# PhishDestroy domain threat record: galviorensoft.com Content language: English Canonical HTML report: https://phishdestroy.io/domain/galviorensoft.com/ Machine-readable companion: https://phishdestroy.io/domain/galviorensoft.com/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-10-27 19:45:01 UTC - Last availability or vendor check: 2026-10-27 23:00:26 UTC - Stored record updated: 2026-10-27 23:30:59 UTC - VirusTotal detections in the stored snapshot: 16/92 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: no stored flag ## Stored infrastructure - Observed IP address: 172.67.153.253 - Registrar in stored WHOIS data: MainReg Inc. - Last stored HTTP status: 200 - Registration date in stored WHOIS data: 2025-11-17 06:21:02 UTC ## Evidence links - URLScan report: https://urlscan.io/result/019ec024-a601-740d-85e9-8b70d7ec4268/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/galviorensoft.com - Certificate Transparency search: https://crt.sh/?q=%25.galviorensoft.com - Web Archive lookup: https://web.archive.org/web/*/https://galviorensoft.com/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview PhishDestroy added galviorensoft.com to its internal blocklist on 2026-10-27 after a trusted report flagged the domain as risky. The recorded page title reads “Galvioren | AI Trading Platform | Official Website”. The site responded with HTTP 200 on the same date, confirming it was reachable at that time. How the scam works The detections suggest the domain may be used for phishing or malware distribution, but no specific credential‑stealing form, wallet request, or malicious payload was observed on the captured page. In general, sites that masquerade as financial or AI‑driven services can lure users into revealing login details or downloading harmful files. Evidence VirusTotal scanned the domain on 2026-10-25 and reported 16 detections across 92 engines, with 15 labeled malicious and one suspicious by vendors such as ESET, BitDefender and ADMINUSLabs. Google Safe Browsing checked on 2026-10-27 and did not flag the URL, while Cloudflare Radar on the same day marked the domain as malicious under the malware category. Urlscan.io captured the site on 2026-06-13, where its machine‑learning engine assigned a malicious score of 100, though the overall verdict was clean, and OTX listed one pulse referencing the domain. Infrastructure The domain was registered with MainReg Inc. on 2025-11-17, giving it an age of 344 days at first sighting. Hosting is provided through Cloudflare, with recorded IP addresses 172.67.153.253 and 104.21.90.78 among others, and the TLS certificate issued by Google Trust Services is valid until 2027-01-10. No DNSSEC records were present, and the domain uses Cloudflare’s nameservers alice.ns.cloudflare.com and ed.ns.cloudflare.com. What to do Visitors should avoid entering any credentials or downloading files from galviorensoft.com and, if they have already submitted sensitive information, change associated passwords and monitor accounts for unusual activity. Organizations can block the domain at the firewall or proxy level and review logs for connections to the recorded IP addresses. Security teams should treat the site as potentially malicious and apply standard phishing‑mitigation controls when encountering similar AI‑trading or finance‑themed pages. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/019ec024-a601-740d-85e9-8b70d7ec4268/ Cloudflare Radar report: https://radar.cloudflare.com/scan/4f776b30-57be-424e-8eee-b198a679411f Stored capture screenshot: https://urlscan.io/screenshots/019ec024-a601-740d-85e9-8b70d7ec4268.png Cloudflare Radar screenshot (2026-10-27T19:48:32Z): https://screenshots.phishdestroy.io/cf/4f776b30-57be-424e-8eee-b198a679411f.png URLScan screenshot (2025-11-17T12:45:21Z): https://screenshots.phishdestroy.io/us/019a91d9-1688-76d2-b488-e366f26d6a12.png URLScan capture report: https://urlscan.io/result/019a91d9-1688-76d2-b488-e366f26d6a12/ URLScan screenshot (2025-11-18T05:39:58Z): https://screenshots.phishdestroy.io/us/019a9579-fcf4-7008-8d99-498a9045d9b8.png