# PhishDestroy domain threat record: globalnordicinvest.sbs

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/globalnordicinvest.sbs/
Machine-readable companion: https://phishdestroy.io/domain/globalnordicinvest.sbs/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-27 21:19:40 UTC
- Last availability or vendor check: 2026-10-27 23:00:28 UTC
- Stored record updated: 2026-10-27 23:56:53 UTC
- VirusTotal detections in the stored snapshot: 19/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored infrastructure

- Observed IP address: 185.62.56.121
- Registrar in stored WHOIS data: NETIM SAS
- Last stored HTTP status: 200
- Registration date in stored WHOIS data: 2026-02-17 09:03:24 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/019e1e02-b4ef-71bb-ac95-1e62bc979caa/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/globalnordicinvest.sbs
- Certificate Transparency search: https://crt.sh/?q=%25.globalnordicinvest.sbs
- Web Archive lookup: https://web.archive.org/web/*/https://globalnordicinvest.sbs/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
PhishDestroy’s automated assessment classifies globalnordicinvest.sbs as an impersonation phishing page. The page presents itself as “Global Nordic Invest | a premium AI | Official Website” and describes a trading‑automation service. The domain was first seen by PhishDestroy on 2026-10-27 and returned HTTP 200 at that time.

How the scam works
Impersonation phishing pages copy the look and language of legitimate brands to trick visitors into entering credentials, personal data, or financial information. Victims are typically led to submit login details or authorize transactions under the false pretense of a trusted service.

Evidence
VirusTotal recorded 19 detections across 92 engines on 2026-10-28, with 16 labeling the domain malicious and 3 as suspicious; vendors include BitDefender, ESET, and AlphaMountain.ai. Google Safe Browsing reported no threat on the same date, while Cloudflare Radar flagged the site as malicious with a malware category on 2026-10-27. PhishDestroy’s internal blocklist includes the domain, external blocklists show no listings, and OTX lists four pulses mentioning it.

Infrastructure
The domain was registered on 2026-02-17 through NETIM SAS and uses Cloudflare nameservers (chance.ns.cloudflare.com, dee.ns.cloudflare.com). Recorded hosting IPs are 172.67.178.54 (urlscan) and 185.62.56.121 (DNS A record), and the TLS certificate issued by ZeroSSL is valid until 2026-12-10.

What to do
Do not enter any credentials or personal information on the site; if you have already done so, change affected passwords and monitor accounts for unauthorized activity. Security teams should block the domain and its recorded IPs at the firewall or proxy and review logs for any connections. Continue to monitor threat feeds for updates on this indicator.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/019e1e02-b4ef-71bb-ac95-1e62bc979caa/
Cloudflare Radar report: https://radar.cloudflare.com/scan/6cdd9de7-d906-4247-8f55-bb7340755897
Stored capture screenshot: https://urlscan.io/screenshots/019e1e02-b4ef-71bb-ac95-1e62bc979caa.png
Cloudflare Radar screenshot (2026-10-27T21:33:40Z): https://screenshots.phishdestroy.io/cf/6cdd9de7-d906-4247-8f55-bb7340755897.png
URLScan screenshot (2026-03-11T17:33:20Z): https://screenshots.phishdestroy.io/us/019cddf5-b6a2-762c-9d77-fd8f12f55cda.png
URLScan capture report: https://urlscan.io/result/019cddf5-b6a2-762c-9d77-fd8f12f55cda/
URLScan screenshot (2026-10-27T21:35:59Z): https://screenshots.phishdestroy.io/us/01a17f4a-6a0f-741f-a1ad-5dab224e5a7e.png
URLScan capture report: https://urlscan.io/result/01a17f4a-6a0f-741f-a1ad-5dab224e5a7e/
VirusTotal report: https://www.virustotal.com/gui/domain/globalnordicinvest.sbs
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=globalnordicinvest.sbs
Archived copy: https://web.archive.org/web/20261027212523/https://globalnordicinvest.sbs/
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-27 23:56:00 UTC

