# PhishDestroy domain threat record: gcwashinvest.click

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/gcwashinvest.click/
Machine-readable companion: https://phishdestroy.io/domain/gcwashinvest.click/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-27 19:46:35 UTC
- Last availability or vendor check: 2026-10-27 23:00:26 UTC
- Stored record updated: 2026-10-27 23:55:28 UTC
- VirusTotal detections in the stored snapshot: 17/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored infrastructure

- Observed IP address: 185.62.56.63
- Registrar in stored WHOIS data: Spaceship, Inc.
- Registrar country in stored WHOIS data: US
- Last stored HTTP status: 200
- Registration date in stored WHOIS data: 2026-06-07 05:43:47 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a02fee-6b6f-72dc-83e8-3f023d975f67/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/gcwashinvest.click
- Certificate Transparency search: https://crt.sh/?q=%25.gcwashinvest.click
- Web Archive lookup: https://web.archive.org/web/*/https://gcwashinvest.click/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
PhishDestroy added gcwashinvest.click to its internal blocklist on 2026-10-27 after an intake review marked it as a trusted report because of its age. The recorded page title claims “gcwash invest | AI Trading Platform | Official Website”. An HTTP 200 response was recorded on the same date. No specific malicious behavior was observed on the page.

How the scam works
Suspicious domains that present fake investment or trading services often aim to persuade visitors to deposit funds or disclose account credentials. Such schemes rely on the appearance of legitimacy, for example by using AI‑related language and professional‑sounding branding. The listing reflects the risk associated with these claims, not a confirmed exploitation technique. No evidence of actual fund collection or credential harvesting was seen on this page.

Evidence
VirusTotal scanned the domain on 2026-10-22 and reported 17 detections from 92 engines, including 14 malicious and 3 suspicious labels from vendors such as BitDefender, ESET and Forcepoint ThreatSeeker. Google Safe Browsing checked on 2026-10-27 and did not flag the site. urlscan captured the page on 2026-08-23; its machine‑learning engine gave a malicious score of 99, while the overall verdict was clean. PhishDestroy’s internal blocklist marked the domain as present on 2026-10-27, and external blocklists showed no entries at the time of checking.

Infrastructure
The domain was registered on 2026-06-07 through Spaceship, Inc., with a clientTransferProhibited status. The recorded IP was 185.62.56.63, which belongs to the Snel.com B.V. network in the Netherlands. DNS was served by Cloudflare nameservers (addilyn.ns.cloudflare.com and ignacio.ns.cloudflare.com) at the time of observation. The TLS certificate, issued by ZeroSSL, was valid until 2026-12-18.

What to do
Visitors should avoid entering any personal, financial or login information on the site and, if they have already done so, change affected passwords and monitor accounts for unauthorized activity. Security teams can block the exact domain in network filters and review logs for connections to the recorded IP address. Continue to monitor threat feeds for any new indicators related to gcwashinvest.click. No further action is required against the hosting provider or registrar based solely on this evidence.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a02fee-6b6f-72dc-83e8-3f023d975f67/
Cloudflare Radar report: https://radar.cloudflare.com/scan/5ad26a49-12cc-4782-8d37-f30d15d62877
Stored capture screenshot: https://urlscan.io/screenshots/01a02fee-6b6f-72dc-83e8-3f023d975f67.png
Cloudflare Radar screenshot: https://screenshots.phishdestroy.io/cf/5ad26a49-12cc-4782-8d37-f30d15d62877.png
URLScan screenshot (2026-07-20T08:15:27Z): https://screenshots.phishdestroy.io/us/019f7e98-0d25-7048-a24d-22fd92cc2ce0.png
URLScan capture report: https://urlscan.io/result/019f7e98-0d25-7048-a24d-22fd92cc2ce0/
URLScan screenshot (2026-07-20T08:25:44Z): https://screenshots.phishdestroy.io/us/019f7ea1-733c-72fe-a0a3-f229273b9ec3.png
URLScan capture report: https://urlscan.io/result/019f7ea1-733c-72fe-a0a3-f229273b9ec3/
VirusTotal report: https://www.virustotal.com/gui/domain/gcwashinvest.click
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=gcwashinvest.click
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-27 19:50:19 UTC

