutions' network at 198.251.81.14. Its HTTPS certificate is a free domain-validated certificate from ZeroSSL, so the padlock only means the connection is encrypted. It says nothing about who runs the site.

What to do
Do not send any upfront fee to secure a loan offered through this site. If you already paid, contact your bank or card issuer at once to dispute the payment and report the fraud to the police. If you uploaded identity documents or bank details, alert your bank, watch your accounts for unfamiliar activity, and consider a credit freeze or fraud alert where available. Change any password you entered on the site and turn on two-factor authentication wherever you reuse it. Defenders should block the domain and its hosting IP, and search mail and proxy logs for users who visited it or received loan offers pointing to it.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a09b52-9c92-75f4-95e5-5368f04065c8/
VirusTotal report: https://www.virustotal.com/gui/domain/finance-loanadvisors.ch
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=finance-loanadvisors.ch
Archived copy: https://web.archive.org/web/20260922023940/https://finance-loanadvisors.ch/
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 10:58:11 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/Q3VhhDv7/9f6d3101b9c9.png
  Captured: 2026-09-13 15:12:25 UTC
- URLScan capture 1: https://screenshots.phishdestroy.io/01a09b52-9c92-75f4-95e5-5368f04065c8.png
  Captured: 2026-09-13 15:12:25 UTC
  Source report: https://urlscan.io/result/01a09b52-9c92-75f4-95e5-5368f04065c8/
- URLScan capture 2: https://urlscan.io/screenshots/01a09b50-8675-7218-b9a4-9c104abbdd7f.png
  Captured: 2026-09-13 15:11:02 UTC
  Source report: https://urlscan.io/result/01a09b52-9c92-75f4-95e5-5368f04065c8/
- URLScan · 2026-09-13: https://screenshots.phishdestroy.io/us/01a09b50-8675-7218-b9a4-9c104abbdd7f.png
  Captured: 2026-09-13 15:09:23 UTC
  Source report: https://urlscan.io/result/01a09b50-8675-7218-b9a4-9c104abbdd7f/
  SHA-256: 872a31ca70cb3b067e64210a132657bda5ad784539ad020b6c83d1bf6c614c16
- URLScan · 2026-09-13: https://screenshots.phishdestroy.io/us/01a09b56-350c-7574-a087-835afe104612.png
  Captured: 2026-09-13 15:15:29 UTC
  Source report: https://urlscan.io/result/01a09b56-350c-7574-a087-835afe104612/
  SHA-256: 872a31ca70cb3b067e64210a132657bda5ad784539ad020b6c83d1bf6c614c16

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-21T02:21:02Z",
        "uuid": "01a09b52-9c92-75f4-95e5-5368f04065c8",
        "scanned_at": "2026-09-13T15:11:34Z",
        "final_url": "https://finance-loanadvisors.ch/",
        "status": 200,
        "ip": "198.251.81.14",
        "ptr": "s13.my-control-panel.com",
        "domains": [
            "assets.chaport.com",
            "fonts.googleapis.com",
            "app.chaport.com",
            "fonts.gstatic.com",
            "s.w.org"
        ],
        "ips": [
            "192.0.77.48",
            "104.26.15.45",
            "142.251.222.227",
            "142.250.207.10",
            "198.251.81.14"
        ],
        "asns": [
            "2635",
            "13335",
            "15169",
            "53667"
        ],
        "countries": [
            "US"
        ],
        "link_domains": [
            "demo.phlox.pro",
            "www.chaport.com"
        ],
        "doc_hash": "8c08c573fe517c49d7a08ea02d24151441dbc32a65508cea787e90bb5cb9dd01",
        "script_hashes": [
            "cb6f2d32c49d1c2b25e9ffc9aaafa3f83075346c01bcd4ae6eb187392a4292cf",
            "5274f11e6fb32ae0cf2dfb9f8043272865c397a7c4223b4cfa7d50ea52fbde89",
            "7c6548c9d93e475c39b0fe3464a28c06796516c18ede72cfa12e7d6571cc8e13",
            "aaa6d53f3f3b22f4c906661e920e60137174ef04cd1b5c04a9a6eae141e34c5a",
            "6f35273b8502706ee06854d797337ab40bc1b3a7421960a2ceb5392ac85a0f54",
            "b65b3de1bc923b9355248a0d941a0eaee15dfb9a6b8eadb51323a8df6189dcd1",
            "e00add38134eac2fb8e8e9c09cbfff7bbe57952b210322eb2eecb0a21fc055eb",
            "b6d7e1b223128d970a7df0bc5bc399c52e7e21257478a804df7e5b173b176639",
            "ec51ebdefd78a5fec1bcb96b151008207421339c587b57a2a6a8d07f7c90f574",
            "d5a8329d5998756b924df173cc64ac849fccd0fa97caa52f12c717e94282bdab"
        ],
        "globals": [
            "jQuery",
            "auxin",
            "auxinNS",
            "html5",
            "Modernizr",
            "___FONT_AWESOME___",
            "fontawesome-free-shims",
            "chaportConfig",
            "chaport",
