# PhishDestroy domain threat record: gainorcapestre.click

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/gainorcapestre.click/
Machine-readable companion: https://phishdestroy.io/domain/gainorcapestre.click/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-27 19:44:44 UTC
- Last availability or vendor check: 2026-10-27 23:00:26 UTC
- Stored record updated: 2026-10-27 23:30:59 UTC
- VirusTotal detections in the stored snapshot: 16/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored infrastructure

- Observed IP address: 188.114.96.1
- Registrar in stored WHOIS data: NETIM SARL
- Last stored HTTP status: 200
- Registration date in stored WHOIS data: 2026-05-31 09:40:04 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/019f931b-c285-70fe-8daf-3df5acdadf63/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/gainorcapestre.click
- Certificate Transparency search: https://crt.sh/?q=%25.gainorcapestre.click
- Web Archive lookup: https://web.archive.org/web/*/https://gainorcapestre.click/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
PhishDestroy listed gainorcapestre.click as a suspicious domain based on automated risk scoring. A recorded page title read “Gainor Capestre | a premium AI trading | Official Website”. The domain was first seen by PhishDestroy on 2026-10-27 and the intake record notes a trusted report because the domain was 149 days old at that time.

How the scam works
The listing reflects a generic phishing risk where sites imitate legitimate‑sounding services to lure visitors into providing credentials or personal data. No specific malicious behavior was observed on the page, and the assessment does not confirm a particular fraud mechanism beyond the phishing category.

Evidence
VirusTotal scanned the domain on 2026-10-23 and returned 16 detections from 92 engines, including 13 malicious and 3 suspicious labels from vendors such as BitDefender, ESET and Fortinet. Google Safe Browsing checked on 2026-10-27 and reported no flag. urlscan.io captured the site on 2026-07-24; its engine analysis gave a malicious score of 99 while the overall verdict was non‑malicious. Cloudflare Radar on 2026-10-27 flagged the domain for phishing and malware. OTX listed three pulses referencing the domain. PhishDestroy’s internal blocklist marks it as blocked, and external blocklists showed zero matches on the check date.

Infrastructure
The domain was registered with NETIM SARL on 2026-05-31. Hosting is provided through Cloudflare, with recorded IPv4 addresses 188.114.96.1 and 188.114.97.3 and IPv6 addresses belonging to Cloudflare’s European network. TLS was issued by Google Trust Services on 2026-05-31 and was valid for 90 days. The site employed Cloudflare’s WAF and HSTS preload configuration.

What to do
Visitors should avoid entering any credentials, personal data, or financial information on the site; if such data was submitted, change associated passwords immediately and monitor accounts for unauthorized activity. Defenders should block gainorcapestre.click at the network perimeter, review web proxy logs for requests to the domain, and note that mitigation may need to account for Cloudflare’s WAF in place.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/019f931b-c285-70fe-8daf-3df5acdadf63/
Cloudflare Radar report: https://radar.cloudflare.com/scan/a07ddf83-d567-4949-a979-be438fb93208
Stored capture screenshot: https://urlscan.io/screenshots/019f931b-c285-70fe-8daf-3df5acdadf63.png
Cloudflare Radar screenshot (2026-10-27T19:48:48Z): https://screenshots.phishdestroy.io/cf/a07ddf83-d567-4949-a979-be438fb93208.png
URLScan screenshot (2026-07-23T12:00:25Z): https://screenshots.phishdestroy.io/us/019f8ed9-1364-747b-ab51-c420b1741ac6.png
URLScan capture report: https://urlscan.io/result/019f8ed9-1364-747b-ab51-c420b1741ac6/
URLScan screenshot (2026-07-24T02:04:29Z): https://screenshots.phishdestroy.io/us/019f91dd-d0d9-73ce-9fa1-bae2173ff1b1.png
URLScan capture report: https://urlscan.io/result/019f91dd-d0d9-73ce-9fa1-bae2173ff1b1/
URLScan screenshot (2026-10-27T19:51:35Z): https://screenshots.phishdestroy.io/us/01a17eea-e107-70eb-96a7-8942108bba1a.png
URLScan capture report: https://urlscan.io/result/01a17eea-e107-70eb-96a7-8942108bba1a/
VirusTotal report: https://www.virustotal.com/gui/domain/gainorcapestre.click
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=gainorcapestre.click
Archived copy: https://web.archive.org/web/20261027194901/https://gainorcapestre.click/
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-27 20:21:33 UTC

