# PhishDestroy domain threat record: framecapcormax.net

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/framecapcormax.net/
Machine-readable companion: https://phishdestroy.io/domain/framecapcormax.net/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-26 23:54:19 UTC
- Last availability or vendor check: 2026-10-28 00:02:41 UTC
- Stored record updated: 2026-10-28 00:02:41 UTC
- VirusTotal detections in the stored snapshot: 16/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored infrastructure

- Observed IP address: 158.94.210.119
- Registrar in stored WHOIS data: Dynadot Inc
- Registration date in stored WHOIS data: 2026-04-22 10:04:23 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a17aa1-ed2b-775a-8a14-a683d03a2d88/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/framecapcormax.net
- Certificate Transparency search: https://crt.sh/?q=%25.framecapcormax.net
- Web Archive lookup: https://web.archive.org/web/*/https://framecapcormax.net/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
PhishDestroy listed framecapcormax.net as suspicious based on a trusted auto rule that flagged the domain after 187 days of age. The domain was first observed by PhishDestroy on 2026-10-27, when an HTTP 200 response was recorded and the page title read “Frame +Cap Cormax - Piattaforma di Trading AI e Analisi Mercati”.

How the scam works
No concrete malicious behavior was seen on the captured page, and the available evidence does not point to a particular fraud type. The domain is flagged because security scanners often associate similar AI‑trading pages with phishing or malware distribution, typically used to lure credentials or deliver unwanted code.

Evidence
VirusTotal scanned the domain on 2026-10-21 and reported 16 detections from 92 engines, including 13 malicious and 3 suspicious labels from vendors such as CRDF, BitDefender and alphaMountain.ai. Google Safe Browsing checked on 2026-10-27 and did not flag the site, while PhishDestroy’s internal blocklist marked it as listed and external blocklists showed zero hits on that date. OTX recorded four pulses referencing the domain as of 2026-10-27; URLScan captured the site on 2026-10-27 with its engine scoring it malicious (score 94) but an overall non‑malicious verdict, and Cloudflare Radar flagged the domain as malicious under the malware category on the same day.

Infrastructure
The domain was registered with Dynadot Inc on 2026-04-22 and uses the nameservers ns1.dyna-ns.net and ns2.dyna-ns.net. The recorded IP address is 158.94.210.119, associated with Omegatech LTD in the Netherlands, and the site presented a Let’s Encrypt / YE2 TLS certificate valid from 2026-08-31 to 2026-11-29 using TLS 1.3 with AES_128_GCM.