URLScan capture report: https://urlscan.io/result/019a9579-fcf4-7008-8d99-498a9045d9b8/ VirusTotal report: https://www.virustotal.com/gui/domain/galviorensoft.com Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=galviorensoft.com Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-27 19:52:32 UTC ## Stored page captures - Primary capture: https://urlscan.io/screenshots/019ec024-a601-740d-85e9-8b70d7ec4268.png Captured: 2026-10-27 19:45:01 UTC - URLScan capture 1: https://screenshots.phishdestroy.io/019ec024-a601-740d-85e9-8b70d7ec4268.png Source report: https://urlscan.io/result/019ec024-a601-740d-85e9-8b70d7ec4268/ - URLScan · 2025-11-17: https://screenshots.phishdestroy.io/us/019a91d9-1688-76d2-b488-e366f26d6a12.png Captured: 2025-11-17 12:45:21 UTC Source report: https://urlscan.io/result/019a91d9-1688-76d2-b488-e366f26d6a12/ SHA-256: 3c0e316a8bb7310bf39c7c84ff702cc8a43a5b835783722194ffef0bac91670d - URLScan · 2025-11-18: https://screenshots.phishdestroy.io/us/019a9579-fcf4-7008-8d99-498a9045d9b8.png Captured: 2025-11-18 05:39:58 UTC Source report: https://urlscan.io/result/019a9579-fcf4-7008-8d99-498a9045d9b8/ SHA-256: 67e3b4c1441ee137e018a3d8cc37f6557702c105ceaf457558be7eb8ba51d6af - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/4f776b30-57be-424e-8eee-b198a679411f.png Captured: 2026-10-27 19:48:32 UTC Source report: https://radar.cloudflare.com/scan/4f776b30-57be-424e-8eee-b198a679411f SHA-256: 63b74d10791b9ab22b951e08ff08ca7bfddec306b2e67d400724648e5d83ebd6 ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-27T19:52:00Z", "uuid": "019ec024-a601-740d-85e9-8b70d7ec4268", "scanned_at": "2026-06-13T08:41:36Z", "final_url": "https://galviorensoft.com/", "status": 200, "redirected": "https-only", "redirects": [ { "to": "https://galviorensoft.com/", "from": "http://galviorensoft.com/", "status": 307 } ], "ip": "185.62.58.101", "ptr": "mysupervps.exmaple.com", "domains": [ "storage-hub.forza-analytics.com", "fonts.gstatic.com", "cdnjs.cloudflare.com", "fonts.googleapis.com", "ajax.googleapis.com", "d3e54v103j8qbb.cloudfront.net" ], "ips": [ "172.67.173.47", "142.251.13.94", "104.17.24.14", "142.251.14.95", "142.251.20.95", "13.226.247.220", "185.62.58.101" ], "asns": [ "13335", "15169", "16509", "62370" ], "countries": [ "US", "NL" ], "doc_hash": "fc96919bb6f46c4832185a2508766dc7a4f17aa5765e00033f1fca8f6329a065", "script_hashes": [ "e6ee7efda89d3aac8247ba7c199b1e5f78870e4fbaf330bc109e1eefb04155d1", "65baaf73001c13bbb1ae1934c4267e35f27855d25a0f2d2ac3dd20f0df6d66ba", "653a448c69253dc5b67cdf5fd1a1982f30ae00e1c81e22c2e301f7fd66e64e95", "1deefa5b2000fbfb6f55c26810a9c81f35969237a8b8c4cedbb5ccae42b7f8fd" ], "globals": [ "funnel", "$", "jQuery", "tram", "Webflow", "setFlagIcon", "setCountryName", "WebFont", "disclaimer", "startTimer", "Handlebars", "Swal", "Trackier", "ClientJS", "intlTelInputGlobals", "apiPath", "script", "styles" ], "cookies": [ "advanced-staticbridge-wf-glvrnsft-com", "funnel-info-wf-glvrnsft-com" ], "tls": { "san": [ "galviorensoft.com" ], "cipher": "AES_256_GCM", "issuer": "E8", "subject": "galviorensoft.com", "protocol": "TLS 1.3", "valid_to": "2026-08-15T01:16:59Z", "valid_from": "2026-05-17T01:17:00Z" }, "domain_age_days": 208, "apex_age_days": 208, "tls_age_days": 27, "tls_valid_days": 89, "requests": 37, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 100, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "nginx/1.14.1", "content-type": "text/html" } }, "cf": { "v": 1, "fetched_at": "2026-10-27T19:52:02Z", "uuid": "4f776b30-57be-424e-8eee-b198a679411f", "scanned_at": "2026-10-27T19:48:32Z", "final_url": "https://galviorensoft.com/", "status": 200, "history": [ { "url": "https://galviorensoft.com/", "status": 200 } ], "dom_hash": "ab41aa258b5a5111e3554940a6fbe1fb74845b1fc566c7bd524e15274bd7e1da", "doc_hash": "685b527db66cf30da8feac53252187daad8f03dbf00d1d5aa9309cfbd5fde7d8", "phishing_v2": [ "phishing" ], "domain_risks": [ "Malware", "Security threats", "CIPA