## Stored page captures

- Primary capture: https://urlscan.io/screenshots/019f931b-c285-70fe-8daf-3df5acdadf63.png
  Captured: 2026-10-27 19:44:44 UTC
- URLScan capture 1: https://screenshots.phishdestroy.io/019f931b-c285-70fe-8daf-3df5acdadf63.png
  Source report: https://urlscan.io/result/019f931b-c285-70fe-8daf-3df5acdadf63/
- URLScan · 2026-07-23: https://screenshots.phishdestroy.io/us/019f8ed9-1364-747b-ab51-c420b1741ac6.png
  Captured: 2026-07-23 12:00:25 UTC
  Source report: https://urlscan.io/result/019f8ed9-1364-747b-ab51-c420b1741ac6/
  SHA-256: 59b722b1e92e0b97f627a14982b0ed16864651f21d12debc2872436435cb7ce3
- URLScan · 2026-07-24: https://screenshots.phishdestroy.io/us/019f91dd-d0d9-73ce-9fa1-bae2173ff1b1.png
  Captured: 2026-07-24 02:04:29 UTC
  Source report: https://urlscan.io/result/019f91dd-d0d9-73ce-9fa1-bae2173ff1b1/
  SHA-256: 5f1e59c613dd09fbc61d774dfe570d3b2ceadd07fb3bde56fa47389025382995
- URLScan · 2026-10-27: https://screenshots.phishdestroy.io/us/01a17eea-e107-70eb-96a7-8942108bba1a.png
  Captured: 2026-10-27 19:51:35 UTC
  Source report: https://urlscan.io/result/01a17eea-e107-70eb-96a7-8942108bba1a/
  SHA-256: 1823e093ff6ee77e6c8c2f6d49667986958a90d4670a36bacd7f16d488d9b784
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/a07ddf83-d567-4949-a979-be438fb93208.png
  Captured: 2026-10-27 19:48:48 UTC
  Source report: https://radar.cloudflare.com/scan/a07ddf83-d567-4949-a979-be438fb93208
  SHA-256: fd6110cc0950e3bdb1894910fe547d356d25b2ed1dec33121229f295644781c3