## Stored page captures

- Primary capture: https://urlscan.io/screenshots/019e1e02-b4ef-71bb-ac95-1e62bc979caa.png
  Captured: 2026-10-27 21:19:40 UTC
- URLScan capture 1: https://screenshots.phishdestroy.io/019e1e02-b4ef-71bb-ac95-1e62bc979caa.png
  Source report: https://urlscan.io/result/019e1e02-b4ef-71bb-ac95-1e62bc979caa/
- URLScan · 2026-03-11: https://screenshots.phishdestroy.io/us/019cddf5-b6a2-762c-9d77-fd8f12f55cda.png
  Captured: 2026-03-11 17:33:20 UTC
  Source report: https://urlscan.io/result/019cddf5-b6a2-762c-9d77-fd8f12f55cda/
  SHA-256: 8c0e474f7d7465bda6c19aa019a4f77683d37eaa2ca275526c92552709695c6e
- URLScan · 2026-10-27: https://screenshots.phishdestroy.io/us/01a17f4a-6a0f-741f-a1ad-5dab224e5a7e.png
  Captured: 2026-10-27 21:35:59 UTC
  Source report: https://urlscan.io/result/01a17f4a-6a0f-741f-a1ad-5dab224e5a7e/
  SHA-256: 197bc2e2e20f20f164e728f9974802b4ebf7458638d85a64b5adbd7bf9b76483
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/6cdd9de7-d906-4247-8f55-bb7340755897.png
  Captured: 2026-10-27 21:33:40 UTC
  Source report: https://radar.cloudflare.com/scan/6cdd9de7-d906-4247-8f55-bb7340755897
  SHA-256: 4d92f0020128fc022dc780502a4870acf8fb4983c300ef8bb699ef704cb904fa

