# PhishDestroy domain threat record: financeslibresinfo.net

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/financeslibresinfo.net/
Machine-readable companion: https://phishdestroy.io/domain/financeslibresinfo.net/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-26 22:06:15 UTC
- Last availability or vendor check: 2026-10-26 22:06:15 UTC
- Stored record updated: 2026-10-26 23:17:01 UTC
- VirusTotal detections in the stored snapshot: 15/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored infrastructure

- Observed IP address: 158.94.210.119
- Registrar in stored WHOIS data: Dynadot Inc
- Last stored HTTP status: 200
- Registration date in stored WHOIS data: 2026-07-20 05:20:28 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a17a3e-1d31-7137-ae61-bc902080df34/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/financeslibresinfo.net
- Certificate Transparency search: https://crt.sh/?q=%25.financeslibresinfo.net
- Web Archive lookup: https://web.archive.org/web/*/https://financeslibresinfo.net/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
PhishDestroy listed financeslibresinfo.net as a suspicious domain without assigning a specific scam category. The page title recorded was “FinancesLibresInfo, votre plateforme de trading algorithmique”. PhishDestroy first observed the domain on 2026-10-26. An HTTP 200 response was recorded on 2026-10-26.

How the scam works
Because the domain is flagged by many security engines for phishing and malware, it could be used to lure visitors into disclosing credentials or to deliver malicious payloads. The observed page only advertises an algorithmic trading platform and does not contain a visible credential‑stealing form or executable code, so the exact tactic cannot be confirmed. Such sites typically rely on social engineering to trick users into providing personal or financial information.

Evidence
In VirusTotal’s domain scan retrieved on 2026-10-27 (analysis date 2026-10-17) 13 vendors marked the domain malicious, 2 marked it suspicious, for a total of 15 detections out of 92 engines. Google Safe Browsing checked on 2026-10-27 reported no flag. urlscan.io captured the site on 2026-10-26; its engine verdict labeled it malicious with a score of 99, while the overall verdict was neutral. Cloudflare Radar’s scan on 2026-10-26 classified the domain as malicious malware, and OTX listed five pulses referencing the domain as of 2026-10-27. PhishDestroy’s internal blocklist contains the domain, while external blocklists returned zero hits on 2026-10-26.

Infrastructure
The domain was registered with Dynadot Inc on 2026-07-20, giving it an age of 98 days at the time of observation. DNS resolution returned the A record 158.94.210.119, which belongs to ASN 202412 operated by Omegatech LTD in Amsterdam, NL. The site presented a Let’s Encrypt TLS certificate valid from 2026-09-01 to 2026-11-30 using TLS 1.3 with AES‑128‑GCM. Open ports observed on 2026-10-26 were 22, 80 and 443, and DNSSEC was not enabled.

What to do
Visitors who entered any credentials or personal information should change those credentials immediately and monitor associated accounts for unauthorized activity. Devices that accessed the site should be scanned with up‑to‑date security software. Defenders should block financeslibresinfo.net at the network perimeter and monitor logs for connections to this exact domain.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a17a3e-1d31-7137-ae61-bc902080df34/
Cloudflare Radar report: https://radar.cloudflare.com/scan/abe0c071-fa50-4468-9e8b-dbed622f6e61
URLQuery report: https://urlquery.net/report/a71e244d-b268-4e1e-9509-b663bec18e08
Stored capture screenshot: https://urlscan.io/screenshots/01a17a3e-1d31-7137-ae61-bc902080df34.png
Cloudflare Radar screenshot (2026-10-26T22:38:49Z): https://screenshots.phishdestroy.io/cf/abe0c071-fa50-4468-9e8b-dbed622f6e61.png
VirusTotal report: https://www.virustotal.com/gui/domain/financeslibresinfo.net
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=financeslibresinfo.net
Archived copy: https://web.archive.org/web/20261026220828/https://financeslibresinfo.net/
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-26 23:16:47 UTC