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-27T19:53:28Z",
        "uuid": "019f931b-c285-70fe-8daf-3df5acdadf63",
        "scanned_at": "2026-07-24T07:51:44Z",
        "final_url": "https://gainorcapestre.click/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://gainorcapestre.click/",
                "from": "http://gainorcapestre.click/",
                "status": 307
            }
        ],
        "ip": "188.114.97.3",
        "domains": [
            "cdnjs.cloudflare.com",
            "cdn.jsdelivr.net",
            "fonts.googleapis.com",
            "static.cloudflare.com"
        ],
        "ips": [
            "104.17.207.5",
            "172.217.208.95",
            "104.17.25.14",
            "188.114.97.3"
        ],
        "asns": [
            "13335",
            "15169"
        ],
        "countries": [
            "US"
        ],
        "doc_hash": "44537fd819f8afebc15a08f59930bd8f722b8162ae08b175a51cc0f7042d43d9",
        "script_hashes": [
            "ccf00d1923b0131a10e0c6d26f95e5dee6ebf8621a27e83c5a2f68a2e0093142"
        ],
        "globals": [
            "LANG_MSGS",
            "ClientJS",
            "_g0x99bcy",
            "toggleTermsPopup",
            "__cfQR",
            "__cfRLUnblockHandlers",
            "__lgT0"
        ],
        "cookies": [
            "entry_url"
        ],
        "tls": {
            "san": [
                "gainorcapestre.click"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "WE1",
            "subject": "gainorcapestre.click",
            "protocol": "TLS 1.3",
            "valid_to": "2026-08-29T14:00:26Z",
            "valid_from": "2026-05-31T13:01:24Z"
        },
        "domain_age_days": 53,
        "apex_age_days": 53,
        "tls_age_days": 53,
        "tls_valid_days": 90,
        "requests": 18,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 99,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "cloudflare",
            "content-type": "text/html; charset=utf-8",
            "strict-transport-security": "max-age=15552000; includeSubDomains; preload",
            "content-security-policy": "frame-ancestors 'self'; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://cdnjs.cloudflare.com; default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://static.c",
            "x-frame-options": "SAMEORIGIN",
            "x-content-type-options": "nosniff",
            "referrer-policy": "strict-origin-when-cross-origin",
            "permissions-policy": "camera=(), microphone=(), geolocation=()",
            "cross-origin-opener-policy": "same-origin"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-27T19:53:30Z",
        "uuid": "a07ddf83-d567-4949-a979-be438fb93208",
        "scanned_at": "2026-10-27T19:48:48Z",
        "final_url": "https://gainorcapestre.click/",
        "status": 200,
        "history": [
            {
                "url": "https://gainorcapestre.click/",
                "status": 200
            }
        ],
        "dom_hash": "11cd5f7311f590c4ae60319c1e7af449ae2bd380c73dc17da3e1a20984c89019",
        "doc_hash": "2a107e287c728a77c9b37970283f1ae2119c3f57e3ee082b46c40194360369a2",
        "phishing_v2": [
            "phishing"
        ],
        "domain_risks": [
            "Malware",
            "Security threats",
            "CIPA Filter",
            "CIPA"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "gainorcapestre.click",
                "type": "A",
                "value": "104.21.67.142"
            },
            {
                "name": "gainorcapestre.click",
                "type": "A",
                "value": "172.67.177.59"
            },
            {
                "name": "gainorcapestre.click",
                "type": "AAAA",
                "value": "2606:4700:3030::6815:438e"
            },
            {
                "name": "gainorcapestre.click",
                "type": "AAAA",
                "value": "2606:4700:3032::ac43:b13b"
            }
        ],
        "dnssec_valid": false,
        "ip": "127.0.1.5",
        "verdict": {
            "tags": [
                "malware"
            ],
            "malicious": true,
            "categories": [
                "malware"
            ]
        },
        "whois": {
            "registrar": "NETIM SARL",
            "created": "2026-05-31T11:40:04Z",
            "updated": "2026-06-05T11:40:11Z",
            "expires": "2027-05-31T11:40:04Z",
            "nameservers": [
                "sierra.ns.cloudflare.com",
                "porter.ns.cloudflare.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-27T20:18:13Z",
        "analysis_at": "2026-10-23T14:08:40Z",
        "stats": {
            "timeout": 0,
            "harmless": 44,
            "malicious": 13,
            "suspicious": 3,
            "undetected": 32
        },
        "detections": {
            "CRDF": "malicious",
            "DNS8": "suspicious",
            "ESET": "suspicious",
            "VIPRE": "phishing",
            "G-Data": "malware",
            "Lionic": "phishing",
            "Sophos": "phishing",
            "CyRadar": "phishing",
            "Fortinet": "phishing",
            "SOCRadar": "phishing",
            "Kaspersky": "phishing",
            "Seclookup": "malicious",
            "Gridinsoft": "suspicious",
            "BitDefender": "phishing",
