# PhishDestroy domain threat record: frt-xev-onix.com Content language: English Canonical HTML report: https://phishdestroy.io/domain/frt-xev-onix.com/ Machine-readable companion: https://phishdestroy.io/domain/frt-xev-onix.com/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-10-26 16:19:22 UTC - Last availability or vendor check: 2026-10-26 16:45:58 UTC - Stored record updated: 2026-10-26 21:10:34 UTC - VirusTotal detections in the stored snapshot: 1/92 - Independent public blocklist matches in the stored snapshot: 2 - Matching public blocklists: MetaMask, SEAL - Google Safe Browsing stored result: no stored flag ## Stored infrastructure - Observed IP address: 198.27.109.52 - Registrar in stored WHOIS data: NameSilo, LLC - Last stored HTTP status: 200 - Registration date in stored WHOIS data: 2026-10-08 22:01:54 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a17919-4316-77f5-b943-a23b1795249d/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/frt-xev-onix.com - Certificate Transparency search: https://crt.sh/?q=%25.frt-xev-onix.com - Web Archive lookup: https://web.archive.org/web/*/https://frt-xev-onix.com/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored page captures - Primary capture: https://i.ibb.co/mVZ4CYw2/b84e93cb36ff.png Captured: 2026-10-26 16:45:58 UTC - URLScan capture 1: https://urlscan.io/screenshots/01a17919-4316-77f5-b943-a23b1795249d.png Captured: 2026-10-26 16:45:58 UTC Source report: https://urlscan.io/result/01a17919-4316-77f5-b943-a23b1795249d/ - URLScan capture 2: https://screenshots.phishdestroy.io/01a177a3-4e7c-76af-9c3a-bb13d0b4b4de.png Captured: 2026-10-26 16:19:22 UTC Source report: https://urlscan.io/result/01a17919-4316-77f5-b943-a23b1795249d/ - URLScan ยท 2026-10-25: https://screenshots.phishdestroy.io/us/01a1753c-9f5a-77d8-b923-93b4b2b68bbc.png Captured: 2026-10-25 22:44:46 UTC Source report: https://urlscan.io/result/01a1753c-9f5a-77d8-b923-93b4b2b68bbc/ SHA-256: 86f20b61028aeaba81fcce60795342c6aa192d4b150c4688147c93f6c5ff467b - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/92a7bde2-5cbe-4374-bbe3-02452fecba63.png Captured: 2026-10-26 16:30:46 UTC Source report: https://radar.cloudflare.com/scan/92a7bde2-5cbe-4374-bbe3-02452fecba63 SHA-256: 16d3b02b4453d67b4c0e255cf8b7c652e7107d402fd91593b9ddc8a878b4fb46 ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-26T17:05:30Z", "uuid": "01a17919-4316-77f5-b943-a23b1795249d", "scanned_at": "2026-10-26T16:44:50Z", "final_url": "https://frt-xev-onix.com/", "status": 200, "redirected": "https-only", "redirects": [ { "to": "https://frt-xev-onix.com/", "from": "http://frt-xev-onix.com/", "status": 307 } ], "ip": "198.27.109.52", "ptr": "ip52.ip-198-27-109.net", "domains": [ "www.tradingview-widget.com", "s3-symbol-logo.tradingview.com", "widget.coinlib.io", "widget-v3.smartsuppcdn.com", "scanner.tradingview.com", "coin-images.coingecko.com", "s3.tradingview.com", "snowplow-pixel.tradingview.com", "widget-sheriff.tradingview-widget.com", "translate.googleapis.com", "www.gstatic.com", "cdnjs.cloudflare.com", "widgetdata.tradingview.com", "www.tradingview.com", "s.tradingview.com", "use.fontawesome.com", "websocket-visitors.smartsupp.com", "pushstream.tradingview.com", "www.googletagmanager.com", "bootstrap.smartsuppchat.com", "translate-pa.googleapis.com", "fonts.gstatic.com", "www.smartsuppchat.com", "scanner-backend.tradingview.com", "api.coingecko.com", "fonts.googleapis.com", "translate.google.com", "widgets.coingecko.com", "cdn.jsdelivr.net", "www.clarity.ms" ], "ips": [ "195.181.172.6", "142.250.188.8", "3.125.68.253", "100.22.212.163", "99.84.234.114", "172.217.112.4", "52.85.31.102", "142.251.16.94", "195.181.172.3", "192.108.254.161", "138.199.40.58", "104.21.63.32", "13.32.241.80", "216.150.1.193", "142.250.31.95" ], "asns": [ "60068", "15169", "16509", "199524", "13335", "54113", "16276" ], "countries": [ "NL", "US", "DE", "CA" ], "link_domains": [ "translate.google.com", "www.tradingview.com" ], "doc_hash": "87dbc7d3223a0c1aba487fa11cc1d0d453c03feb3150a55fb01e378f1230a3b0", "script_hashes": [ "f3bf1dfc30c3d03223733bf3f8db208eac938252d5bd7fcd67443e3868815066", "2854c76d347ea7f08700f330afb842df73644475907f38ac769adc9288c16e22", "13cd5c801be8ba64264d6fce6cf132cc2a7e3d91092de855fb661610d19baa25", "f7413a14f53fcae513e0d12c6ff607f6e01648b881b875b1627549ebaf7b9d1d", "1e6905782838c7c5d13aa879a4bcb78645312a150eeef23e05ee7dcc3fa15f58", "2a4a109e24eb56658908927f5d7558085c562c4b721ebb1f89106bc4df5aa1e1", "1ed938af388dbd1fe63cfa4925e1ce07758c733ee7bfc5e4dfdd95bc2fb5a7f3", "8eebb033b54682d3490cca2e06204c463a2ab86a624bd54c94459b9876460b05", "179edb995606be05c67a56148526183548318aa4a80b50f08b10e2bc6d07a92a", "2d721db2014c36bc7953744f63906cb71eab66ec6404ab3f4eb491c105391053" ], "globals": [ "$", "jQuery", "cssInit", "initAnima", "outAnima", "resetAnima", "getURLParameter", "openWindow", "onePageScroll", "getOptionsString", "isEmpty", "correctValue", "isScrollView", "Cookies", "Sweetalert2", "SweetAlert", "Swal", "sweetAlert", "swal", "__core-js_shared__", "core", "googleTranslateElementInit", "_DumpException", "google", "TradingView", "Glide", "EvEmitter", "imagesLoaded", "default_tr", "_F_toggles_default_tr", "listCountries", "listPlans", "transarray", "run", "request", "interval", "changeLanguageByButtonClick", "showPopup", "closePopup", "_smartsupp" ], "cookies": [ "PHPSESSID", "_sp_ses.6222", "_sp_id.6222", "sp" ], "tls": { "san": [ "*.frt-xev-onix.com", "frt-xev-onix.com" ], "cipher": "AES_256_GCM", "issuer": "YR1", "subject": "frt-xev-onix.com", "protocol": "TLS 1.3", "valid_to": "2027-01-11T21:26:36Z", "valid_from": "2026-10-13T21:26:37Z" }, "domain_age_days": 16, "apex_age_days": 16, "tls_age_days": 12, "tls_valid_days": 89, "requests": 624, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 99, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "nginx", "content-type": "text/html; charset=UTF-8" } }, "cf": { "v": 1, "fetched_at": "2026-10-26T16:33:18Z", "uuid": "92a7bde2-5cbe-4374-bbe3-02452fecba63", "scanned_at": "2026-10-26T16:30:46Z", "final_url": "https://frt-xev-onix.com/", "status": 200, "history": [ { "url": "https://frt-xev-onix.com/", "status": 200 } ], "dom_hash": "751264da311197ab2989eb1a2778786a01f80137c89b5438f2563624221a3e95", "doc_hash": "87dbc7d3223a0c1aba487fa11cc1d0d453c03feb3150a55fb01e378f1230a3b0", "phishing_v2": [ "phishing" ], "url_risks": [ "Scam" ], "domain_risks": [ "New Domains", "Security Risks", "Newly Seen Domains", "Scam", "Security threats", "CIPA Filter", "CIPA" ], "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "frt-xev-onix.com", "type": "A", "value": "198.27.109.52" } ], "dnssec_valid": false, "ip": "198.27.109.52", "whois": { "registrar": "NameSilo, LLC", "created": "2026-10-09T00:01:54Z", "updated": "2026-10-09T00:04:44Z", "expires": "2027-10-09T00:01:54Z", "nameservers": [ "ns5.ddoscure.com", "ns6.ddoscure.com" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-26T21:10:13Z", "analysis_at": "2026-10-26T17:08:49Z", "stats": { "timeout": 