## Stored page captures

- Primary capture: https://urlscan.io/screenshots/01a02fee-6b6f-72dc-83e8-3f023d975f67.png
  Captured: 2026-10-27 19:46:35 UTC
- URLScan capture 1: https://screenshots.phishdestroy.io/01a02fee-6b6f-72dc-83e8-3f023d975f67.png
  Source report: https://urlscan.io/result/01a02fee-6b6f-72dc-83e8-3f023d975f67/
- URLScan · 2026-07-20: https://screenshots.phishdestroy.io/us/019f7e98-0d25-7048-a24d-22fd92cc2ce0.png
  Captured: 2026-07-20 08:15:27 UTC
  Source report: https://urlscan.io/result/019f7e98-0d25-7048-a24d-22fd92cc2ce0/
  SHA-256: bc1a5e0cc9e3148fe5ab57b4c4723a000ede8a97e756be1f224e7a4431b66d61
- URLScan · 2026-07-20: https://screenshots.phishdestroy.io/us/019f7ea1-733c-72fe-a0a3-f229273b9ec3.png
  Captured: 2026-07-20 08:25:44 UTC
  Source report: https://urlscan.io/result/019f7ea1-733c-72fe-a0a3-f229273b9ec3/
  SHA-256: 49e1cf32f6339607dd2b0389db2b2d9b756e8fbab75db9bf7c43b14caa8731f4
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/5ad26a49-12cc-4782-8d37-f30d15d62877.png
  Captured: 2026-10-27 19:48:13 UTC
  Source report: https://radar.cloudflare.com/scan/5ad26a49-12cc-4782-8d37-f30d15d62877
  SHA-256: 1240996f09c5a4e5acb462ef99d6c7e791096176bd0e85da7acffd272a8c24d6

