# PhishDestroy domain threat record: gainforthic-uk.live Content language: English Canonical HTML report: https://phishdestroy.io/domain/gainforthic-uk.live/ Machine-readable companion: https://phishdestroy.io/domain/gainforthic-uk.live/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-10-27 19:44:38 UTC - Last availability or vendor check: 2026-10-28 00:31:11 UTC - Stored record updated: 2026-10-28 00:31:11 UTC - VirusTotal detections in the stored snapshot: 16/92 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: no stored flag ## Stored classification - Targeted brand: bnb chain ## Stored infrastructure - Observed IP address: 172.67.199.223 - Registrar in stored WHOIS data: Dynadot Inc - Last stored HTTP status: 200 - Registration date in stored WHOIS data: 2026-10-08 06:27:32 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a17eea-3dbf-73e8-b0e4-602bce2622a0/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/gainforthic-uk.live - Certificate Transparency search: https://crt.sh/?q=%25.gainforthic-uk.live - Web Archive lookup: https://web.archive.org/web/*/https://gainforthic-uk.live/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview PhishDestroy lists gainforthic-uk.live as a suspicious domain based on automated analysis and trusted reporting. The domain was first observed on 2026-10-27, 19 days after registration on 2026-10-08. The recorded HTTP response returned a 200 status on 2026-10-27 via Cloudflare hosting. The page title and description promote a trading platform using AI tools for crypto, forex, and equities, which is consistent with pages used to promote deceptive financial services but does not independently establish fraudulent intent. How the scam works The listing and detections do not establish a specific scam mechanism. Pages that promote AI-powered trading or financial tools can be used to harvest credentials, push malware, or solicit deposits for non-existent services. Visitors should treat any financial interaction or data entry as potentially risky until independently verified. Evidence VirusTotal detected 16 detections from 92 engines on 2026-10-23, including phishing and malicious flags from vendors such as BitDefender, ESET, Fortinet, G-Data, and alphaMountain.ai. Cloudflare Radar flagged the domain as phishing and malware on 2026-10-27. Google Safe Browsing returned no flag on 2026-10-27. PhishDestroy’s internal blocklist includes this domain. OTX recorded 5 pulses on 2026-10-27. urlscan’s engines scored the page as malicious (score 99) while the overall verdict remained clean. Infrastructure The domain is registered with Dynadot Inc and created on 2026-10-08, with a 1-year registration expiring on 2027-10-08. Nameservers are linda.ns.cloudflare.com and weston.ns.cloudflare.com. The recorded IP is 172.67.199.223, hosted by Cloudflare, Inc. in Canada. TLS was issued by Let’s Encrypt on 2026-10-08, valid until 2027-01-06. What to do If you visited this site and entered credentials or downloaded files, change passwords and scan devices. Do not approve wallet connections or deposit funds based on claims seen here. Organizations should block access to this domain and review network logs for related activity. Treat any financial offer as unverified until confirmed through official channels. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a17eea-3dbf-73e8-b0e4-602bce2622a0/ Cloudflare Radar report: https://radar.cloudflare.com/scan/243ff131-e89f-47dd-ad20-eefd28536efc URLQuery report: https://urlquery.net/report/5dab405a-e7c7-47df-b57d-81ab4586db77 Stored capture screenshot: https://i.ibb.co/d4zd8pZw/e5bf3ba2d54b.png Cloudflare Radar screenshot (2026-10-27T19:48:58Z): https://screenshots.phishdestroy.io/cf/243ff131-e89f-47dd-ad20-eefd28536efc.png URLQuery screenshot: https://screenshots.phishdestroy.io/uq/5dab405a-e7c7-47df-b57d-81ab4586db77.png URLScan screenshot (2026-10-08T13:45:25Z): https://screenshots.phishdestroy.io/us/01a11bc2-db70-702a-9a61-0f5d2f916003.png URLScan capture report: https://urlscan.io/result/01a11bc2-db70-702a-9a61-0f5d2f916003/ URLScan screenshot (2026-10-23T08:04:38Z): https://screenshots.phishdestroy.io/us/01a167ca-46cc-772f-90d1-63d2142e8852.png URLScan capture report: https://urlscan.io/result/01a167ca-46cc-772f-90d1-63d2142e8852/ VirusTotal report: https://www.virustotal.com/gui/domain/gainforthic-uk.live Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=gainforthic-uk.live Archived copy: https://web.archive.org/web/20261027194738/https://gainforthic-uk.live/ Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-27 20:50:46 UTC ## Stored page captures - Primary capture: https://i.ibb.co/d4zd8pZw/e5bf3ba2d54b.png Captured: 2026-10-27 19:52:43 UTC - URLScan capture 1: https://screenshots.phishdestroy.io/01a17eea-3dbf-73e8-b0e4-602bce2622a0.png Captured: 2026-10-27 19:52:43 UTC Source report: https://urlscan.io/result/01a17eea-3dbf-73e8-b0e4-602bce2622a0/ - URLScan · 2026-10-23: https://screenshots.phishdestroy.io/us/01a167ca-46cc-772f-90d1-63d2142e8852.png Captured: 2026-10-23 08:04:38 UTC Source report: https://urlscan.io/result/01a167ca-46cc-772f-90d1-63d2142e8852/ SHA-256: 7a8d92d639412c40eeea1c22e075350062bd44984cdd96e2500fa41f26e2ab41 - URLScan · 2026-10-08: https://screenshots.phishdestroy.io/us/01a11bc2-db70-702a-9a61-0f5d2f916003.png Captured: 2026-10-08 13:45:25 UTC Source report: https://urlscan.io/result/01a11bc2-db70-702a-9a61-0f5d2f916003/ SHA-256: 7a8d92d639412c40eeea1c22e075350062bd44984cdd96e2500fa41f26e2ab41 - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/243ff131-e89f-47dd-ad20-eefd28536efc.png Captured: 2026-10-27 19:48:58 UTC Source report: https://radar.cloudflare.com/scan/243ff131-e89f-47dd-ad20-eefd28536efc SHA-256: 3f9e5806708f95fae325d38589521f1d47653f1ba9de8387cb929420b711929b - URLQuery: https://screenshots.phishdestroy.io/uq/5dab405a-e7c7-47df-b57d-81ab4586db77.png Source report: https://urlquery.net/report/5dab405a-e7c7-47df-b57d-81ab4586db77 SHA-256: 1c263c8b4b91f012e6b3856858c897d205d124abcb1cda2c3dabae9ddb0a3aa9 ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-27T19:53:54Z", "uuid": "01a17eea-3dbf-73e8-b0e4-602bce2622a0", "scanned_at": "2026-10-27T19:50:49Z", "final_url": "https://gainforthic-uk.live/", "status": 200, "redirected": "https-only", "redirects": [ { "to": "https://gainforthic-uk.live/", "from": "http://gainforthic-uk.live/", "status": 307 } ], "ip": "172.67.199.223", "domains": [ "cdnedge.io", "cdn.jsdelivr.net", "fonts.gstatic.com", "fonts.googleapis.com" ], "ips": [ "142.251.20.94", "104.21.51.47", "104.16.180.112", "192.178.183.95", "172.67.199.223" ], "asns": [ "15169", "13335" ], "countries": [ "US" ], "doc_hash": "3a6c1e555434ffe98fcf14f194c14a070f67420486d86f36c138dcb3aa7b6274", "script_hashes": [ "6d92d12642b5d9bffd7c332337571df6f2d4c79ac5b7b2e2034e5f2f319eac9d", "ebd93599d10a98e5194c21190195203781e895dda30e80dfe7bebd42008b63f5", "ae133c55f2b77cd96b579e95dcffaa7d33bef1042dd2f1a1e68cd8ec462dd0d2" ], "globals": [ "APP_LANG", "intlTelInput", "getLeadCookieName", "getLeadCookieDays", "hasLeadCookie", "setLeadCookie", "showAlreadyRegistered", "getFieldWrap", "clearFieldError", "setFieldError", "showFormMessage", "hideFormMessage", "validateNativeFields", "validatePhone", "focusInvalidField", "getThanksPageUrl", "integrationBaseUrl", "resolveVisitorPhoneCountry", "syncPhoneCountryHidden", "refreshFormToken", "ensureFormToken", "setupFormValidation", "redirectToForm", "forms", "L", "phoneErrorMap" ], "cookies": [ "PHPSESSID" ], "tls": { "san": [ "*.gainforthic-uk.live", "gainforthic-uk.live" ], "cipher": "AES_128_GCM", "issuer": "YE1", "subject": "gainforthic-uk.live", "protocol": "TLS 