What to do
Visitors should avoid entering credentials, downloading files, or providing personal information on this site; if any credentials were submitted, change the associated passwords immediately. Security teams should block traffic to framecapcormax.net, monitor logs for connections to the recorded IP, and treat alerts referencing this exact address as potentially malicious.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a17aa1-ed2b-775a-8a14-a683d03a2d88/
Cloudflare Radar report: https://radar.cloudflare.com/scan/4c684535-e15a-4fee-9e6b-410333af7190
URLQuery report: https://urlquery.net/report/5b7f3708-3fa9-45c7-894f-e6f4822ff2b2
Stored capture screenshot: https://i.ibb.co/fVQhj4rk/b4711a119c78.png
Cloudflare Radar screenshot (2026-10-27T00:25:33Z): https://screenshots.phishdestroy.io/cf/4c684535-e15a-4fee-9e6b-410333af7190.png
URLQuery screenshot: https://screenshots.phishdestroy.io/uq/5b7f3708-3fa9-45c7-894f-e6f4822ff2b2.png
URLScan screenshot (2026-08-31T23:45:56Z): https://screenshots.phishdestroy.io/us/01a05a36-ff0b-7195-a1cc-73e917f4ce29.png
URLScan capture report: https://urlscan.io/result/01a05a36-ff0b-7195-a1cc-73e917f4ce29/
URLScan screenshot (2026-09-01T10:16:03Z): https://screenshots.phishdestroy.io/us/01a05c77-c4b3-7156-b585-5ec3a58d5a91.png
URLScan capture report: https://urlscan.io/result/01a05c77-c4b3-7156-b585-5ec3a58d5a91/
URLScan screenshot (2026-10-27T00:05:25Z): https://screenshots.phishdestroy.io/us/01a17aac-f9ad-739d-a4a7-cbdda517a39d.png
URLScan capture report: https://urlscan.io/result/01a17aac-f9ad-739d-a4a7-cbdda517a39d/
VirusTotal report: https://www.virustotal.com/gui/domain/framecapcormax.net
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=framecapcormax.net
Archived copy: https://web.archive.org/web/20261026235526/https://framecapcormax.net/
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-27 00:26:45 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/fVQhj4rk/b4711a119c78.png
  Captured: 2026-10-26 23:54:19 UTC
- URLScan capture 1: https://screenshots.phishdestroy.io/01a17aa1-ed2b-775a-8a14-a683d03a2d88.png
  Captured: 2026-10-26 23:54:19 UTC
  Source report: https://urlscan.io/result/01a17aa1-ed2b-775a-8a14-a683d03a2d88/
- URLScan · 2026-08-31: https://screenshots.phishdestroy.io/us/01a05a36-ff0b-7195-a1cc-73e917f4ce29.png
  Captured: 2026-08-31 23:45:56 UTC
  Source report: https://urlscan.io/result/01a05a36-ff0b-7195-a1cc-73e917f4ce29/
  SHA-256: 892caeb244f01f64fafb0b024fdfff3fc385426e88f954df6bcb3e639b461fbf
- URLScan · 2026-09-01: https://screenshots.phishdestroy.io/us/01a05c77-c4b3-7156-b585-5ec3a58d5a91.png
  Captured: 2026-09-01 10:16:03 UTC
  Source report: https://urlscan.io/result/01a05c77-c4b3-7156-b585-5ec3a58d5a91/
  SHA-256: 896a476ccbeb1e2ced73a25d54413db031516e45208b0586cfa8fcea8db64cd6
- URLScan · 2026-10-27: https://screenshots.phishdestroy.io/us/01a17aac-f9ad-739d-a4a7-cbdda517a39d.png
  Captured: 2026-10-27 00:05:25 UTC
  Source report: https://urlscan.io/result/01a17aac-f9ad-739d-a4a7-cbdda517a39d/
  SHA-256: a97f37de239454cd8549764557f48ae7528af11fe4ffd6ef99dd8b82ca89b7fb
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/4c684535-e15a-4fee-9e6b-410333af7190.png
  Captured: 2026-10-27 00:25:33 UTC
  Source report: https://radar.cloudflare.com/scan/4c684535-e15a-4fee-9e6b-410333af7190
  SHA-256: 70c1de825ae23f32422a78ebb88cf7498695b1bc295a742aaa986e7325235086
- URLQuery: https://screenshots.phishdestroy.io/uq/5b7f3708-3fa9-45c7-894f-e6f4822ff2b2.png
  Source report: https://urlquery.net/report/5b7f3708-3fa9-45c7-894f-e6f4822ff2b2
  SHA-256: 189a9a0b8840e675eb131a1869873f593768ec2ec7bb83a86e8b8681e947debd

