# PhishDestroy domain threat record: futurecoreai.click Content language: English Canonical HTML report: https://phishdestroy.io/domain/futurecoreai.click/ Machine-readable companion: https://phishdestroy.io/domain/futurecoreai.click/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-09-12 17:59:00 UTC - Last availability or vendor check: 2026-10-21 22:32:33 UTC - Stored record updated: 2026-10-22 06:21:38 UTC - VirusTotal detections in the stored snapshot: 16/89 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: no stored flag ## Stored classification - Targeted brand: Investment Scam ## Stored infrastructure - Observed IP address: 188.114.97.3 - Registrar in stored WHOIS data: NETIM - Registrar country in stored WHOIS data: US - Last stored HTTP status: 200 - Registration date (registry RDAP, futurecoreai.click): 2026-05-10 11:20:09 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a096c8-7910-77c1-b352-5a6178b3b32a/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/futurecoreai.click - Certificate Transparency search: https://crt.sh/?q=%25.futurecoreai.click - Web Archive lookup: https://web.archive.org/web/*/https://futurecoreai.click/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview futurecoreai.click operates under the brand "Futurecore AI," presenting itself as a legitimate AI-powered cryptocurrency trading platform aimed at retail investors seeking automated returns. PhishDestroy first flagged it on 2026-09-12, and as of 2026-10-19 the site is still live with active content. The domain was quietly registered on 2026-05-10, giving operators months to build out the platform before detection. How the scam works Fake exchange scams draw victims in with promises of algorithmic or AI-driven profits, then encourage increasingly large cryptocurrency deposits into accounts the operators fully control. When a victim tries to withdraw, the platform invents tax holds, verification fees or minimum balance requirements to extract more money before vanishing entirely. The page title — "Futurecore AI | AI Trading Platform | Official Website" — is crafted to project institutional credibility and suppress skepticism at the moment a user is deciding whether to deposit. Evidence Sixteen of 89 engines on VirusTotal returned malicious verdicts against this domain as of 2026-09-20, with confirmed detections from BitDefender, ESET, Fortinet, Forcepoint ThreatSeeker, CRDF, CyRadar, alphaMountain.ai and Chong Lua Dao. Five independent threat intelligence pulses on OTX corroborate the classification. The domain is listed on the PhishDestroy blocklist. Infrastructure NETIM registered the domain on 2026-05-10, and traffic is routed through Cloudflare's network with hosting attributed to Canada. The site's TLS certificate is issued by ZeroSSL GmbH via ZeroSSL ECC DV SSL CA 2; a padlock in the browser bar reflects encryption only and carries no implication that the site has been vetted. What to do Anyone who deposited cryptocurrency should treat those funds as lost and refuse any further demands for fees or taxes, which are a secondary theft tactic. If you submitted identity documents or personal details, place fraud alerts with your financial institutions and monitor for misuse. Passwords shared with this site should be changed immediately on every platform where they were reused. Defenders should block futurecoreai.click at the DNS and firewall layers and propagate the associated indicators through internal threat intelligence pipelines. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a096c8-7910-77c1-b352-5a6178b3b32a/ VirusTotal report: https://www.virustotal.com/gui/domain/futurecoreai.click Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=futurecoreai.click Archived copy: https://web.archive.org/web/20260922185404/https://futurecoreai.click/ Revoke token approvals: https://revoke.cash/ Report crypto fraud (Chainabuse): https://www.chainabuse.com/report Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-19 08:35:35 UTC ## Stored page captures - Primary capture: https://i.ibb.co/DHBZNKvW/30c4bbdca7bf.png Captured: 2026-09-12 18:03:29 UTC - URLScan capture 1: https://screenshots.phishdestroy.io/01a096c8-7910-77c1-b352-5a6178b3b32a.png Captured: 2026-09-12 18:03:29 UTC Source report: https://urlscan.io/result/01a096c8-7910-77c1-b352-5a6178b3b32a/ - URLScan capture 2: https://urlscan.io/screenshots/019f88db-f48c-72ca-bd1a-899ed3af271d.png Captured: 2026-09-12 17:59:00 UTC Source report: https://urlscan.io/result/01a096c8-7910-77c1-b352-5a6178b3b32a/ - URLQuery: https://screenshots.phishdestroy.io/uq/cb39e03e-6a1f-47d9-9bd1-ace4120a5243.png Captured: 2026-09-12 18:09:59 UTC Source report: https://urlquery.net/report/cb39e03e-6a1f-47d9-9bd1-ace4120a5243 SHA-256: 45a8eaf98994d6a9c4ea19ecf4d2a473d58af6318f8ceaee904f8e7420be358c - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/26760337-6b4b-43e9-8f97-9edc118ad6a7.png Captured: 2026-09-12 18:03:54 UTC Source report: https://radar.cloudflare.com/scan/26760337-6b4b-43e9-8f97-9edc118ad6a7 SHA-256: 00090315661133745e95c955465b73c963ce1f05b5e68b0901b8c362a4b97191 - URLScan · 2026-09-12: https://screenshots.phishdestroy.io/us/01a096c8-771e-706a-8a58-b8e2ed0357a7.png Captured: 2026-09-12 18:02:01 UTC Source report: https://urlscan.io/result/01a096c8-771e-706a-8a58-b8e2ed0357a7/ SHA-256: f17936444fb4d2d0e7a203925c2e651b0a0d2971ad2b91fe04fb6b2846219372 ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-21T00:18:03Z", "uuid": "01a096c8-7910-77c1-b352-5a6178b3b32a", "scanned_at": "2026-09-12T18:02:01Z", "final_url": "https://futurecoreai.click/", "status": 200, "redirected": "https-only", "redirects": [ { "to": "https://futurecoreai.click/", "from": "http://futurecoreai.click/", "status": 307 } ], "ip": "188.114.96.3", "domains": [ "cdnjs.cloudflare.com", "cdn.jsdelivr.net", "fonts.googleapis.com", "static.cloudflare.com" ], "ips": [ "104.17.207.5", "142.251.13.95", "104.17.25.14", "188.114.96.3" ], "asns": [ "13335", "15169" ], "countries": [ "US" ], "doc_hash": "78b3a6205955a6f7968b860e6c1f505d8f9e175b2a0fa4f070282ddbd05f3039", "script_hashes": [ "ccf00d1923b0131a10e0c6d26f95e5dee6ebf8621a27e83c5a2f68a2e0093142" ], "globals": [ "LANG_MSGS", "ClientJS", "_cqne4", "toggleTermsPopup", "__cfQR", "__cfRLUnblockHandlers", "__lgT0" ], "cookies": [ "entry_url" ], "tls": { "san": [ "futurecoreai.click" ], "cipher": "AES_128_GCM", "issuer": "WE1", "subject": "futurecoreai.click", "protocol": "QUIC", "valid_to": "2026-12-04T14:27:50Z", "valid_from": "2026-09-05T13:27:55Z" }, "domain_age_days": 125, "apex_age_days": 125, "tls_age_days": 7, "tls_valid_days": 90, "requests": 17, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 99, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "cloudflare", "content-type": "text/html; charset=utf-8", "strict-transport-security": "max-age=63072000; includeSubDomains; preload", "content-security-policy": "font-src 'self' https://fonts.gstatic.com https://cdnjs.cloudflare.com; frame-ancestors 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://static.cloudflare.com https://cdn.jsdelivr.net;", "x-frame-options": "SAMEORIGIN", "x-content-type-options": "nosniff", "referrer-policy": "strict-origin", "permissions-policy": "camera=(), microphone=(), geolocation=()", "cross-origin-opener-policy": "same-origin" } }, "cf": { "v": 1, "fetched_at": "2026-10-21T02:31:22Z", "uuid": "26760337-6b4b-43e9-8f97-9edc118ad6a7", "scanned_at": "2026-09-12T18:03:54Z", "final_url": "https://futurecoreai.click/", "status": 200, "history": [ { "url": "https://futurecoreai.click/", "status": 200 } ], "dom_hash": "2b8e776d868348f89b8853f8ea6136ec4b5f36def3df1217fa38ea8370aeb240", "doc_hash": "92473a471426e3673a3ea83e7e857a05dfc7239fb3d6754a8ce79a344490ae41", "phishing_v2": [ "phishing" ], "domain_risks": [ "Malware", "Security threats", "CIPA Filter", "CIPA" ], "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "futurecoreai.click", "type": "A", "value": "104.21.87.204" }, { "name": "futurecoreai.click", "type": "A", "value": "172.67.145.243" }, { "name": "futurecoreai.click", "type": "AAAA", "value": "2606:4700:3037::6815:57cc" }, { "name": "futurecoreai.click", "type": "AAAA", "value": "2606:4700:3031::ac43:91f3" } ], "dnssec_valid": false, "ip": "104.21.87.204", "verdict": { "tags": [ "malware" ], "malicious": true, "categories": [ "malware" ] }, "whois": { "registrar": "NETIM SARL", "created": "2026-05-10T11:20:09Z", "updated": "2026-05-15T11:21:49Z", "expires": "2027-05-10T11:20:09Z", "nameservers": [ "noor.ns.cloudflare.com", "chase.ns.cloudflare.com" ] } } } ```