## Stored page captures

- Primary capture: https://urlscan.io/screenshots/01a17a3e-1d31-7137-ae61-bc902080df34.png
  Captured: 2026-10-26 22:06:15 UTC
- URLScan capture: https://screenshots.phishdestroy.io/01a17a3e-1d31-7137-ae61-bc902080df34.png
  Captured: 2026-10-26 22:06:15 UTC
  Source report: https://urlscan.io/result/01a17a3e-1d31-7137-ae61-bc902080df34/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/abe0c071-fa50-4468-9e8b-dbed622f6e61.png
  Captured: 2026-10-26 22:38:49 UTC
  Source report: https://radar.cloudflare.com/scan/abe0c071-fa50-4468-9e8b-dbed622f6e61
  SHA-256: 792aaf013489e96560419e01c3f76d48b2755729b9871039be4b89628c0a8003

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-26T22:27:36Z",
        "uuid": "01a17a3e-1d31-7137-ae61-bc902080df34",
        "scanned_at": "2026-10-26T22:04:19Z",
        "final_url": "https://financeslibresinfo.net/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://financeslibresinfo.net/",
                "from": "http://financeslibresinfo.net/",
                "status": 307
            }
        ],
        "ip": "158.94.210.119",
        "ips": [
            "158.94.210.119"
        ],
        "asns": [
            "202412"
        ],
        "countries": [
            "NL"
        ],
        "doc_hash": "229e57ab1a4048f20b47593785792773cae82a8541a52c5e4f5d8ab5b579508c",
        "script_hashes": [
            "8aa5f8f647356dcd4fc5dbbe0efd5bc0e8da74026bc61e24636e2e1f5749b0ce"
        ],
        "globals": [
            "__dclq",
            "__dclOrig",
            "__dclFlush",
            "toggleLang",
            "toggleMenu",
            "closeMobileNav",
            "__smsCheckBeforeSubmit",
            "__isSmsEnabled",
            "__isSmsVerified",
            "intlTelInput"
        ],
        "cookies": [
            "connect.sid"
        ],
        "tls": {
            "san": [
                "financeslibresinfo.net"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "YE1",
            "subject": "financeslibresinfo.net",
            "protocol": "TLS 1.3",
            "valid_to": "2026-11-30T16:11:10Z",
            "valid_from": "2026-09-01T16:11:11Z"
        },
        "domain_age_days": 98,
        "apex_age_days": 98,
        "tls_age_days": 55,
        "tls_valid_days": 89,
        "requests": 8,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 99,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "content-type": "text/html; charset=utf-8",
            "x-content-type-options": "nosniff",
            "referrer-policy": "same-origin"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-26T22:39:07Z",
        "uuid": "abe0c071-fa50-4468-9e8b-dbed622f6e61",
        "scanned_at": "2026-10-26T22:38:49Z",
        "final_url": "https://financeslibresinfo.net/",
        "status": 200,
        "history": [
            {
                "url": "https://financeslibresinfo.net/",
                "status": 200
            }
        ],
        "dom_hash": "c1fddf19202f203b9657d9e67ad7d1ffbd0671731f1937d103d11627df47dd69",
        "doc_hash": "0819321e9d2b6627d34df8d6d3c1685ce9493dfc1a3cdee5b02460f29e3bd513",
        "domain_risks": [
            "Malware",
            "Security threats",
            "CIPA Filter",
            "CIPA"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "financeslibresinfo.net",
                "type": "A",
                "value": "158.94.210.119"
            }
        ],
        "dnssec_valid": false,
        "ip": "158.94.210.119",
        "verdict": {
            "tags": [
                "malware"
            ],
            "malicious": true,
            "categories": [
                "malware"
            ]
        },
        "whois": {
            "registrar": "Dynadot Inc",
            "created": "2026-07-20T07:20:28Z",
            "updated": "2026-08-13T12:46:06Z",
            "expires": "2027-07-20T07:20:28Z",
            "nameservers": [
                "ns1.dyna-ns.net",
                "ns2.dyna-ns.net"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-26T23:14:29Z",
        "analysis_at": "2026-10-17T11:46:37Z",
        "stats": {
            "timeout": 0,
            "harmless": 44,
            "malicious": 13,
            "suspicious": 2,