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-27T00:25:47Z",
        "uuid": "01a17aa1-ed2b-775a-8a14-a683d03a2d88",
        "scanned_at": "2026-10-26T23:53:22Z",
        "final_url": "https://framecapcormax.net/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://framecapcormax.net/",
                "from": "http://framecapcormax.net/",
                "status": 307
            }
        ],
        "ip": "158.94.210.119",
        "ips": [
            "158.94.210.119"
        ],
        "asns": [
            "202412"
        ],
        "countries": [
            "NL"
        ],
        "doc_hash": "a95bc2a261d46617a7d5c11bab519c39c3a38ce328eaa571ed7e3a593b7a4815",
        "script_hashes": [
            "8aa5f8f647356dcd4fc5dbbe0efd5bc0e8da74026bc61e24636e2e1f5749b0ce"
        ],
        "globals": [
            "__dclq",
            "__dclOrig",
            "__dclFlush",
            "checkFooter",
            "__smsCheckBeforeSubmit",
            "__isSmsEnabled",
            "__isSmsVerified",
            "intlTelInput",
            "navToggle",
            "navMenu",
            "langBtn",
            "langDropdown",
            "footerDivider"
        ],
        "cookies": [
            "connect.sid"
        ],
        "tls": {
            "san": [
                "framecapcormax.net"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "YE2",
            "subject": "framecapcormax.net",
            "protocol": "TLS 1.3",
            "valid_to": "2026-11-29T11:05:23Z",
            "valid_from": "2026-08-31T11:05:24Z"
        },
        "domain_age_days": 187,
        "apex_age_days": 187,
        "tls_age_days": 56,
        "tls_valid_days": 89,
        "requests": 6,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 94,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "content-type": "text/html; charset=utf-8",
            "x-content-type-options": "nosniff",
            "referrer-policy": "same-origin"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-27T00:25:50Z",
        "uuid": "4c684535-e15a-4fee-9e6b-410333af7190",
        "scanned_at": "2026-10-27T00:25:33Z",
        "final_url": "https://framecapcormax.net/",
        "status": 200,
        "history": [
            {
                "url": "https://framecapcormax.net/",
                "status": 200
            }
        ],
        "dom_hash": "200b16bb3eea4d4505c73c79b641c3bdec20d98c063c5445cd1e837387f9fe9b",
        "doc_hash": "6788ad4495fe42955cba81bc84a5da3e2c5ed2c6561f443bd67c7a325f938fb8",
        "phishing_v2": [
            "phishing"
        ],
        "domain_risks": [
            "Malware",
            "Security threats",
            "CIPA Filter",
            "CIPA"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "framecapcormax.net",
                "type": "A",
                "value": "158.94.210.119"
            }
        ],
        "dnssec_valid": false,
        "ip": "158.94.210.119",
        "verdict": {
            "tags": [
                "malware"
            ],
            "malicious": true,
            "categories": [
                "malware"
            ]
        },
        "whois": {
            "registrar": "Dynadot Inc",
            "created": "2026-04-22T12:04:23Z",
            "updated": "2026-08-13T12:28:25Z",
            "expires": "2027-04-22T12:04:23Z",
            "nameservers": [
                "ns1.dyna-ns.net",
                "ns2.dyna-ns.net"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-27T00:25:30Z",
        "analysis_at": "2026-10-21T12:00:56Z",
        "stats": {
            "timeout": 0,
            "harmless": 44,
            "malicious": 13,
            "suspicious": 3,
            "undetected": 32
        },
        "detections": {
            "CRDF": "malicious",
            "DNS8": "suspicious",
            "ESET": "suspicious",
            "VIPRE": "phishing",
            "G-Data": "phishing",
            "Lionic": "phishing",
            "Sophos": "phishing",
            "CyRadar": "phishing",
            "Fortinet": "spam",
            "SOCRadar": "phishing",
            "Kaspersky": "phishing",
            "Seclookup": "malicious",
            "Gridinsoft": "phishing",
            "BitDefender": "phishing",
            "alphaMountain.ai": "phishing",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "created": "2026-04-22T00:00:00Z",
        "updated": "2026-04-22T00:00:00Z",
        "first_seen": "2026-04-22T12:55:11Z",
        "dns": [
            {
                "ttl": 300,
                "type": "A",
                "value": "158.94.210.119"
            },
            {
                "ttl": 300,
                "type": "SOA",
                "rname": "hostmaster.framecapcormax.net",
                "value": "ns1.dyna-ns.net"
            },
            {
                "ttl": 300,
                "type": "NS",
                "value": "ns2.dyna-ns.net"
            },
            {
                "ttl": 300,
                "type": "NS",
                "value": "ns1.dyna-ns.net"
            }
        ],
        "dns_at": "2026-10-21T12:06:15Z",
        "jarm": "40d40d40d00000000043d43d00043d6aff5ab0f4fc31897186312c9e639319",
        "cert": {
            "san": [
                "framecapcormax.net"
            ],
            "issuer": "Let's Encrypt / YE2",
            "serial": "503728a4b6dfb3c224b577f539d58233cf7",
            "sha256": "3085de164f364369bd17a1bef8fbe06f5a06bb62a6ad36363c5d9f1ffe1a72ee",
            "subject": "framecapcormax.net",
            "valid_to": "2026-11-29T11:05:23Z",
            "valid_from": "2026-08-31T11:05:24Z"
        },
        "whois": [],
        "rdap": {
            "status": [
                "transfer prohibited"
            ],
            "events": {
                "expiration": "2027-04-22T12:04:23Z",
                "last changed": "2026-08-31T11:52:55Z",
                "registration": "2026-04-22T12:04:23Z",
                "registrar expiration": "2027-04-22T12:04:23Z",
                "last update of RDAP database": "2026-10-16T07:01:17Z"
            },
            "registrar": "DYNADOT LLC",