1.3", "valid_to": "2027-01-06T07:52:23Z", "valid_from": "2026-10-08T07:52:24Z" }, "domain_age_days": 19, "apex_age_days": 19, "tls_age_days": 19, "tls_valid_days": 89, "requests": 29, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 99, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "cloudflare", "content-type": "text/html; charset=UTF-8" } }, "cf": { "v": 1, "fetched_at": "2026-10-27T19:53:55Z", "uuid": "243ff131-e89f-47dd-ad20-eefd28536efc", "scanned_at": "2026-10-27T19:48:58Z", "final_url": "https://gainforthic-uk.live/", "status": 200, "history": [ { "url": "https://gainforthic-uk.live/", "status": 200 } ], "dom_hash": "e06b1db9d07508dc199d45b11ac59fb22b196c37c53e968c75c38c21eedad3a0", "doc_hash": "7ef9f4a8bee8bbbe661d0a3b4075d90ae17a67d2d05a8aa126b8026d9d7ed5a8", "phishing_v2": [ "phishing" ], "domain_risks": [ "Newly Seen Domains", "Security Risks", "Malware", "Security threats", "New Domains", "CIPA Filter", "CIPA" ], "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "gainforthic-uk.live", "type": "A", "value": "172.67.199.223" }, { "name": "gainforthic-uk.live", "type": "A", "value": "104.21.90.109" }, { "name": "gainforthic-uk.live", "type": "AAAA", "value": "2606:4700:3031::ac43:c7df" }, { "name": "gainforthic-uk.live", "type": "AAAA", "value": "2606:4700:3030::6815:5a6d" } ], "dnssec_valid": false, "ip": "127.0.1.6", "verdict": { "tags": [ "malware" ], "malicious": true, "categories": [ "malware" ] }, "whois": { "registrar": "Dynadot Inc", "created": "2026-10-08T08:27:32Z", "updated": "2026-10-13T08:27:34Z", "expires": "2027-10-08T08:27:32Z", "nameservers": [ "linda.ns.cloudflare.com", "weston.ns.cloudflare.com" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-27T20:48:24Z", "analysis_at": "2026-10-23T14:36:37Z", "stats": { "timeout": 0, "harmless": 43, "malicious": 11, "suspicious": 5, "undetected": 33 }, "detections": { "CRDF": "malicious", "DNS8": "suspicious", "ESET": "suspicious", "VIPRE": "phishing", "G-Data": "phishing", "Lionic": "phishing", "Sophos": "phishing", "Fortinet": "spam", "PREBYTES": "suspicious", "SOCRadar": "phishing", "Kaspersky": "phishing", "Seclookup": "malicious", "Gridinsoft": "suspicious", "BitDefender": "phishing", "alphaMountain.ai": "phishing", "Forcepoint ThreatSeeker": "phishing" }, "reputation": 0, "categories": { "alphaMountain.ai": "Phishing, Newly Registered (alphaMountain.ai)" }, "first_seen": "2026-10-08T13:39:55Z", "dns": [ { "ttl": 300, "type": "A", "value": "104.21.90.109" }, { "ttl": 300, "type": "AAAA", "value": "2606:4700:3030::6815:5a6d" }, { "ttl": 300, "type": "AAAA", "value": "2606:4700:3031::ac43:c7df" }, { "ttl": 300, "type": "A", "value": "172.67.199.223" }, { "ttl": 1800, "type": "SOA", "rname": "dns.cloudflare.com", "value": "linda.ns.cloudflare.com" }, { "ttl": 21600, "type": "NS", "value": "weston.ns.cloudflare.com" }, { "ttl": 21600, "type": "NS", "value": "linda.ns.cloudflare.com" } ], "dns_at": "2026-10-23T14:36:59Z", "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c", "cert": { "san": [ "*.gainforthic-uk.live", "gainforthic-uk.live" ], "issuer": "Let's Encrypt / YE1", "serial": "6a5cdb2717876744c290d2bc3f2b3d1ca46", "sha256": "7e4d0f34b4e54b57d3be1902e8828d457156c909f7b62b4a792611656001bce6", "subject": "gainforthic-uk.live", "valid_to": "2027-01-06T07:52:23Z", "valid_from": "2026-10-08T07:52:24Z" }, "rdap": { "status": [ "transfer prohibited" ], "events": { "expiration": "2027-10-08T08:27:32Z", "last changed": "2026-10-08T08:41:51Z", "registration": "2026-10-08T08:27:32Z", "registrar expiration": "2027-10-08T08:27:32Z", "last update of RDAP database": "2026-10-16T07:46:01Z" }, "registrar": "DYNADOT LLC", "registrar_iana_id": "472" } }, "webcheck": { "v": 1, "fetched_at": "2026-10-27T19:54:13Z", "mail_config": { "spf_lookups": 