# PhishDestroy domain threat record: firmyieldvale.pro Content language: English Canonical HTML report: https://phishdestroy.io/domain/firmyieldvale.pro/ Machine-readable companion: https://phishdestroy.io/domain/firmyieldvale.pro/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: unknown - First observed by PhishDestroy: 2026-10-26 21:59:31 UTC - Stored record updated: 2026-10-26 22:22:51 UTC - VirusTotal detections in the stored snapshot: 17/92 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: no stored flag ## Stored infrastructure - Observed IP address: 104.21.40.56 - Registrar in stored WHOIS data: NameCheap, Inc. - Last stored HTTP status: 200 - Registration date in stored WHOIS data: 2026-03-11 10:41:55 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a0d812-deca-7145-b058-d6fcf1556849/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/firmyieldvale.pro - Certificate Transparency search: https://crt.sh/?q=%25.firmyieldvale.pro - Web Archive lookup: https://web.archive.org/web/*/https://firmyieldvale.pro/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview PhishDestroy’s intake AI classified firmyieldvale.pro as malicious because the site advertises an “AI Trading Platform” and asks visitors to provide name, email and phone for “secured onboarding details for AI‑assisted trading bots”. The assessment was recorded on 2026-10-26. The domain first appeared in PhishDestroy’s feed on 2026-10-26, 229 days after its registration. How the scam works Fraudulent AI‑trading schemes typically lure victims with promises of automated, high‑return trading bots, then collect personal information to build a profile for future phishing or to request funds. After the initial data capture, attackers may follow up with fake investment offers, account takeover attempts, or requests for cryptocurrency deposits. Evidence VirusTotal scanned the domain on 2026-10-24 and reported 17 detections from 92 engines, including 13 malicious and 4 suspicious verdicts from vendors such as BitDefender, ESET and Fortinet. Google Safe Browsing checked on 2026-10-26 and did not flag the site. urlscan.io captured a snapshot on 2026-09-25; its machine‑learning engine gave a malicious score of 96, though the overall verdict was non‑malicious. OTX listed one pulse referencing the domain on 2026-10-26, and PhishDestroy’s internal blocklist marked it as malicious while external blocklists showed no hits. Infrastructure The domain was registered with NameCheap on 2026-03-11. Hosting records show two Cloudflare IP addresses (104.21.40.56 and 172.67.176.121) located in Canada, and the TLS certificate issued by Google Trust Services is valid until 2026-12-04. No additional infrastructure details were observed. What to do Visitors should avoid submitting any personal or financial information to the site and, if they have already done so, change passwords on related accounts and monitor for suspicious activity. Defenders should block firmyieldvale.pro at the network perimeter, log DNS queries for the recorded IPs, and treat any connections as potentially malicious. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a0d812-deca-7145-b058-d6fcf1556849/ Cloudflare Radar report: https://radar.cloudflare.com/scan/4725b60c-b6d0-4fa9-8ca0-556a190a61b7 Stored capture screenshot: https://urlscan.io/screenshots/01a0d812-deca-7145-b058-d6fcf1556849.png URLScan screenshot (2026-09-24T14:00:26Z): https://screenshots.phishdestroy.io/us/01a0d3b7-9ade-7559-ae93-cc5e1f82df15.png URLScan capture report: https://urlscan.io/result/01a0d3b7-9ade-7559-ae93-cc5e1f82df15/ VirusTotal report: https://www.virustotal.com/gui/domain/firmyieldvale.pro Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=firmyieldvale.pro Archived copy: https://web.archive.org/web/20261026220228/https://firmyieldvale.pro/ Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-26 