            "undetected": 33
        },
        "detections": {
            "CRDF": "malicious",
            "ESET": "suspicious",
            "VIPRE": "phishing",
            "G-Data": "phishing",
            "Lionic": "phishing",
            "Sophos": "phishing",
            "CyRadar": "phishing",
            "Fortinet": "phishing",
            "SOCRadar": "phishing",
            "Kaspersky": "phishing",
            "Seclookup": "malicious",
            "Gridinsoft": "suspicious",
            "BitDefender": "phishing",
            "alphaMountain.ai": "phishing",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "categories": {
            "alphaMountain.ai": "Phishing, Newly Registered (alphaMountain.ai)"
        },
        "created": "2026-07-20T00:00:00Z",
        "updated": "2026-07-20T00:00:00Z",
        "first_seen": "2026-07-20T08:05:08Z",
        "dns": [
            {
                "ttl": 300,
                "type": "SOA",
                "rname": "hostmaster.financeslibresinfo.net",
                "value": "ns1.dyna-ns.net"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "158.94.210.119"
            },
            {
                "ttl": 300,
                "type": "NS",
                "value": "ns2.dyna-ns.net"
            },
            {
                "ttl": 300,
                "type": "NS",
                "value": "ns1.dyna-ns.net"
            }
        ],
        "dns_at": "2026-10-17T11:52:18Z",
        "jarm": "40d40d40d00000000043d43d00043d6aff5ab0f4fc31897186312c9e639319",
        "cert": {
            "san": [
                "financeslibresinfo.net"
            ],
            "issuer": "Let's Encrypt / YE1",
            "serial": "6268300c1a3f55f884634ce9871af86e1ba",
            "sha256": "f56405ff5d2cd1ec041ef12a1c73ac092b298755fbe4bc763f0dad14bdbc9e07",
            "subject": "financeslibresinfo.net",
            "valid_to": "2026-11-30T16:11:10Z",
            "valid_from": "2026-09-01T16:11:11Z"
        },
        "whois": [],
        "rdap": {
            "status": [
                "transfer prohibited"
            ],
            "events": {
                "expiration": "2027-07-20T07:20:28Z",
                "last changed": "2026-09-01T12:29:13Z",
                "registration": "2026-07-20T07:20:28Z",
                "registrar expiration": "2027-07-20T07:20:28Z",
                "last update of RDAP database": "2026-10-16T07:25:12Z"
            },
            "registrar": "DYNADOT LLC",
            "registrar_iana_id": "472"
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-26T22:39:20Z",
        "mail_config": {
            "spf_lookups": 0
        },
        "caa_records": {
            "domain": "financeslibresinfo.net"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_by": [
                "CloudFlare Family"
            ],
            "blocked_count": 1
        },
        "archives": {
            "last": "2026-10-26T22:08:28Z",
            "first": "2026-10-13T22:55:11Z",
            "changes": 1,
            "days_archived": 2,
            "scans_per_day": 0.08,
            "avg_page_bytes": 22892
        },
        "robots_txt": {
            "agents": [
                "*"
            ],
            "present": true,
            "sitemaps": [
                "https://financeslibresinfo.net/sitemap.xml"
            ]
        },
        "sitemap": {
            "present": true,
            "url_count": 5
        },
        "social_tags": {
            "title": "FinancesLibresInfo, votre plateforme de trading algorithmique",
            "robots": "index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1",
            "description": "Optimisez chaque décision d'investissement. FinancesLibresInfo déploie un système de trading intelligent avec une précision analytique de pointe.",
            "canonicalUrl": "https://financeslibresinfo.net/"
        },
        "trackers": {
            "requests": 54,
            "trackers": [
                {
                    "name": "Cloudflare",
                    "company": "Cloudflare",
                    "country": "US",
                    "category": "Hosting",
                    "requests": 1
                },
                {