0, "harmless": 54, "malicious": 1, "suspicious": 0, "undetected": 37 }, "detections": { "Netcraft": "malicious" }, "reputation": 0, "tags": [ "dga" ], "categories": { "alphaMountain.ai": "Spam (alphaMountain.ai)", "Forcepoint ThreatSeeker": "newly registered websites" }, "registrar": "NameSilo, LLC", "created": "2026-10-09T00:01:54Z", "expires": "2027-10-09T00:01:54Z", "updated": "2026-10-09T00:04:44Z", "first_seen": "2026-10-14T07:45:49Z", "dns": [ { "ttl": 21600, "type": "NS", "value": "protected3.ddoscure.com" }, { "ttl": 21600, "type": "NS", "value": "ns5.ddoscure.com" }, { "ttl": 14400, "type": "A", "value": "198.27.109.52" }, { "ttl": 14400, "type": "MX", "value": "frt-xev-onix.com", "priority": 0 }, { "ttl": 14400, "type": "TXT", "value": "v=spf1 +a +mx +ip4:142.44.212.2 +ip4:198.27.109.52 ~all" }, { "ttl": 21600, "type": "SOA", "rname": "ddoscure.gmail.com", "value": "ns5.ddoscure.com" }, { "ttl": 21600, "type": "NS", "value": "protected4.ddoscure.com" }, { "ttl": 21600, "type": "NS", "value": "ns6.ddoscure.com" } ], "dns_at": "2026-10-26T17:14:19Z", "jarm": "29d29d15d29d29d00042d42d00000072e74222ce193a6f991becaa3da6c94d", "cert": { "san": [ "*.frt-xev-onix.com", "frt-xev-onix.com" ], "issuer": "Let's Encrypt / YR1", "serial": "6ce935f0131a22731cee491a3cab4fab678", "sha256": "b9b0acf19d2ecb1aac481d11329c67e6688329147f323fe5d1045bc82e869177", "subject": "frt-xev-onix.com", "valid_to": "2027-01-11T21:26:36Z", "valid_from": "2026-10-13T21:26:37Z" }, "whois": { "registrar": "NameSilo, LLC", "registrar_iana_id": "1479", "registrar_url": "http://www.namesilo.com", "created": "2026-10-09T00:01:54Z", "updated": "2026-10-09T00:04:44Z", "expires": "2027-10-09T00:01:54Z", "status": [ "clientTransferProhibited" ], "nameservers": [ "ns5.ddoscure.com", "ns6.ddoscure.com" ], "dnssec": "unsigned" }, "rdap": { "status": [ "client transfer prohibited" ], "events": { "last changed": "2026-10-23T04:38:36Z", "registration": "2026-10-08T00:00:00Z", "registrar expiration": "2027-10-09T00:00:00Z", "last update of RDAP database": "2026-10-26T17:14:19Z" } } }, "webcheck": { "v": 1, "fetched_at": "2026-10-26T16:38:00Z", "mail_config": { "mx": [ "frt-xev-onix.com" ], "spf": "v=spf1 +a +mx +ip4:142.44.212.2 +ip4:198.27.109.52 ~all", "dkim": [ "default" ], "dmarc": true, "dkim_bits": 2048, "spf_lookups": 2 }, "caa_records": { "domain": "frt-xev-onix.com" }, "block_lists": { "resolvers": 12, "blocked_count": 0 }, "archives": { "last": "2026-10-26T16:30:04Z", "first": "2026-10-12T00:56:07Z", "changes": 1, "days_archived": 2, "scans_per_day": 0.07, "avg_page_bytes": 6598 }, "social_tags": { "ogUrl": "https://aurex-dex.com", "ogImage": "https://aurex-dex.com/media/fbb.png", "keywords": "FRT-XEV-ONIX investment platform", "description": "FRT-XEV-ONIX" }, "trackers": { "requests": 178, "trackers": [ { "name": "Google Tag", "company": "Google", "country": "US", "category": "Advertising", "requests": 1 }, { "name": "Google Translate", "company": "Google", "country": "US", "category": "Customer Interaction", "requests": 1 }, { "name": "Smartsupp Chat", "company": "Smartsuppp", "country": "CZ", "category": "Customer Interaction", "requests": 2 }, { "name": "Cloudflare", "company": "Cloudflare", "country": "US", "category": "Hosting", "requests": 1 }, { "name": "fontawesome.com", "company": "fontawesome.com", "category": "Hosting", "requests": 8 }, { "name": "Google APIs", "company": "Google", "country": "US", "category": "Hosting", "requests": 