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-27T21:36:17Z",
        "uuid": "019e1e02-b4ef-71bb-ac95-1e62bc979caa",
        "scanned_at": "2026-05-12T21:06:01Z",
        "final_url": "https://globalnordicinvest.sbs/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://globalnordicinvest.sbs/",
                "from": "http://globalnordicinvest.sbs/",
                "status": 307
            }
        ],
        "ip": "172.67.178.54",
        "domains": [
            "cdnjs.cloudflare.com",
            "fonts.gstatic.com",
            "cdn.jsdelivr.net",
            "fonts.googleapis.com",
            "static.cloudflare.com"
        ],
        "ips": [
            "142.251.13.94",
            "104.17.208.5",
            "142.251.13.95",
            "104.17.25.14",
            "172.67.178.54"
        ],
        "asns": [
            "15169",
            "13335"
        ],
        "countries": [
            "US"
        ],
        "doc_hash": "a508c331da5d4130226d0c3c81b1216997c8fad86459bc1d832a0ac99e51fc9c",
        "globals": [
            "LANG_MSGS",
            "ClientJS",
            "_mhk1p",
            "toggleTermsPopup"
        ],
        "tls": {
            "san": [
                "globalnordicinvest.sbs"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "WE1",
            "subject": "globalnordicinvest.sbs",
            "protocol": "TLS 1.3",
            "valid_to": "2026-07-16T17:46:42Z",
            "valid_from": "2026-04-17T16:46:52Z"
        },
        "domain_age_days": 84,
        "apex_age_days": 84,
        "tls_age_days": 25,
        "tls_valid_days": 90,
        "requests": 17,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 84,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "cloudflare",
            "content-type": "text/html; charset=utf-8",
            "strict-transport-security": "max-age=31536000; includeSubDomains; preload",
            "content-security-policy": "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://static.cloudflare.com https://cdn.jsdelivr.net; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://cdnjs.",
            "x-frame-options": "SAMEORIGIN",
            "x-content-type-options": "nosniff",
            "referrer-policy": "strict-origin-when-cross-origin",
            "permissions-policy": "camera=(), microphone=(), geolocation=()",
            "cross-origin-opener-policy": "same-origin"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-27T21:36:26Z",
        "uuid": "6cdd9de7-d906-4247-8f55-bb7340755897",
        "scanned_at": "2026-10-27T21:33:40Z",
        "final_url": "https://globalnordicinvest.sbs/",
        "status": 200,
        "history": [
            {
                "url": "https://globalnordicinvest.sbs/",
                "status": 200
            }
        ],
        "dom_hash": "9c95222f9d778bd7e6202853c04770f5a5e221838138b60bd7bba440d2f0b03b",
        "doc_hash": "e2b30c84c1c62d8a4050cf9ed74039819e1b7f3c50cc9d3ac5a7e0ad96dab4e1",
        "phishing_v2": [
            "phishing"
        ],
        "domain_risks": [
            "Malware",
            "Security threats",
            "CIPA Filter",
            "CIPA"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "globalnordicinvest.sbs",
                "type": "A",
                "value": "185.62.56.121"
            }
        ],
        "dnssec_valid": false,
        "ip": "127.0.1.11",
        "verdict": {
            "tags": [
                "malware"
            ],
            "malicious": true,
            "categories": [
                "malware"
            ]
        },
        "whois": {
            "registrar": "NETIM SAS",
            "created": "2026-02-17T10:03:24Z",
            "updated": "2026-02-22T10:07:19Z",
            "expires": "2027-02-17T23:59:59Z",
            "nameservers": [
                "chance.ns.cloudflare.com",
                "dee.ns.cloudflare.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-27T23:50:39Z",
        "analysis_at": "2026-10-22T17:48:36Z",
        "stats": {
            "timeout": 0,
            "harmless": 43,
            "malicious": 16,
            "suspicious": 3,
            "undetected": 30
        },
        "detections": {
            "CRDF": "malicious",
            "DNS8": "suspicious",
            "ESET": "suspicious",
            "VIPRE": "phishing",
            "G-Data": "phishing",
            "Lionic": "phishing",
            "Sophos": "phishing",
            "CyRadar": "phishing",
            "Webroot": "malicious",
            "Fortinet": "phishing",
            "SOCRadar": "phishing",
            "Kaspersky": "phishing",
            "Seclookup": "malicious",
            "Gridinsoft": "suspicious",
            "BitDefender": "phishing",
            "Chong Lua Dao": "malicious",
            "alphaMountain.ai": "malicious",
            "Bfore.Ai PreCrime": "malicious",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "categories": {
            "Sophos": "phishing and fraud",
            "Webroot": "Malware Sites",
            "alphaMountain.ai": "Spam, Suspicious (alphaMountain.ai)",
            "Forcepoint ThreatSeeker": "phishing and other frauds"
        },
        "created": "2026-02-17T00:00:00Z",
        "updated": "2026-02-17T00:00:00Z",
        "first_seen": "2026-02-17T13:27:53Z",
        "dns": [
            {
                "ttl": 21600,
                "type": "NS",
                "value": "chance.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "185.62.56.121"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "dee.ns.cloudflare.com"
            },
            {
                "ttl": 1800,
                "type": "SOA",
                "rname": "dns.cloudflare.com",
                "value": "chance.ns.cloudflare.com"
            }
        ],
        "dns_at": "2026-10-22T17:49:04Z",
        "jarm": "40d40d40d00000000043d43d00043d6aff5ab0f4fc31897186312c9e639319",
        "cert": {
            "san": [
                "globalnordicinvest.sbs"
            ],
            "issuer": "ZeroSSL GmbH / ZeroSSL ECC DV SSL CA 2",
            "serial": "a0907927338f8e1fac8c74e44c2d706",
            "sha256": "72e552dbb902c12a60009fc416e897c684502d021dfada3e4ca721c314a1aa87",
            "subject": "globalnordicinvest.sbs",
            "valid_to": "2026-12-10T23:59:59Z",
            "valid_from": "2026-09-11T00:00:00Z"
        },
        "whois": [],
        "rdap": {
            "status": [
                "active",
                "client transfer prohibited"
            ],
            "events": {
                "expiration": "2027-02-17T21:00:00Z",
                "last changed": "2026-02-17T11:03:23Z",