Filter", "CIPA" ], "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "galviorensoft.com", "type": "A", "value": "172.67.153.253" }, { "name": "galviorensoft.com", "type": "A", "value": "104.21.90.78" }, { "name": "galviorensoft.com", "type": "AAAA", "value": "2606:4700:3032::6815:5a4e" }, { "name": "galviorensoft.com", "type": "AAAA", "value": "2606:4700:3034::ac43:99fd" } ], "dnssec_valid": false, "ip": "127.0.1.6", "verdict": { "tags": [ "malware" ], "malicious": true, "categories": [ "malware" ] }, "whois": { "registrar": "MainReg Inc.", "created": "2025-11-17T07:21:02Z", "updated": "2026-02-05T09:40:09Z", "expires": "2026-11-17T07:21:02Z", "nameservers": [ "alice.ns.cloudflare.com", "ed.ns.cloudflare.com" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-27T19:47:29Z", "analysis_at": "2026-10-25T10:21:18Z", "stats": { "timeout": 0, "harmless": 44, "malicious": 15, "suspicious": 1, "undetected": 32 }, "detections": { "ESET": "phishing", "VIPRE": "malware", "G-Data": "phishing", "Lionic": "phishing", "Sophos": "phishing", "Webroot": "malicious", "Emsisoft": "malware", "SOCRadar": "phishing", "Kaspersky": "phishing", "Seclookup": "malicious", "Gridinsoft": "suspicious", "ADMINUSLabs": "malicious", "BitDefender": "phishing", "Chong Lua Dao": "malicious", "alphaMountain.ai": "phishing", "Forcepoint ThreatSeeker": "phishing" }, "reputation": 0, "created": "2025-11-17T00:00:00Z", "updated": "2025-11-17T00:00:00Z", "first_seen": "2025-11-17T08:33:32Z", "dns": [ { "ttl": 300, "type": "MX", "value": "mail.galviorensoft.com", "priority": 10 }, { "ttl": 300, "type": "A", "value": "104.21.90.78" }, { "ttl": 300, "type": "AAAA", "value": "2606:4700:3032::6815:5a4e" }, { "ttl": 300, "type": "TXT", "value": "google-site-verification=wJntnT1kLYzdkHHcupjs2wAEdcyRT-5lDAc4rX9tErA" }, { "ttl": 300, "type": "AAAA", "value": "2606:4700:3034::ac43:99fd" }, { "ttl": 300, "type": "TXT", "value": "v=spf1 ip4:46.166.131.92 ~all" }, { "ttl": 21600, "type": "NS", "value": "ed.ns.cloudflare.com" }, { "ttl": 1800, "type": "SOA", "rname": "dns.cloudflare.com", "value": "alice.ns.cloudflare.com" }, { "ttl": 300, "type": "A", "value": "172.67.153.253" }, { "ttl": 21600, "type": "NS", "value": "alice.ns.cloudflare.com" } ], "dns_at": "2026-10-25T10:26:49Z", "jarm": "27d40d40d00040d00042d43d00041df04c41293ba84f6efe3a613b22f983e6", "cert": { "san": [ "galviorensoft.com" ], "issuer": "Google Trust Services / WE1", "serial": "f3b94b747f8b2110e94bad87fe07fb7", "sha256": "d981ab17a95e27e8ba943c751456decd577c26df16645110efd06b67639d5eff", "subject": "galviorensoft.com", "valid_to": "2027-01-10T09:28:34Z", "valid_from": "2026-10-12T08:28:38Z" }, "whois": [], "rdap": { "status": [ "active" ], "events": { "last changed": "2026-02-05T00:00:00Z", "registration": "2025-11-17T00:00:00Z", "registrar expiration": "2026-11-17T00:00:00Z", "last update of RDAP database": "2026-10-25T10:26:00Z" }, "registrar": "MainReg Inc.", "registrar_iana_id": "1917" } }, "webcheck": { "v": 1, "fetched_at": "2026-10-27T19:52:18Z", "mail_config": { "mx": [ "mail.galviorensoft.com" ], "spf": "v=spf1 ip4:46.166.131.92 ~all", "spf_lookups": 0 }, "caa_records": { "domain": "galviorensoft.com" }, "block_lists": { "resolvers": 12, "blocked_by": [ "CloudFlare Family" ], "blocked_count": 1 }, "archives": { "last": "2026-10-27T19:48:22Z", "first": "2026-10-11T01:11:35Z", "changes": 2, "days_archived": 3, "scans_per_day": 0.12, "avg_page_bytes": 41031 }, "robots_txt": { "agents": [ "*" ], "present": true, "sitemaps": [ "https://galviorensoft.com/sitemap.xml" ] }, "sitemap": { "present": true, "url_count": 5 }, "social_tags": { "ogUrl": "https://galviorensoft.com/", "title": "Galvioren | AI Trading Platform | Official Website", "ogType": "website", "robots": "index, follow", "ogTitle": "Galvioren: Elite AI Trading Platform with Automated Bots", "ogSiteName": "Galvioren", "themeColor": "#1a0028", "description": "Galvioren delivers advanced AI-driven trading automation, structured workflows, continuous monitoring, and robust risk controls for confident, scalable market participation.", "twitterCard": "summary", "canonicalUrl": "https://galviorensoft.com/", "ogDescription": "Galvioren