            "EvEmitter",
            "imagesLoaded",
            "jQueryBridget",
            "getSize",
            "matchesSelector",
            "fizzyUIUtils",
            "Outlayer",
            "Masonry",
            "PerfectScrollbar",
            "_typeof",
            "lazySizesConfig",
            "GMaps",
            "Switchery",
            "Isotope",
            "Packery",
            "PhotoSwipe",
            "PhotoSwipeUI_Default",
            "lazySizes",
            "jsSocials",
            "UAParser",
            "averta",
            "package",
            "_mobile",
            "_touch",
            "parseQueryString",
            "AuxUserAgent",
            "AuxBrowser",
            "AVTAligner",
            "CSSTween",
            "CTween",
            "EaseDic"
        ],
        "cookies": [
            "chaport-6a9f3a034eabbf1177b18de2"
        ],
        "storage_keys": [
            "cp_test",
            "wpEmojiSettingsSupports",
            "wsc_session_started_at",
            "wsc_visitor-data",
            "wsc_page_views",
            "wsc_pages"
        ],
        "tls": {
            "san": [
                "finance-loanadvisors.ch",
                "www.finance-loanadvisors.ch"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "ZeroSSL RSA DV SSL CA 2",
            "subject": "finance-loanadvisors.ch",
            "protocol": "TLS 1.3",
            "valid_to": "2026-12-05T23:59:59Z",
            "valid_from": "2026-09-06T00:00:00Z"
        },
        "domain_age_days": 7,
        "apex_age_days": 7,
        "tls_age_days": 7,
        "tls_valid_days": 90,
        "requests": 85,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 96,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "LiteSpeed",
            "content-type": "text/html; charset=UTF-8"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-21T00:26:57Z",
        "uuid": "f9a58b33-8e5a-4614-8c9d-66b8963b8e4b",
        "scanned_at": "2026-09-13T15:44:39Z"
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-22T13:26:12Z",
        "analysis_at": "2026-09-26T02:00:11Z",
        "stats": {
            "timeout": 0,
            "harmless": 52,
            "malicious": 4,
            "suspicious": 1,
            "undetected": 35
        },
        "detections": {
            "CRDF": "malicious",
            "SOCRadar": "phishing",
            "Gridinsoft": "suspicious",
            "alphaMountain.ai": "phishing",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "categories": {
            "alphaMountain.ai": "Phishing (alphaMountain.ai)",
            "Forcepoint ThreatSeeker": "phishing and other frauds"
        },
        "first_seen": "2026-09-03T20:33:29Z",
        "dns": [
            {
                "ttl": 3600,
                "type": "TXT",
                "value": "v=spf1 a mx ip4:198.251.81.14 ip4:65.21.92.21  ~all"
            },
            {
                "ttl": 3600,
                "type": "NS",
                "value": "ns1.robotichosting.com"
            },
            {
                "ttl": 3600,
                "type": "SOA",
                "rname": "hostmaster.finance-loanadvisors.ch",
                "value": "ns1.robotichosting.com"
            },
            {
                "ttl": 3600,
                "type": "A",
                "value": "198.251.81.14"
            },
            {
                "ttl": 3600,
                "type": "NS",
                "value": "ns2.robotichosting.com"
            },
            {
                "ttl": 3600,
                "type": "MX",
                "value": "mail.finance-loanadvisors.ch",
                "priority": 10
            }
        ],
        "dns_at": "2026-09-26T02:00:27Z",
        "jarm": "29d29d00029d29d21c42d43d00041df48f145f65c66577d0b01ecea881c1ba",
        "cert": {
            "san": [
                "finance-loanadvisors.ch",
                "www.finance-loanadvisors.ch"
            ],
            "issuer": "ZeroSSL GmbH / ZeroSSL RSA DV SSL CA 2",
            "serial": "396ded08e87174d4d66f439f21031b7f",
            "sha256": "4c5f386109294d9aae73fb10f5b04972896582d9f8a56f903de3a08ff26ba881",
            "subject": "finance-loanadvisors.ch",
            "valid_to": "2026-12-05T23:59:59Z",
            "valid_from": "2026-09-06T00:00:00Z"
        },
        "rdap": {
            "status": [
                "active"
            ],
            "events": {
                "registration": "2026-09-03T00:00:00Z"
            }
        }
    }
}
```