1 }, { "name": "Google Fonts", "company": "Google", "country": "US", "category": "Hosting", "requests": 1 }, { "name": "Google Static", "company": "Google", "country": "US", "category": "Hosting", "requests": 4 }, { "name": "jsDelivr", "company": "jsDelivr", "category": "Hosting", "requests": 1 }, { "name": "Microsoft Clarity", "company": "Microsoft", "country": "US", "category": "Site Analytics", "requests": 1 } ] }, "mixed_content": { "no_sri": [ "https://cdn.jsdelivr.net/npm/sweetalert2@10", "https://widgets.coingecko.com/coingecko-coin-price-marquee-widget.js", "https://translate.google.com/translate_a/element.js", "https://s3.tradingview.com/external-embedding/embed-widget-screener.js", "https://s3.tradingview.com/tv.js", "https://s3.tradingview.com/external-embedding/embed-widget-technical-analysis.js" ], "third_party_scripts": 6 }, "status": { "up": true, "code": 200, "timings": { "dns": 2, "tls": 127, "wait": 1134, "connect": 102, "download": 97 }, "response_ms": 1462 }, "tls_connection": { "alpn": "http/1.1", "cipher": "TLS_AES_256_GCM_SHA384", "protocol": "TLSv1.3", "versions": [ "TLSv1.2", "TLSv1.3" ], "authorized": true, "forward_secrecy": true }, "ports": { "open": [ 21, 22, 25, 53, 80, 110, 143, 443, 587, 993, 995 ] }, "carbon": { "bytes": 56229, "co2_grams": 0.0021, "cleaner_than": 34 }, "dns_server": { "ns": [ { "ip": "149.56.180.33", "host": "ns6.ddoscure.com" }, { "ip": "149.56.180.33", "host": "protected4.ddoscure.com" }, { "ip": "149.56.180.32", "host": "ns5.ddoscure.com" }, { "ip": "149.56.180.32", "host": "protected3.ddoscure.com" } ], "zone": "frt-xev-onix.com" }, "cookies": { "cookies": [ { "name": "PHPSESSID", "session": true, "http_only": true }, { "name": "_sp_ses.6222", "secure": true, "same_site": "None" }, { "name": "_sp_id.6222", "secure": true, "same_site": "None" } ] }, "location": { "ip": "198.27.109.52", "asn": "16276", "org": "OVH SAS", "city": "Charlotte Amalie", "country": "VI" }, "ssl": { "issuer": "Let's Encrypt / YR1", "subject": "frt-xev-onix.com" }, "dns": { "A": [ "198.27.109.52" ], "MX": [ "{\"exchange\": \"frt-xev-onix.com\", \"priority\": 0}" ], "NS": [ "ns6.ddoscure.com", "protected3.ddoscure.com", "protected4.ddoscure.com", "ns5.ddoscure.com" ], "SOA": "{\"nsname\": \"ns5.ddoscure.com\", \"hostmaster\": \"ddoscure.gmail.com\", \"serial\": 2026102200, \"refresh\": 3600, \"retry\": 1800, \"expire\": 1209600, \"minttl\": 86400}", "TXT": [ "v=spf1 +a +mx +ip4:142.44.212.2 +ip4:198.27.109.52 ~all" ] }, "dnssec": { "ds": false, "rrsig": false, "dnskey": false }, "hsts": { "message": "Site does not serve any HSTS headers." }, "http_security": { "xFrameOptions": false, "referrerPolicy": false, "xXSSProtection": false, "permissionsPolicy": false, "xContentTypeOptions": false, "contentSecurityPolicy": false, "strictTransportPolicy": false, "crossOriginOpenerPolicy": false, "crossOriginEmbedderPolicy": false, "crossOriginResourcePolicy": false }, "get_ip": { "ip": "198.27.109.52", "family": 4 }, "redirects": { "chain": [ "https://frt-xev-onix.com" ] }, "linked_pages": { "internal_count": 9 }, "whois": { "registrar": "NameSilo, LLC", "created": "2026-10-09T00:01:54Z", "updated": "2026-10-09T00:04:44Z", "expires": "2027-10-09T00:01:54Z", "status": [ "clientTransferProhibited https://icann.org/epp" ], "nameservers": [ "ns5.ddoscure.com", "ns6.ddoscure.com" ] }, "headers": { "headers": { "server": "nginx", "content-type": "text/html; charset=UTF-8" } } } } ```