22:06:48 UTC ## Stored page captures - Primary capture: https://urlscan.io/screenshots/01a0d812-deca-7145-b058-d6fcf1556849.png Captured: 2026-10-26 21:59:31 UTC - URLScan capture 1: https://screenshots.phishdestroy.io/01a0d812-deca-7145-b058-d6fcf1556849.png Source report: https://urlscan.io/result/01a0d812-deca-7145-b058-d6fcf1556849/ - URLScan · 2026-09-24: https://screenshots.phishdestroy.io/us/01a0d3b7-9ade-7559-ae93-cc5e1f82df15.png Captured: 2026-09-24 14:00:26 UTC Source report: https://urlscan.io/result/01a0d3b7-9ade-7559-ae93-cc5e1f82df15/ SHA-256: c971919043a51d2914e0986618f1d0e6fcf222a41294e22d066214b851002db2 - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/4725b60c-b6d0-4fa9-8ca0-556a190a61b7.png Captured: 2026-10-26 22:05:10 UTC Source report: https://radar.cloudflare.com/scan/4725b60c-b6d0-4fa9-8ca0-556a190a61b7 SHA-256: ab1db875a32a449f5e5251717113b8702abb761fcd06f083e36a2bf164290b1f ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-26T22:05:57Z", "uuid": "01a0d812-deca-7145-b058-d6fcf1556849", "scanned_at": "2026-09-25T10:18:38Z", "final_url": "https://firmyieldvale.pro/", "status": 200, "redirected": "https-only", "redirects": [ { "to": "https://firmyieldvale.pro/", "from": "http://firmyieldvale.pro/", "status": 307 } ], "ip": "172.67.176.121", "domains": [ "cdnjs.cloudflare.com", "cdn.jsdelivr.net", "fonts.googleapis.com", "static.cloudflare.com" ], "ips": [ "2a04:4e42:600::485", "2a00:1450:4001:c25::5f", "104.17.25.14", "172.67.176.121" ], "asns": [ "54113", "15169", "13335" ], "countries": [ "US", "DE" ], "doc_hash": "4c15bc414b47a9e8ec84a249b1c63fc8ac9db623b2f481805d715db4c610d9b3", "script_hashes": [ "ccf00d1923b0131a10e0c6d26f95e5dee6ebf8621a27e83c5a2f68a2e0093142" ], "globals": [ "requestResize", "LANG_MSGS", "ClientJS", "_fujl9t6", "toggleTermsPopup", "__cfQR", "__cfRLUnblockHandlers", "__lgT0" ], "cookies": [ "entry_url" ], "tls": { "san": [ "firmyieldvale.pro" ], "cipher": "AES_128_GCM", "issuer": "WE1", "subject": "firmyieldvale.pro", "protocol": "QUIC", "valid_to": "2026-12-04T10:33:04Z", "valid_from": "2026-09-05T09:33:07Z" }, "domain_age_days": 197, "apex_age_days": 197, "tls_age_days": 20, "tls_valid_days": 90, "requests": 16, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 96, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "cloudflare", "content-type": "text/html; charset=utf-8", "strict-transport-security": "max-age=63072000; includeSubDomains; preload", "content-security-policy": "default-src 'self'; font-src 'self' https://fonts.gstatic.com https://cdnjs.cloudflare.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://cdnjs.cloudflare.com; connect-src 'sel", "x-frame-options": "SAMEORIGIN", "x-content-type-options": "nosniff", "referrer-policy": "strict-origin", "permissions-policy": "camera=(), microphone=(), geolocation=()", "cross-origin-opener-policy": "same-origin" } }, "cf": { "v": 1, "fetched_at": "2026-10-26T22:27:39Z", "uuid": "4725b60c-b6d0-4fa9-8ca0-556a190a61b7", "scanned_at": "2026-10-26T22:05:10Z", "final_url": "https://firmyieldvale.pro/", "status": 200, "history": [ { "url": "https://firmyieldvale.pro/", "status": 200 } ], "dom_hash": "472bdd4c4b9e881c98e02dc278898ad942335db9336e62946ca353dd485bf0c3", "doc_hash": "866eeea416155207eeb10ab46c24489662f4342b107f34aefda7f22b956cc9a0", "phishing_v2": [ "phishing" ], "domain_risks": [ "Malware", "Security threats", "CIPA Filter", "CIPA" ], "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "firmyieldvale.pro", "type": "A", "value": "104.21.40.56" }, { "name": "firmyieldvale.pro", "type": "A", "value": "172.67.176.121" }, { "name": "firmyieldvale.pro", "type": "AAAA", "value": "2606:4700:3032::ac43:b079" }, { "name": "firmyieldvale.pro", "type": "AAAA", "value": "2606:4700:3034::6815:2838" } ], "dnssec_valid": false, "ip": "104.21.40.56", "verdict": { "tags": [ "malware" ], "malicious": true, "categories": [ "malware" ] }, "whois": { "registrar": "NameCheap, Inc.", "created": "2026-03-11T11:41:55Z", "updated": "2026-08-11T19:38:33Z", "expires": "2027-03-11T11:41:55Z", "nameservers": [ "alec.ns.cloudflare.com", "journey.ns.cloudflare.com" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-26T22:03:52Z", "analysis_at": "2026-10-24T20:18:16Z", "stats": { "timeout": 0, "harmless": 43, "malicious": 13, "suspicious": 4, "undetected": 32 }, "detections": { "CRDF": "malicious", "DNS8": "suspicious", "ESET": "suspicious", "VIPRE": "phishing", "G-Data": "phishing", "Lionic": "phishing", "Sophos": "malware", "CyRadar": "phishing", "Fortinet": "phishing", "PREBYTES": "suspicious", "SOCRadar": "phishing", "Kaspersky": "phishing", "Seclookup": "malicious", "Gridinsoft": "phishing", "BitDefender": "phishing", "alphaMountain.ai": "suspicious", "Forcepoint ThreatSeeker": "phishing" }, "reputation": 0, "categories": { "Sophos": "phishing and fraud", "alphaMountain.ai": "Suspicious (alphaMountain.ai)" }, "created": "2026-03-11T00:00:00Z", "updated": "2026-03-11T00:00:00Z", "first_seen": "2026-03-11T15:56:07Z", "dns": [ { "ttl": 300, "type": "AAAA", "value": "2606:4700:3034::6815:2838" }, { "ttl": 21600, "type": "NS", "value": "alec.ns.cloudflare.com" }, { "ttl": 300, "type": "TXT", "value": "google-site-verification=xsQYxOJnyKiL8sOp2Xv6ioMgcqCSZ43SHEoenoQP7lE" }, { "ttl": 300, "type": "MX", "value": "mail.firmyieldvale.pro", "priority": 10 }, { "ttl": 300, "type": "AAAA", "value": "2606:4700:3032::ac43:b079" }, { "ttl": 21600, "type": "NS", "value": "journey.ns.cloudflare.com" }, { "ttl": 1800, "type": "SOA", "rname": "dns.cloudflare.com", "value": "alec.ns.cloudflare.com" }, { "ttl": 300, "type": "TXT", "value": "v=spf1 ip4:46.166.131.92 ~all" }, { "ttl": 300, "type": "A", "value": "172.67.176.121" }, { "ttl": 300, "type": "A", "value": "104.21.40.56" } ], "dns_at": "2026-10-24T20:23:36Z", "jarm": "27d40d40d00040d00042d43d00041df04c41293ba84f6efe3a613b22f983e6", "cert": { "san": [ "firmyieldvale.pro" ], "issuer": "Google Trust Services / WE1", "serial": "9fe576a2cf4f844b0ea3f314788394e", "sha256": "4f88a7814e7bdac56186090059468852b9238c8fb02e28a249c914c83b79ac3e", "subject": "firmyieldvale.pro", "valid_to": "2026-12-04T10:33:04Z", "valid_from": "2026-09-05T09:33:07Z" }, "rdap": { "status": [ "client transfer prohibited" ], "events": { "registration": "2026-03-11T11:41:55Z", "registrar expiration": "2027-03-11T11:41:55Z", "last update of RDAP database": "2026-10-24T20:23:36Z" }, "registrar": "NAMECHEAP INC", "registrar_iana_id": "1068" } }, "webcheck": { "v": 1, "fetched_at": "2026-10-26T22:06:31Z", "mail_config": { "mx": [ "mail.firmyieldvale.pro" ], "spf": "v=spf1 ip4:46.166.131.92 ~all", "spf_lookups": 0 }, "caa_records": { "domain": "firmyieldvale.pro" }, "block_lists": { "resolvers": 12, "blocked_by": [ "CloudFlare Family" ], "blocked_count": 1 }, "archives": { "last": "2026-10-26T22:02:28Z", "first": "2026-10-09T19:31:55Z", "changes": 1, "days_archived": 2, "scans_per_day": 0.06, "avg_page_bytes": 40532 }, "robots_txt": { "agents": [ "*", "Amazonbot", "Applebot-Extended", "Bytespider", "CCBot" ], "present": true, "sitemaps": [ "https://firmyieldvale.pro/sitemap.xml" ] }, "sitemap": { "present": true, "url_count": 5 }, "social_tags": { "title": "Firm Yieldvale | AI Trading Platform | Official Website", "robots": "index, follow", "themeColor": "#061310", "description": "Firm Yieldvale delivers a premium, AI-driven trading platform that orchestrates automated bots, multi-asset workflows, and intelligent risk controls for superior market participation." }, "trackers": { "requests": 16, "trackers": [ { "name": "Cloudflare", "company": "Cloudflare", "country": "US", "category": "Hosting", "requests": 5 }, { "name": "Google Fonts", "company": "Google", "country": "US", "category": "Hosting", "requests": 1 }, { "name": "jsDelivr", "company": "jsDelivr", "category": "Hosting", "requests": 1 } ] }, "mixed_content": { "no_sri": [ "https://static.cloudflare.com/beacon.min.js", "https://challenges.cloudflare.com/turnstile/v0/api.js", "https://cdn.jsdelivr.net/npm/clientjs@0.2.1/dist/client.min.js" ], "third_party_scripts": 3 }, "status": { "up": true, "code": 200, "timings": { "dns": 12, "tls": 31, "wait": 133, "connect": 6, "download": 11 }, "response_ms": 193 }, "tls_connection": { "alpn": "h2", "cipher": "TLS_AES_256_GCM_SHA384", "protocol": "TLSv1.3", "versions": [ "TLSv1.2", "TLSv1.3" ], "authorized": true, "forward_secrecy": true }, "ports": { "open": [ 80, 443, 8080 ] }, "carbon": { "bytes": 133579, "co2_grams": 0.0049, "cleaner_than": 16 }, "dns_server": { "ns": [ { "ip": "162.159.38.3", "host": "journey.ns.cloudflare.com" }, { "ip": "172.64.33.59", "host": "alec.ns.cloudflare.com" } ], "zone": "firmyieldvale.pro" }, "cookies": { "cookies": [ { "name": "entry_url", "secure": true, "same_site": "Lax" } ] }, "location": { "ip": "2606:4700:3034::6815:2838", "asn": "13335", "org": "Cloudflare, Inc.", "city": "Toronto", "country": "CA" }, "ssl": { "issuer": "Google Trust Services / WE1", "subject": "firmyieldvale.pro" }, "dns": { "A": [ "172.67.176.121", "104.21.40.56" ], "MX": [ "{\"exchange\": \"mail.firmyieldvale.pro\", \"priority\": 10}" ], "NS": [ "journey.ns.cloudflare.com", "alec.ns.cloudflare.com" ], "SOA": "{\"nsname\": \"alec.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2418083818, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}", "TXT": [ "v=spf1 ip4:46.166.131.92 ~all", "google-site-verification=xsQYxOJnyKiL8sOp2Xv6ioMgcqCSZ43SHEoenoQP7lE" ], "AAAA": [ "2606:4700:3034::6815:2838", "2606:4700:3032::ac43:b079" ] }, "dnssec": { "ds": false, "rrsig": false, "dnskey": false }, "hsts": { "header": "max-age=15552000; includeSubDomains; preload", "message": "HSTS max-age is 15552000, below the 31536000 minimum." }, "http_security": { "xFrameOptions": "SAMEORIGIN", "referrerPolicy": "no-referrer-when-downgrade", "xXSSProtection": false, "permissionsPolicy": "camera=(), microphone=(), geolocation=()", "xContentTypeOptions": "nosniff", "contentSecurityPolicy": "default-src 'self'; connect-src 'self' https://cloudflareinsights.com https://challenges.cloudflare.com; font-src 'self'", "strictTransportPolicy": "max-age=15552000; includeSubDomains; preload", "crossOriginOpenerPolicy": "same-origin", "crossOriginEmbedderPolicy": false, "crossOriginResourcePolicy": false }, "firewall": { "waf": "Cloudflare", "has_waf": true }, "get_ip": { "ip": "2606:4700:3032::ac43:b079", "family": 6 }, "redirects": { "chain": [ "https://firmyieldvale.pro" ] }, "tech_stack": { "technologies": [ "jsDelivr", "Cloudflare Turnstile", "Cloudflare Rocket Loader", "ClientJS", "Priority Hints", "Google Font API", "HSTS", "Cloudflare", "HTTP/3" ] }, "linked_pages": { "internal_count": 12 }, "headers": { "headers": { "server": "cloudflare", "content-type": "text/html; charset=utf-8", "strict-transport-security": "max-age=15552000; includeSubDomains; preload", "content-security-policy": "default-src 'self'; connect-src 'self' https://cloudflareinsights.com https://challenges.cloudflare.com; font-src 'self' https://fonts.gstatic.com https://cdnjs.cloudflare.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://cdnjs.cloudflare.com; frame-src https://challenges.cl", "x-frame-options": "SAMEORIGIN", "x-content-type-options": "nosniff", "referrer-policy": "no-referrer-when-downgrade", "permissions-policy": "camera=(), microphone=(), geolocation=()", "cross-origin-opener-policy": "same-origin" } } } } ```