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-27T19:49:33Z",
        "uuid": "01a02fee-6b6f-72dc-83e8-3f023d975f67",
        "scanned_at": "2026-08-23T18:42:35Z",
        "final_url": "https://gcwashinvest.click/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://gcwashinvest.click/",
                "from": "http://gcwashinvest.click/",
                "status": 307
            }
        ],
        "ip": "185.62.56.63",
        "ptr": "s46060.hosted-by-snel.com",
        "domains": [
            "cdn.jsdelivr.net",
            "cdnjs.cloudflare.com",
            "fonts.gstatic.com",
            "www.cloudflare.com",
            "fonts.googleapis.com"
        ],
        "ips": [
            "142.250.154.94",
            "104.17.208.5",
            "104.16.123.96",
            "2606:4700::6811:cf05",
            "104.17.24.14",
            "2a00:1450:4001:c1f::5f",
            "185.62.56.63"
        ],
        "asns": [
            "15169",
            "13335",
            "62370"
        ],
        "countries": [
            "US",
            "DE",
            "NL"
        ],
        "doc_hash": "1d0e68b484f3435aed450278f49a55610f654a9b5ac82b290b8797909e8c49bf",
        "script_hashes": [
            "dcffb692e1e6bda024f7830b7f5a3fa758c06ede0ac195daebf2c9fe01442f3f"
        ],
        "globals": [
            "toggleTermsPopup",
            "intlTelInput",
            "__visitorCountry",
            "ClientJS"
        ],
        "storage_keys": [
            "t_cfp"
        ],
        "tls": {
            "san": [
                "gcwashinvest.click"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "ZeroSSL ECC DV SSL CA 2",
            "subject": "gcwashinvest.click",
            "protocol": "TLS 1.3",
            "valid_to": "2026-10-19T23:59:59Z",
            "valid_from": "2026-07-21T00:00:00Z"
        },
        "domain_age_days": 76,
        "apex_age_days": 76,
        "tls_age_days": 33,
        "tls_valid_days": 90,
        "requests": 20,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 99,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "content-type": "text/html; charset=utf-8",
            "referrer-policy": "no-referrer-when-downgrade"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-27T20:30:57Z",
        "uuid": "5ad26a49-12cc-4782-8d37-f30d15d62877",
        "scanned_at": "2026-10-27T19:48:13Z",
        "final_url": "https://gcwashinvest.click/",
        "status": 200,
        "history": [
            {
                "url": "https://gcwashinvest.click/",
                "status": 200
            }
        ],
        "dom_hash": "b03210b6eebacaa38e24cc9766b22b7f748620daf1a64823ee6d3079d85367ed",
        "doc_hash": "a4e4f2b322de06a5c453bde9071c48803c2eeda3a64285ef44391707ac9b16fb",
        "phishing_v2": [
            "phishing"
        ],
        "domain_risks": [
            "Malware",
            "Security threats",
            "CIPA Filter",
            "CIPA"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "gcwashinvest.click",
                "type": "A",
                "value": "185.62.56.63"
            }
        ],
        "dnssec_valid": false,
        "ip": "127.0.1.3",
        "verdict": {
            "tags": [
                "malware"
            ],
            "malicious": true,
            "categories": [
                "malware"
            ]
        },
        "whois": {
            "registrar": "Spaceship, Inc.",
            "created": "2026-06-07T07:43:47Z",
            "updated": "2026-06-12T07:44:27Z",
            "expires": "2027-06-07T07:43:47Z",
            "nameservers": [
                "addilyn.ns.cloudflare.com",
                "ignacio.ns.cloudflare.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-27T19:47:27Z",
        "analysis_at": "2026-10-22T12:15:37Z",
        "stats": {
            "timeout": 0,
            "harmless": 43,
            "malicious": 14,
            "suspicious": 3,
            "undetected": 32
        },
        "detections": {
            "CRDF": "malicious",
            "DNS8": "suspicious",
            "ESET": "suspicious",
            "VIPRE": "phishing",
            "G-Data": "phishing",
            "Lionic": "phishing",
            "Sophos": "phishing",
            "CyRadar": "phishing",
            "Webroot": "malicious",
            "Fortinet": "phishing",
            "SOCRadar": "phishing",
            "Kaspersky": "phishing",
            "Seclookup": "malicious",
            "Gridinsoft": "suspicious",
            "BitDefender": "phishing",
            "alphaMountain.ai": "phishing",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "registrar": "Spaceship, Inc.",
        "created": "2026-06-07T07:43:47Z",
        "expires": "2027-06-07T07:43:47Z",
        "updated": "2026-06-12T07:44:27Z",
        "first_seen": "2026-06-08T13:03:38Z",
        "dns": [
            {
                "ttl": 21600,
                "type": "NS",
                "value": "addilyn.ns.cloudflare.com"
            },
            {
                "ttl": 1800,
                "type": "SOA",
                "rname": "dns.cloudflare.com",
                "value": "addilyn.ns.cloudflare.com"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "ignacio.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "185.62.56.63"
            }
        ],
        "dns_at": "2026-10-22T12:20:54Z",
        "jarm": "40d40d40d00000000043d43d00043d6aff5ab0f4fc31897186312c9e639319",
        "cert": {
            "san": [
                "gcwashinvest.click"
            ],
            "issuer": "ZeroSSL GmbH / ZeroSSL ECC DV SSL CA 2",
            "serial": "95d0fb7b290427c7d4f25103edac4a1f",
            "sha256": "db14e3fe0b86daa88baa804cb0aeda48d8d9f6af5e4fdd45e0772151f49aaeb4",
            "subject": "gcwashinvest.click",
            "valid_to": "2026-12-18T23:59:59Z",
            "valid_from": "2026-09-19T00:00:00Z"
        },
        "whois": {
            "registrar": "Spaceship, Inc.",
            "registrar_iana_id": "3862",
            "registrar_url": "https://www.spaceship.com/",
            "created": "2026-06-07T07:43:47Z",
            "updated": "2026-06-12T07:44:27Z",
            "expires": "2027-06-07T07:43:47Z",
            "status": [
                "clientTransferProhibited"
            ],
            "nameservers": [
                "addilyn.ns.cloudflare.com",
                "ignacio.ns.cloudflare.com"
            ],