            "alphaMountain.ai": "phishing",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "categories": {
            "alphaMountain.ai": "Phishing (alphaMountain.ai)"
        },
        "registrar": "NETIM",
        "created": "2026-05-31T11:40:04Z",
        "expires": "2027-05-31T11:40:04Z",
        "updated": "2026-06-05T11:40:11Z",
        "first_seen": "2026-05-31T14:25:12Z",
        "dns": [
            {
                "ttl": 1800,
                "type": "SOA",
                "rname": "dns.cloudflare.com",
                "value": "porter.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "104.21.67.142"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3030::6815:438e"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3032::ac43:b13b"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "172.67.177.59"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "porter.ns.cloudflare.com"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "sierra.ns.cloudflare.com"
            }
        ],
        "dns_at": "2026-10-23T14:14:13Z",
        "jarm": "27d40d40d00040d00042d43d00041df04c41293ba84f6efe3a613b22f983e6",
        "cert": {
            "san": [
                "gainorcapestre.click"
            ],
            "issuer": "Google Trust Services / WE1",
            "serial": "91efe0826efc91f10eadbea3a404a3f9",
            "sha256": "159a84e7f82e0bcc6931d9c81c0226dc3e053ab0d28ab7122111df9517cdc6a3",
            "subject": "gainorcapestre.click",
            "valid_to": "2026-12-25T12:34:20Z",
            "valid_from": "2026-09-26T11:34:24Z"
        },
        "whois": {
            "registrar": "NETIM",
            "registrar_iana_id": "1519",
            "registrar_url": "https://www.netim.com",
            "created": "2026-05-31T00:00:00Z",
            "updated": "2026-05-31T13:40:01Z",
            "expires": "2027-05-31T21:00:00Z",
            "status": [
                "clientTransferProhibited",
                "ok"
            ],
            "nameservers": [
                "porter.ns.cloudflare.com",
                "sierra.ns.cloudflare.com"
            ],
            "dnssec": "unsigned"
        },
        "rdap": {
            "status": [
                "active",
                "client transfer prohibited"
            ],
            "events": {
                "expiration": "2027-05-31T21:00:00Z",
                "last changed": "2026-05-31T13:40:01Z",
                "registration": "2026-05-31T00:00:00Z",
                "registrar expiration": "2027-05-31T21:00:00Z",
                "last update of RDAP database": "2026-10-22T16:11:46Z"
            }
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-27T19:53:45Z",
        "mail_config": {
            "spf_lookups": 0
        },
        "caa_records": {
            "domain": "gainorcapestre.click"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_by": [
                "CloudFlare Family"
            ],
            "blocked_count": 1
        },
        "archives": {
            "last": "2026-10-27T19:49:01Z",
            "first": "2026-10-27T19:49:01Z",
            "changes": 0,
            "days_archived": 1,
            "avg_page_bytes": 42967
        },
        "robots_txt": {
            "agents": [
                "*"
            ],
            "present": true,
            "sitemaps": [
                "https://gainorcapestre.click/sitemap.xml"
            ]
        },
        "sitemap": {
            "present": true,
            "url_count": 140
        },
        "social_tags": {
            "ogUrl": "https://gainorcapestre.click/",
            "title": "Gainor Capestre | a premium AI trading | Official Website",
            "ogType": "website",
            "robots": "index, follow",
            "ogTitle": "Gainor Capestre | Luxury-grade AI trading workflow view",
            "ogSiteName": "Gainor Capestre",
            "themeColor": "#000000",
            "description": "Gainor Capestre presents a premium trading workflow view with AI-powered trading assistance, automated trading bots, execution controls, and risk-focused...",
            "twitterCard": "summary",
            "canonicalUrl": "https://gainorcapestre.click/",
            "ogDescription": "Gainor Capestre presents a premium trading workflow view with AI-powered trading assistance, automated trading bots, execution controls, and risk-focused configuration for active market participants."
        },
        "trackers": {
            "requests": 18,
            "trackers": [
                {
                    "name": "Cloudflare",
                    "company": "Cloudflare",
                    "country": "US",
                    "category": "Hosting",
                    "requests": 8
                },
                {
                    "name": "Google Fonts",
                    "company": "Google",
                    "country": "US",
                    "category": "Hosting",
                    "requests": 1
                },
                {
                    "name": "jsDelivr",
                    "company": "jsDelivr",
                    "category": "Hosting",
                    "requests": 1
                }
            ]
        },
        "mixed_content": {
            "no_sri": [
                "https://static.cloudflare.com/beacon.min.js",