delivers advanced AI-driven trading automation, structured workflows, continuous monitoring, and robust risk controls for confident, scalable market participation." }, "trackers": { "requests": 15, "trackers": [ { "name": "Cloudflare", "company": "Cloudflare", "country": "US", "category": "Hosting", "requests": 6 }, { "name": "Google Fonts", "company": "Google", "country": "US", "category": "Hosting", "requests": 1 }, { "name": "jsDelivr", "company": "jsDelivr", "category": "Hosting", "requests": 1 } ] }, "mixed_content": { "no_sri": [ "https://challenges.cloudflare.com/turnstile/v0/api.js", "https://cdn.jsdelivr.net/npm/clientjs@0.2.1/dist/client.min.js" ], "third_party_scripts": 2 }, "status": { "up": true, "code": 200, "timings": { "dns": 4, "tls": 51, "wait": 258, "connect": 6, "download": 21 }, "response_ms": 340 }, "tls_connection": { "alpn": "h2", "cipher": "TLS_AES_256_GCM_SHA384", "protocol": "TLSv1.3", "versions": [ "TLSv1.2", "TLSv1.3" ], "authorized": true, "forward_secrecy": true }, "ports": { "open": [ 80, 443, 8080 ] }, "carbon": { "bytes": 144422, "co2_grams": 0.0053, "cleaner_than": 14 }, "dns_server": { "ns": [ { "ip": "173.245.58.60", "host": "alice.ns.cloudflare.com" }, { "ip": "108.162.193.111", "host": "ed.ns.cloudflare.com" } ], "zone": "galviorensoft.com" }, "cookies": { "cookies": [ { "name": "entry_url", "secure": true, "same_site": "Lax" } ] }, "location": { "ip": "2606:4700:3032::6815:5a4e", "asn": "13335", "org": "Cloudflare, Inc.", "city": "Toronto", "country": "CA" }, "ssl": { "issuer": "Google Trust Services / WE1", "subject": "galviorensoft.com" }, "dns": { "A": [ "104.21.90.78", "172.67.153.253" ], "MX": [ "{\"exchange\": \"mail.galviorensoft.com\", \"priority\": 10}" ], "NS": [ "alice.ns.cloudflare.com", "ed.ns.cloudflare.com" ], "SOA": "{\"nsname\": \"alice.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2418251935, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}", "TXT": [ "google-site-verification=wJntnT1kLYzdkHHcupjs2wAEdcyRT-5lDAc4rX9tErA", "v=spf1 ip4:46.166.131.92 ~all" ], "AAAA": [ "2606:4700:3034::ac43:99fd", "2606:4700:3032::6815:5a4e" ] }, "dnssec": { "ds": false, "rrsig": false, "dnskey": false }, "hsts": { "header": "max-age=15552000; includeSubDomains; preload", "message": "HSTS max-age is 15552000, below the 31536000 minimum." }, "http_security": { "xFrameOptions": "SAMEORIGIN", "referrerPolicy": "strict-origin", "xXSSProtection": false, "permissionsPolicy": "camera=(), microphone=(), geolocation=()", "xContentTypeOptions": "nosniff", "contentSecurityPolicy": "style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://cdnjs.cloudflare.com; default-src 'self'; img-src", "strictTransportPolicy": "max-age=15552000; includeSubDomains; preload", "crossOriginOpenerPolicy": "same-origin", "crossOriginEmbedderPolicy": false, "crossOriginResourcePolicy": false }, "firewall": { "waf": "Cloudflare", "has_waf": true }, "get_ip": { "ip": "2606:4700:3032::6815:5a4e", "family": 6 }, "redirects": { "chain": [ "https://galviorensoft.com" ] }, "linked_pages": { "internal_count": 12 }, "whois": { "registrar": "MainReg Inc.", "created": "2025-11-17T07:21:02Z", "updated": "2026-02-05T09:40:09Z", "expires": "2026-11-17T07:21:02Z", "status": [ "ok https://icann.org/epp" ], "nameservers": [ "alice.ns.cloudflare.com", "ed.ns.cloudflare.com" ] }, "headers": { "headers": { "server": "cloudflare", "content-type": "text/html; charset=utf-8", "strict-transport-security": "max-age=15552000; includeSubDomains; preload", "content-security-policy": "style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://cdnjs.cloudflare.com; default-src 'self'; img-src 'self' data: blob:; frame-ancestors 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://static.cloudflare.com https://cdn.jsdelivr.net https://challenges.cloudflare.com", "x-frame-options": "SAMEORIGIN", "x-content-type-options": "nosniff", "referrer-policy": "strict-origin", "permissions-policy": "camera=(), microphone=(), geolocation=()", "cross-origin-opener-policy": "same-origin" } } } } ```