                    "name": "jsDelivr",
                    "company": "jsDelivr",
                    "category": "Hosting",
                    "requests": 4
                }
            ]
        },
        "mixed_content": {
            "third_party_scripts": 0
        },
        "status": {
            "up": true,
            "code": 200,
            "timings": {
                "dns": 644,
                "tls": 94,
                "wait": 89,
                "connect": 71,
                "download": 140
            },
            "response_ms": 1038
        },
        "tls_connection": {
            "alpn": "h2",
            "cipher": "TLS_AES_128_GCM_SHA256",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                22,
                80,
                443
            ]
        },
        "carbon": {
            "bytes": 87532,
            "co2_grams": 0.0032,
            "cleaner_than": 25
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "162.159.25.5",
                    "host": "ns2.dyna-ns.net"
                },
                {
                    "ip": "162.159.26.92",
                    "host": "ns1.dyna-ns.net"
                }
            ],
            "zone": "financeslibresinfo.net"
        },
        "cookies": {
            "cookies": [
                {
                    "name": "cf-c",
                    "http_only": true,
                    "same_site": "Lax"
                },
                {
                    "name": "__cf_clicked"
                },
                {
                    "name": "ph_phc_t6w4wzJE2sbz4ro8LmZZTssm5go3KD6mP7QsqcDQRSp6_posthog",
                    "secure": true,
                    "same_site": "Lax"
                }
            ]
        },
        "location": {
            "ip": "158.94.210.119",
            "asn": "202412",
            "org": "Omegatech LTD",
            "city": "Amsterdam",
            "country": "NL"
        },
        "ssl": {
            "issuer": "Let's Encrypt / YE1",
            "subject": "financeslibresinfo.net"
        },
        "dns": {
            "A": [
                "158.94.210.119"
            ],
            "NS": [
                "ns2.dyna-ns.net",
                "ns1.dyna-ns.net"
            ],
            "SOA": "{\"nsname\": \"ns1.dyna-ns.net\", \"hostmaster\": \"hostmaster.financeslibresinfo.net\", \"serial\": 2026090101, \"refresh\": 16384, \"retry\": 2048, \"expire\": 1209600, \"minttl\": 300}"
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "hsts": {
            "message": "Site does not serve any HSTS headers."
        },
        "http_security": {
            "xFrameOptions": false,
            "referrerPolicy": "same-origin",
            "xXSSProtection": false,
            "permissionsPolicy": false,
            "xContentTypeOptions": "nosniff",
            "contentSecurityPolicy": false,
            "strictTransportPolicy": false,
            "crossOriginOpenerPolicy": false,
            "crossOriginEmbedderPolicy": false,
            "crossOriginResourcePolicy": false
        },
        "get_ip": {
            "ip": "158.94.210.119",
            "family": 4
        },
        "redirects": {
            "chain": [
                "https://financeslibresinfo.net"
            ]
        },
        "tech_stack": {
            "technologies": [
                "Node.js",
                "Express",
                "lit-html",
                "lit-element",
                "HTTP/3"
            ]
        },
        "linked_pages": {
            "internal_count": 27
        },
        "whois": {
            "registrar": "Dynadot Inc",
            "created": "2026-07-20T07:20:28Z",
            "updated": "2026-08-13T12:46:06Z",
            "expires": "2027-07-20T07:20:28Z",
            "status": [
                "clientTransferProhibited https://icann.org/epp"
            ],
            "nameservers": [
                "ns1.dyna-ns.net",
                "ns2.dyna-ns.net"
            ]
        },
        "headers": {
            "headers": {
                "content-type": "text/html; charset=utf-8",
                "x-content-type-options": "nosniff",
                "referrer-policy": "same-origin"
            }
        }
    }
}
```