            "dnssec": "unsigned"
        },
        "rdap": {
            "status": [
                "client transfer prohibited"
            ],
            "events": {
                "last changed": "2026-08-21T21:52:55Z",
                "registration": "2026-06-07T07:43:47Z",
                "registrar expiration": "2027-06-07T07:43:47Z",
                "last update of RDAP database": "2026-10-19T12:04:56Z"
            }
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-27T19:49:55Z",
        "mail_config": {
            "spf_lookups": 0
        },
        "caa_records": {
            "domain": "gcwashinvest.click"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_by": [
                "CloudFlare Family"
            ],
            "blocked_count": 1
        },
        "robots_txt": {
            "agents": [
                "*"
            ],
            "present": true,
            "sitemaps": [
                "https://gcwashinvest.click/sitemap.xml"
            ]
        },
        "sitemap": {
            "present": true,
            "url_count": 140
        },
        "social_tags": {
            "ogUrl": "https://gcwashinvest.click/",
            "title": "gcwash invest | AI Trading Platform | Official Website",
            "ogType": "website",
            "robots": "index, follow",
            "ogTitle": "gcwash invest | Intelligent AI-driven trading automation",
            "ogSiteName": "gcwash invest",
            "themeColor": "#101010",
            "description": "gcwash invest delivers AI-driven trading guidance with automated bots, risk controls, and transparent operations for informed decisions across markets.",
            "twitterCard": "summary",
            "canonicalUrl": "https://gcwashinvest.click/",
            "ogDescription": "gcwash invest provides AI-powered trading guidance with automated bots, structured risk controls, and transparent operations for informed decision-making across markets."
        },
        "trackers": {
            "requests": 24,
            "trackers": [
                {
                    "name": "Cloudflare",
                    "company": "Cloudflare",
                    "country": "US",
                    "category": "Hosting",
                    "requests": 8
                },
                {
                    "name": "Google Fonts",
                    "company": "Google",
                    "country": "US",
                    "category": "Hosting",
                    "requests": 1
                },
                {
                    "name": "Google Static",
                    "company": "Google",
                    "country": "US",
                    "category": "Hosting",
                    "requests": 2
                },
                {
                    "name": "jsDelivr",
                    "company": "jsDelivr",
                    "category": "Hosting",
                    "requests": 5
                }
            ]
        },
        "mixed_content": {
            "no_sri": [
                "https://cdn.jsdelivr.net/npm/intl-tel-input@23/build/js/intlTelInput.min.js"
            ],
            "third_party_scripts": 1
        },
        "status": {
            "up": true,
            "code": 200,
            "timings": {
                "dns": 27,
                "tls": 22,
                "wait": 20,
                "connect": 35,
                "download": 35
            },
            "response_ms": 139
        },
        "tls_connection": {
            "alpn": "h2",
            "cipher": "TLS_AES_128_GCM_SHA256",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "ocsp_stapled": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                80,
                443
            ]
        },
        "carbon": {
            "bytes": 47973,
            "co2_grams": 0.0018,
            "cleaner_than": 38
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "162.159.38.217",
                    "host": "addilyn.ns.cloudflare.com"
                },
                {
                    "ip": "108.162.195.82",
                    "host": "ignacio.ns.cloudflare.com"
                }
            ],
            "zone": "gcwashinvest.click"
        },
        "location": {
            "ip": "185.62.56.63",
            "asn": "62370",
            "org": "Snel.com B.V.",
            "country": "NL"
        },
        "ssl": {
            "issuer": "ZeroSSL GmbH / ZeroSSL ECC DV SSL CA 2",
            "subject": "gcwashinvest.click"
        },
        "dns": {
            "A": [
                "185.62.56.63"
            ],
            "NS": [
                "ignacio.ns.cloudflare.com",
                "addilyn.ns.cloudflare.com"
            ],
            "SOA": "{\"nsname\": \"addilyn.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2416653260, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}"
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "hsts": {
            "message": "Site does not serve any HSTS headers."
        },
        "http_security": {
            "xFrameOptions": false,
            "referrerPolicy": "no-referrer-when-downgrade",
            "xXSSProtection": false,
            "permissionsPolicy": false,
            "xContentTypeOptions": false,
            "contentSecurityPolicy": false,
            "strictTransportPolicy": false,
            "crossOriginOpenerPolicy": false,
            "crossOriginEmbedderPolicy": false,
            "crossOriginResourcePolicy": false
        },
        "get_ip": {
            "ip": "185.62.56.63",
            "family": 4
        },
        "redirects": {
            "chain": [
                "https://gcwashinvest.click"
            ]
        },
        "linked_pages": {
            "internal_count": 38
        },
        "whois": {
            "registrar": "Spaceship, Inc.",
            "created": "2026-06-07T07:43:47Z",
            "updated": "2026-06-12T07:44:27Z",
            "expires": "2027-06-07T07:43:47Z",
            "status": [
                "clientTransferProhibited https://icann.org/epp"
            ],
            "nameservers": [
                "addilyn.ns.cloudflare.com",
                "ignacio.ns.cloudflare.com"
            ]
        },
        "headers": {
            "headers": {
                "content-type": "text/html; charset=utf-8",
                "referrer-policy": "no-referrer-when-downgrade"
            }
        }
    }
}
```