                "https://challenges.cloudflare.com/turnstile/v0/api.js",
                "https://cdn.jsdelivr.net/npm/clientjs@0.2.1/dist/client.min.js"
            ],
            "third_party_scripts": 3
        },
        "status": {
            "up": true,
            "code": 200,
            "timings": {
                "dns": 6,
                "tls": 27,
                "wait": 124,
                "connect": 6,
                "download": 31
            },
            "response_ms": 194
        },
        "tls_connection": {
            "alpn": "h2",
            "cipher": "TLS_AES_256_GCM_SHA384",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                80,
                443,
                8080
            ]
        },
        "carbon": {
            "bytes": 152312,
            "co2_grams": 0.0056,
            "cleaner_than": 13
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "162.159.38.245",
                    "host": "sierra.ns.cloudflare.com"
                },
                {
                    "ip": "172.64.35.243",
                    "host": "porter.ns.cloudflare.com"
                }
            ],
            "zone": "gainorcapestre.click"
        },
        "cookies": {
            "cookies": [
                {
                    "name": "entry_url",
                    "secure": true,
                    "same_site": "Lax"
                }
            ]
        },
        "location": {
            "ip": "2a06:98c1:3120::3",
            "asn": "13335",
            "org": "CloudFLARENET-EU",
            "city": "London",
            "country": "GB"
        },
        "ssl": {
            "issuer": "Google Trust Services / WE1",
            "subject": "gainorcapestre.click"
        },
        "dns": {
            "A": [
                "188.114.97.3",
                "188.114.96.3"
            ],
            "NS": [
                "sierra.ns.cloudflare.com",
                "porter.ns.cloudflare.com"
            ],
            "SOA": "{\"nsname\": \"porter.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2418085294, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}",
            "AAAA": [
                "2a06:98c1:3120::3",
                "2a06:98c1:3121::3"
            ]
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "hsts": {
            "header": "max-age=31536000; includeSubDomains; preload",
            "message": "Site is compatible with the HSTS preload list!",
            "compatible": true
        },
        "http_security": {
            "xFrameOptions": "SAMEORIGIN",
            "referrerPolicy": "strict-origin",
            "xXSSProtection": false,
            "permissionsPolicy": "camera=(), microphone=(), geolocation=()",
            "xContentTypeOptions": "nosniff",
            "contentSecurityPolicy": "frame-src https://challenges.cloudflare.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://static.cloudflare.c",
            "strictTransportPolicy": "max-age=31536000; includeSubDomains; preload",
            "crossOriginOpenerPolicy": "same-origin",
            "crossOriginEmbedderPolicy": false,
            "crossOriginResourcePolicy": false
        },
        "firewall": {
            "waf": "Cloudflare",
            "has_waf": true
        },
        "get_ip": {
            "ip": "2a06:98c1:3120::3",
            "family": 6
        },
        "redirects": {
            "chain": [
                "https://gainorcapestre.click"
            ]
        },
        "tech_stack": {
            "technologies": [
                "jsDelivr",
                "Cloudflare Turnstile",
                "Cloudflare Rocket Loader",
                "ClientJS",
                "Priority Hints",
                "Google Font API",
                "Font Awesome",
                "cdnjs",
                "HSTS",
                "Cloudflare",
                "Open Graph",
                "HTTP/3"
            ]
        },
        "linked_pages": {
            "internal_count": 15
        },
        "whois": {
            "registrar": "NETIM SARL",
            "created": "2026-05-31T11:40:04Z",
            "updated": "2026-06-05T11:40:11Z",
            "expires": "2027-05-31T11:40:04Z",
            "status": [
                "clientTransferProhibited https://icann.org/epp"
            ],
            "nameservers": [
                "sierra.ns.cloudflare.com",
                "porter.ns.cloudflare.com"
            ]
        },
        "headers": {
            "headers": {
                "server": "cloudflare",
                "content-type": "text/html; charset=utf-8",
                "strict-transport-security": "max-age=31536000; includeSubDomains; preload",
                "content-security-policy": "frame-src https://challenges.cloudflare.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://static.cloudflare.com https://cdn.jsdelivr.net https://challenges.cloudflare.com; font-src 'self' https://fonts.gstatic.com https://cdnjs.cloudflare.com; default-src 'self'; style-src 'self' 'unsafe-",
                "x-frame-options": "SAMEORIGIN",
                "x-content-type-options": "nosniff",
                "referrer-policy": "strict-origin",
                "permissions-policy": "camera=(), microphone=(), geolocation=()",
                "cross-origin-opener-policy": "same-origin"
            }
        }
    }
}
```