0 }, "caa_records": { "domain": "gainforthic-uk.live" }, "block_lists": { "resolvers": 12, "blocked_by": [ "CloudFlare Family" ], "blocked_count": 1 }, "robots_txt": { "agents": [ "*" ], "present": true, "sitemaps": [ "https://gainforthic-uk.live/sitemap.xml" ] }, "sitemap": { "present": true, "url_count": 8 }, "social_tags": { "ogUrl": "https://gainforthic-uk.live/", "title": "Gainforthic | Premium AI Trading Engine for Global Markets", "ogType": "website", "robots": "index, follow, max-image-preview:large", "ogImage": "https://gainforthic-uk.live/static/img/platform/gainforthic-trading-platform-mobile.png", "ogTitle": "Gainforthic | Premium AI Trading Engine for Global Markets", "ogSiteName": "Gainforthic", "description": "Gainforthic — a smarter, cleaner way to access global markets with structured AI tools for crypto, forex, and equities.", "twitterCard": "summary_large_image", "canonicalUrl": "https://gainforthic-uk.live/", "ogDescription": "Gainforthic — a smarter, cleaner way to access global markets with structured AI tools for crypto, forex, and equities." }, "trackers": { "requests": 26, "trackers": [ { "name": "Google Fonts", "company": "Google", "country": "US", "category": "Hosting", "requests": 1 }, { "name": "Google Static", "company": "Google", "country": "US", "category": "Hosting", "requests": 1 }, { "name": "jsDelivr", "company": "jsDelivr", "category": "Hosting", "requests": 4 } ] }, "mixed_content": { "no_sri": [ "https://cdnedge.io/js/52a7547b0e1466a40f73a64d75b9ece0/app.min.js", "https://cdn.jsdelivr.net/npm/intl-tel-input@23.0.12/build/js/intlTelInput.min.js" ], "third_party_scripts": 2 }, "status": { "up": true, "code": 200, "timings": { "dns": 11, "tls": 57, "wait": 111, "connect": 7, "download": 36 }, "response_ms": 222 }, "tls_connection": { "alpn": "h2", "cipher": "TLS_AES_256_GCM_SHA384", "protocol": "TLSv1.3", "versions": [ "TLSv1", "TLSv1.1", "TLSv1.2", "TLSv1.3" ], "authorized": true, "forward_secrecy": true }, "ports": { "open": [ 80, 443, 8080 ] }, "carbon": { "bytes": 70796, "co2_grams": 0.0026, "cleaner_than": 29 }, "dns_server": { "ns": [ { "ip": "173.245.58.250", "host": "linda.ns.cloudflare.com" }, { "ip": "162.159.44.138", "host": "weston.ns.cloudflare.com" } ], "zone": "gainforthic-uk.live" }, "cookies": { "cookies": [ { "name": "PHPSESSID", "session": true } ] }, "location": { "ip": "2606:4700:3030::6815:5a6d", "asn": "13335", "org": "Cloudflare, Inc.", "city": "Toronto", "country": "CA" }, "ssl": { "issuer": "Let's Encrypt / YE1", "subject": "gainforthic-uk.live" }, "dns": { "A": [ "172.67.199.223", "104.21.90.109" ], "NS": [ "linda.ns.cloudflare.com", "weston.ns.cloudflare.com" ], "SOA": "{\"nsname\": \"linda.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2416935187, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}", "AAAA": [ "2606:4700:3030::6815:5a6d", "2606:4700:3031::ac43:c7df" ] }, "dnssec": { "ds": false, "rrsig": false, "dnskey": false }, "hsts": { "message": "Site does not serve any HSTS headers." }, "http_security": { "xFrameOptions": false, "referrerPolicy": false, "xXSSProtection": false, "permissionsPolicy": false, "xContentTypeOptions": false, "contentSecurityPolicy": false, "strictTransportPolicy": false, "crossOriginOpenerPolicy": false, "crossOriginEmbedderPolicy": false, "crossOriginResourcePolicy": false }, "firewall": { "waf": "Cloudflare", "has_waf": true }, "get_ip": { "ip": "2606:4700:3030::6815:5a6d", "family": 6 }, "redirects": { "chain": [ "https://gainforthic-uk.live" ] }, "tech_stack": { "technologies": [ "PHP", "PayPal", "jsDelivr", "Google Font API", "Cloudflare", "Open Graph", "HTTP/3" ] }, "linked_pages": { "internal_count": 15 }, "headers": { "headers": { "server": "cloudflare", "content-type": "text/html; charset=UTF-8" } } } } ```