            "registrar_iana_id": "472"
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-27T00:26:02Z",
        "mail_config": {
            "spf_lookups": 0
        },
        "caa_records": {
            "domain": "framecapcormax.net"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_by": [
                "CloudFlare Family"
            ],
            "blocked_count": 1
        },
        "archives": {
            "last": "2026-10-26T23:55:26Z",
            "first": "2026-10-26T23:55:26Z",
            "changes": 0,
            "days_archived": 1,
            "avg_page_bytes": 24316
        },
        "robots_txt": {
            "agents": [
                "*"
            ],
            "present": true,
            "sitemaps": [
                "https://framecapcormax.net/sitemap.xml"
            ]
        },
        "sitemap": {
            "present": true,
            "url_count": 5
        },
        "social_tags": {
            "title": "Frame +Cap Cormax - Piattaforma di Trading AI e Analisi Mercati",
            "robots": "index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1",
            "description": "Frame +Cap Cormax - Analisi predittiva AI, trading automatizzato e opportunità di investimento su 140+ mercati globali. Decisioni più smart, accesso rapido ai mercati.",
            "canonicalUrl": "https://framecapcormax.net/"
        },
        "trackers": {
            "requests": 31,
            "trackers": [
                {
                    "name": "Cloudflare",
                    "company": "Cloudflare",
                    "country": "US",
                    "category": "Hosting",
                    "requests": 1
                },
                {
                    "name": "jsDelivr",
                    "company": "jsDelivr",
                    "category": "Hosting",
                    "requests": 3
                }
            ]
        },
        "mixed_content": {
            "third_party_scripts": 0
        },
        "status": {
            "up": true,
            "code": 200,
            "timings": {
                "dns": 530,
                "tls": 81,
                "wait": 93,
                "connect": 68,
                "download": 163
            },
            "response_ms": 935
        },
        "tls_connection": {
            "alpn": "h2",
            "cipher": "TLS_AES_128_GCM_SHA256",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                22,
                80,
                443
            ]
        },
        "carbon": {
            "bytes": 95141,
            "co2_grams": 0.0035,
            "cleaner_than": 23
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "162.159.24.5",
                    "host": "ns2.dyna-ns.net"
                },
                {
                    "ip": "162.159.27.158",
                    "host": "ns1.dyna-ns.net"
                }
            ],
            "zone": "framecapcormax.net"
        },
        "cookies": {
            "cookies": [
                {
                    "name": "cf-c",
                    "http_only": true,
                    "same_site": "Lax"
                },
                {
                    "name": "__cf_clicked"
                },
                {
                    "name": "ph_phc_t6w4wzJE2sbz4ro8LmZZTssm5go3KD6mP7QsqcDQRSp6_posthog",
                    "secure": true,
                    "same_site": "Lax"
                }
            ]
        },
        "location": {
            "ip": "158.94.210.119",
            "asn": "202412",
            "org": "Omegatech LTD",
            "city": "Amsterdam",
            "country": "NL"
        },
        "ssl": {
            "issuer": "Let's Encrypt / YE2",
            "subject": "framecapcormax.net"
        },
        "dns": {
            "A": [
                "158.94.210.119"
            ],
            "NS": [
                "ns2.dyna-ns.net",
                "ns1.dyna-ns.net"
            ],
            "SOA": "{\"nsname\": \"ns1.dyna-ns.net\", \"hostmaster\": \"hostmaster.framecapcormax.net\", \"serial\": 2026083101, \"refresh\": 16384, \"retry\": 2048, \"expire\": 1209600, \"minttl\": 300}"
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "hsts": {
            "message": "Site does not serve any HSTS headers."
        },
        "http_security": {
            "xFrameOptions": false,
            "referrerPolicy": "same-origin",
            "xXSSProtection": false,
            "permissionsPolicy": false,
            "xContentTypeOptions": "nosniff",
            "contentSecurityPolicy": false,
            "strictTransportPolicy": false,
            "crossOriginOpenerPolicy": false,
            "crossOriginEmbedderPolicy": false,
            "crossOriginResourcePolicy": false
        },
        "get_ip": {
            "ip": "158.94.210.119",
            "family": 4
        },
        "redirects": {
            "chain": [
                "https://framecapcormax.net"
            ]
        },
        "subdomains": {
            "count": 1,
            "subdomains": [
                "www.framecapcormax.net"
            ]
        },
        "tech_stack": {
            "technologies": [
                "Node.js",
                "Express",
                "lit-html",
                "lit-element",
                "HTTP/3"
            ]
        },
        "linked_pages": {
            "internal_count": 26
        },
        "whois": {
            "registrar": "Dynadot Inc",
            "created": "2026-04-22T12:04:23Z",
            "updated": "2026-08-13T12:28:25Z",
            "expires": "2027-04-22T12:04:23Z",
            "status": [
                "clientTransferProhibited https://icann.org/epp"
            ],
            "nameservers": [
                "ns1.dyna-ns.net",
                "ns2.dyna-ns.net"
            ]
        },
        "headers": {
            "headers": {
                "content-type": "text/html; charset=utf-8",
                "x-content-type-options": "nosniff",
                "referrer-policy": "same-origin"
            }
        }
    }
}
```