                "registration": "2026-02-17T00:00:00Z",
                "registrar expiration": "2027-02-17T21:00:00Z",
                "last update of RDAP database": "2026-04-17T20:54:32Z"
            },
            "registrar": "NETIM SAS",
            "registrar_iana_id": "1519"
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-27T21:39:11Z",
        "mail_config": {
            "spf_lookups": 0
        },
        "caa_records": {
            "domain": "globalnordicinvest.sbs"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_by": [
                "CloudFlare Family"
            ],
            "blocked_count": 1
        },
        "archives": {
            "last": "2026-10-27T21:25:23Z",
            "first": "2026-10-13T18:13:11Z",
            "changes": 1,
            "days_archived": 2,
            "scans_per_day": 0.07,
            "avg_page_bytes": 12623
        },
        "robots_txt": {
            "agents": [
                "*"
            ],
            "present": true,
            "sitemaps": [
                "https://globalnordicinvest.sbs/sitemap.xml"
            ]
        },
        "sitemap": {
            "present": true,
            "url_count": 140
        },
        "social_tags": {
            "ogUrl": "https://globalnordicinvest.sbs/",
            "title": "Global Nordic Invest | a premium AI | Official Website",
            "ogType": "website",
            "robots": "index, follow",
            "ogTitle": "NordicWave Intelligence | Enterprise-grade automation powering professional trading",
            "ogSiteName": "NordicWave Intelligence",
            "themeColor": "#0a1f0a",
            "description": "NordicWave Intelligence delivers AI-assisted automated trading workflows, execution controls, and risk-focused tooling for structured monitoring, permissions, and governance.",
            "twitterCard": "summary",
            "canonicalUrl": "https://globalnordicinvest.sbs/",
            "ogDescription": "NordicWave Intelligence delivers AI-assisted automated trading workflows, execution controls, and risk-focused tooling for structured monitoring, permissions, and governance."
        },
        "trackers": {
            "requests": 20,
            "trackers": [
                {
                    "name": "Cloudflare",
                    "company": "Cloudflare",
                    "country": "US",
                    "category": "Hosting",
                    "requests": 7
                },
                {
                    "name": "Google Fonts",
                    "company": "Google",
                    "country": "US",
                    "category": "Hosting",
                    "requests": 1
                },
                {
                    "name": "Google Static",
                    "company": "Google",
                    "country": "US",
                    "category": "Hosting",
                    "requests": 2
                },
                {
                    "name": "jsDelivr",
                    "company": "jsDelivr",
                    "category": "Hosting",
                    "requests": 3
                }
            ]
        },
        "mixed_content": {
            "no_sri": [
                "https://cdn.jsdelivr.net/npm/intl-tel-input@23/build/js/intlTelInput.min.js"
            ],
            "third_party_scripts": 1
        },
        "status": {
            "up": true,
            "code": 200,
            "timings": {
                "dns": 15,
                "tls": 30,
                "wait": 22,
                "connect": 18,
                "download": 50
            },
            "response_ms": 135
        },
        "tls_connection": {
            "alpn": "h2",
            "cipher": "TLS_AES_128_GCM_SHA256",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "ocsp_stapled": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                80,
                443
            ]
        },
        "carbon": {
            "bytes": 48343,
            "co2_grams": 0.0018,
            "cleaner_than": 38
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "172.64.32.93",
                    "host": "dee.ns.cloudflare.com"
                },
                {
                    "ip": "108.162.195.33",
                    "host": "chance.ns.cloudflare.com"
                }
            ],
            "zone": "globalnordicinvest.sbs"
        },
        "location": {
            "ip": "185.62.56.121",
            "asn": "62370",
            "org": "Snel.com B.V.",
            "city": "Rotterdam",
            "country": "NL"
        },
        "ssl": {
            "issuer": "ZeroSSL GmbH / ZeroSSL ECC DV SSL CA 2",
            "subject": "globalnordicinvest.sbs"
        },
        "dns": {
            "A": [
                "185.62.56.121"
            ],
            "NS": [
                "dee.ns.cloudflare.com",
                "chance.ns.cloudflare.com"
            ],
            "SOA": "{\"nsname\": \"chance.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2417216620, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}"
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "hsts": {
            "message": "Site does not serve any HSTS headers."
        },
        "http_security": {
            "xFrameOptions": false,
            "referrerPolicy": "no-referrer-when-downgrade",
            "xXSSProtection": false,
            "permissionsPolicy": false,
            "xContentTypeOptions": false,
            "contentSecurityPolicy": false,
            "strictTransportPolicy": false,
            "crossOriginOpenerPolicy": false,
            "crossOriginEmbedderPolicy": false,
            "crossOriginResourcePolicy": false
        },
        "get_ip": {
            "ip": "185.62.56.121",
            "family": 4
        },
        "redirects": {
            "chain": [
                "https://globalnordicinvest.sbs"
            ]
        },
        "linked_pages": {
            "internal_count": 37
        },
        "whois": {
            "registrar": "NETIM SAS",
            "created": "2026-02-17T10:03:24Z",
            "updated": "2026-02-22T10:07:19Z",
            "expires": "2027-02-17T23:59:59Z",
            "status": [
                "clientTransferProhibited https://icann.org/epp"
            ],
            "nameservers": [
                "chance.ns.cloudflare.com",
                "dee.ns.cloudflare.com"
            ]
        },
        "headers": {
            "headers": {
                "content-type": "text/html; charset=utf-8",
                "referrer-policy": "no-referrer-when-downgrade"
            }
        }
    }
}
```