# PhishDestroy domain threat record: glurvextopin-official.org Content language: English Canonical HTML report: https://phishdestroy.io/domain/glurvextopin-official.org/ Machine-readable companion: https://phishdestroy.io/domain/glurvextopin-official.org/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-10-27 21:20:07 UTC - Last availability or vendor check: 2026-10-27 21:57:05 UTC - Stored record updated: 2026-10-27 23:56:51 UTC - VirusTotal detections in the stored snapshot: 16/92 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: no stored flag ## Stored classification - Targeted brand: ethereum ## Stored infrastructure - Observed IP address: 188.114.97.3 - Registrar in stored WHOIS data: Dynadot Inc - Last stored HTTP status: 200 - Registration date in stored WHOIS data: 2026-06-02 14:16:18 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a17f5d-934a-72c8-991d-9c8d66d645cf/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/glurvextopin-official.org - Certificate Transparency search: https://crt.sh/?q=%25.glurvextopin-official.org - Web Archive lookup: https://web.archive.org/web/*/https://glurvextopin-official.org/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview PhishDestroy’s automated assessment categorises glurvextopin-official.org as an impersonation phishing page. The recorded page title reads “Glurvextopin™ [2026] | Official Platform for Financial Management and Data Analysis”, which suggests a fake financial‑service offering. The domain was first observed by PhishDestroy on 2026-10-27 and returned an HTTP 200 response at that time. How the scam works Impersonation phishing sites copy the branding and language of legitimate financial or data‑analysis services to trick visitors into entering credentials, personal data, or payment information. Victims are typically lured via email, social media, or search results and directed to a look‑alike login or registration form. Collected data can be used for account takeover, identity theft, or sold to other fraud actors. Evidence VirusTotal scanned the domain on 2026-10-19 and reported 16 detections from 92 engines, including 13 malicious and 3 suspicious labels from vendors such as BitDefender, Fortinet and ESET. Google Safe Browsing checked on 2026-10-28 and did not flag the site. urlscan.io captured the page on 2026-10-27; its engine score was 99 malicious but the overall verdict was non‑malicious with a score of 0. Cloudflare Radar scanned on 2026-10-27 and marked the domain as phishing and malware. OTX listed four pulses referencing the domain as of 2026-10-28. PhishDestroy’s internal blocklist contains the domain, while external blocklists (Spamhaus, others) reported no listings on the same date. Infrastructure The domain was registered on 2026-06-02 through Dynadot Inc. Hosting records show the site resolved to Cloudflare network addresses (e.g., 188.114.97.3, 104.21.89.216) located in the United States. The TLS certificate, issued by Google Trust Services, is valid from 2026-09-29 to 2026-12-28 and covers the domain and its subdomains. No DNSSEC signatures were observed. What to do Do not enter any credentials, personal data, or payment information on the site. If you have already submitted such data, change passwords on the affected services and monitor accounts for unauthorized activity. Report the domain to PhishDestroy and to any relevant anti‑phishing or security teams. Defenders should block the exact domain in web filters and monitor DNS queries for the listed IP ranges. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a17f5d-934a-72c8-991d-9c8d66d645cf/ Cloudflare Radar report: https://radar.cloudflare.com/scan/9a1a7c1f-793e-4778-8c09-1c3a1811b72a URLQuery report: https://urlquery.net/report/7133e35a-cad7-40ad-8b30-855cd52b5776 Stored capture screenshot: https://i.ibb.co/HDJ7CBzR/38fbf9ce8b75.png Cloudflare Radar screenshot (2026-10-27T21:33:18Z): https://screenshots.phishdestroy.io/cf/9a1a7c1f-793e-4778-8c09-1c3a1811b72a.png URLQuery screenshot: https://screenshots.phishdestroy.io/uq/7133e35a-cad7-40ad-8b30-855cd52b5776.png URLScan screenshot (2026-09-29T07:00:20Z): https://screenshots.phishdestroy.io/us/01a0ebf6-c55f-7154-ab5d-b7d02f1d9d84.png URLScan capture report: https://urlscan.io/result/01a0ebf6-c55f-7154-ab5d-b7d02f1d9d84/ URLScan screenshot (2026-09-29T11:30:09Z): https://screenshots.phishdestroy.io/us/01a0eced-d222-7400-a185-aa2beea17126.png URLScan capture report: https://urlscan.io/result/01a0eced-d222-7400-a185-aa2beea17126/ URLScan screenshot (2026-09-30T12:02:39Z): https://screenshots.phishdestroy.io/us/01a0f231-e944-71fe-b1d0-8bea6f488df1.png URLScan capture report: https://urlscan.io/result/01a0f231-e944-71fe-b1d0-8bea6f488df1/ URLScan screenshot (2026-10-27T21:38:48Z): https://screenshots.phishdestroy.io/us/01a17f4d-1adf-7579-957c-83cd6da4706f.png URLScan capture report: https://urlscan.io/result/01a17f4d-1adf-7579-957c-83cd6da4706f/ VirusTotal report: https://www.virustotal.com/gui/domain/glurvextopin-official.org Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=glurvextopin-official.org Archived copy: https://web.archive.org/web/20261027212608/https://glurvextopin-official.org/ Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-27 23:54:50 UTC ## Stored page captures - Primary capture: https://i.ibb.co/HDJ7CBzR/38fbf9ce8b75.png Captured: 2026-10-27 21:57:05 UTC - URLScan capture 1: https://urlscan.io/screenshots/01a17f5d-934a-72c8-991d-9c8d66d645cf.png Captured: 2026-10-27 21:57:05 UTC Source report: https://urlscan.io/result/01a17f5d-934a-72c8-991d-9c8d66d645cf/ - URLScan capture 2: https://screenshots.phishdestroy.io/01a0f231-e944-71fe-b1d0-8bea6f488df1.png Captured: 2026-10-27 21:20:07 UTC Source report: https://urlscan.io/result/01a17f5d-934a-72c8-991d-9c8d66d645cf/ - URLScan · 2026-09-29: https://screenshots.phishdestroy.io/us/01a0ebf6-c55f-7154-ab5d-b7d02f1d9d84.png Captured: 2026-09-29 07:00:20 UTC Source report: https://urlscan.io/result/01a0ebf6-c55f-7154-ab5d-b7d02f1d9d84/ SHA-256: 930ad4b26c94e167d297fc3646e14b32c20ead88a290d2382f852b664fa49fd9 - URLScan · 2026-09-29: https://screenshots.phishdestroy.io/us/01a0eced-d222-7400-a185-aa2beea17126.png Captured: 2026-09-29 11:30:09 UTC Source report: https://urlscan.io/result/01a0eced-d222-7400-a185-aa2beea17126/ SHA-256: dad996d8527822b2c7274615d001a192b9cd1508d05e8bb5d7a007b44e2cd514 - URLScan · 2026-10-27: https://screenshots.phishdestroy.io/us/01a17f4d-1adf-7579-957c-83cd6da4706f.png Captured: 2026-10-27 21:38:48 UTC Source report: https://urlscan.io/result/01a17f4d-1adf-7579-957c-83cd6da4706f/ SHA-256: 384e367a0b29a478ae82fe94ec65af8483fbb3b060a6c17806401d330d12c2eb - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/9a1a7c1f-793e-4778-8c09-1c3a1811b72a.png Captured: 2026-10-27 21:33:18 UTC Source report: https://radar.cloudflare.com/scan/9a1a7c1f-793e-4778-8c09-1c3a1811b72a SHA-256: 804c1d774f85caace1012ff21659963461ca83224f7eb860cf134d4578230245 - URLQuery: https://screenshots.phishdestroy.io/uq/7133e35a-cad7-40ad-8b30-855cd52b5776.png Source report: https://urlquery.net/report/7133e35a-cad7-40ad-8b30-855cd52b5776 SHA-256: 1b4078cb4050da5d84bca3beb08a85291d021f824ccc0842ade632d7321836c6 - URLScan · 2026-09-30: https://screenshots.phishdestroy.io/us/01a0f231-e944-71fe-b1d0-8bea6f488df1.png Captured: 2026-09-30 12:02:39 UTC Source report: https://urlscan.io/result/01a0f231-e944-71fe-b1d0-8bea6f488df1/ SHA-256: 9e259518e76d5dd5d7029b2da2e145c1a9ac8184baf1faf0bda187a8b5823b7a ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-27T22:07:26Z", "uuid": "01a17f5d-934a-72c8-991d-9c8d66d645cf", "scanned_at": "2026-10-27T21:56:49Z", "final_url": "https://glurvextopin-official.org/", "status": 200, "redirected": "https-only", "redirects": [ { "to": "https://glurvextopin-official.org/", "from": "http://glurvextopin-official.org/", "status": 307 } ], "ip": "104.21.89.216", "domains": [ "fonts.gstatic.com", "cdn.jsdelivr.net", "cdnjs.cloudflare.com", "modernroomdesigns.com", "static.cloudflareinsights.com", "fonts.googleapis.com" ], "ips": [ "172.67.222.66", "192.178.155.94", "104.16.79.73", "104.17.25.14", "104.16.179.112", "142.251.163.95", "104.21.89.216" ], "asns": [ "13335", "15169" ], "countries": [ "US" ], "doc_hash": "04d05978fdb111358073ab0524e5c1fafc0826615c206987618416b8bd8a4747", "script_hashes": [ "4082edfaa0f4837bfa6ea5de436af8c395b7f6c65db26b87d2978143aab01885", "1375bb5f82062a5ba4ccb2ec5b420ee41578abf4ec04673a6bcfa6714b95f885", "28033e449a31ebcc396e5be8b13b63152bf03094288fb5867034321927bce087", "ad33c2df9ada8a663c2147357828f980d0b7ca731ef33eb3c6e4f327c3b2cda5", "3d8e7c179d5999b95ced558a5a717566c4c810e296df6c2a5382fe39c5c01cfe" ], "globals": [ "polylang", "_language", "_loader", "GEO_API_URL", "_phone_error", "_form_unknown_error", "__offerChatWidgetMounted", "intlTelInput", "Lenis", "gsapVersions", "Linear", "Power0", "Quad", "Power1", "Cubic", "Power2", "Quart", "Power3", "Quint", "Power4", "Strong", "Elastic", "Bounce", "Expo", "Circ", "Sine", "Back", "SteppedEase", "TweenLite", "TweenMax", "TimelineMax", "TimelineLite", "AttrPlugin", "EndArrayPlugin", "RoundPropsPlugin", "ModifiersPlugin", "SnapPlugin", "gsap", "CSSPlugin", "Observer" ], "cookies": [ "_subid", "csrftoken" ], "domain_age_days": 146, "apex_age_days": 146, "tls_age_days": 28, "tls_valid_days": 90, "requests": 25, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 99, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "content-type": "image/png" } }, "cf": { "v": 1, "fetched_at": "2026-10-27T21:36:24Z", "uuid": "9a1a7c1f-793e-4778-8c09-1c3a1811b72a", "scanned_at": "2026-10-27T21:33:18Z", "final_url": "https://glurvextopin-official.org/", "status": 200, "history": [ { "url": "https://glurvextopin-official.org/", "status": 200 } ], "dom_hash": "1e6b8929d3197961498f5ae9f994adfa7b9246235546aef8a339c34280f7b5b5", "doc_hash": "4f7dd5f20cb954b7bc8ee93dba4851fd6bc8f57ce40c489e7b7a4fc19093aaa2", "phishing_v2": [ "phishing" ], "domain_risks": [ "Malware", "Security threats", "CIPA Filter", "CIPA" ], "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "glurvextopin-official.org", "type": "A", "value": "104.21.89.216" }, { "name": "glurvextopin-official.org", "type": "A", "value": "172.67.165.50" }, { "name": "glurvextopin-official.org", "type": "AAAA", "value": "2606:4700:3037::ac43:a532" }, { "name": "glurvextopin-official.org", "type": "AAAA", "value": "2606:4700:3032::6815:59d8" } ], "dnssec_valid": false, "ip": "127.0.1.14", "verdict": { "tags": [ "malware" ], "malicious": true, "categories": [ "malware" ] }, "whois": { "registrar": "Dynadot Inc", "created": "2026-06-02T16:16:18Z", "updated": "2026-08-12T01:55:44Z", "expires": "2027-06-02T16:16:18Z", "nameservers": [ "dayana.ns.cloudflare.com", "louis.ns.cloudflare.com" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-27T23:50:37Z", "analysis_at": "2026-10-19T10:44:30Z", "stats": { "timeout": 0, "harmless": 45, "malicious": 13, "suspicious": 3, "undetected": 31 }, "detections": { "CRDF": "malicious", "DNS8": "suspicious", "ESET": "suspicious", "VIPRE": "phishing", "G-Data": "phishing", "Lionic": "phishing", "Sophos": "phishing", "Fortinet": "phishing", "SOCRadar": "phishing", "Kaspersky": "phishing", "Seclookup": "malicious", "Gridinsoft": "suspicious", "BitDefender": "phishing", "alphaMountain.ai": "phishing", "Bfore.Ai PreCrime": "malicious", "Forcepoint ThreatSeeker": "phishing" }, "reputation": 0, "tags": [ "dga" ], "registrar": "Dynadot Inc", "created": "2026-06-02T16:16:18Z", "expires": "2027-06-02T16:16:18Z", "updated": "2026-08-12T01:55:44Z", "first_seen": "2026-06-02T17:29:17Z", "dns": [ { "ttl": 300, "type": "A", "value": "172.67.165.50" }, { "ttl": 300, "type": "AAAA", "value": "2606:4700:3032::6815:59d8" }, { "ttl": 21600, "type": "NS", "value": "louis.ns.cloudflare.com" }, { "ttl": 1800, "type": "SOA", "rname": "dns.cloudflare.com", "value": "dayana.ns.cloudflare.com" }, { "ttl": 300, "type": "AAAA", "value": "2606:4700:3037::ac43:a532" }, { "ttl": 21600, "type": "NS", "value": "dayana.ns.cloudflare.com" }, { "ttl": 300, "type": "A", "value": "104.21.89.216" } ], "dns_at": "2026-10-19T10:49:48Z", "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c", "cert": { "san": [ "glurvextopin-official.org", "*.glurvextopin-official.org" ], "issuer": "Google Trust Services / WE1", "serial": "e9a0c440aa8b5f10e46c94fa899abdc", "sha256": "9f82f37123ce5ed0380ad2b358e1666537d949e55185c0148a05b6f8617bbe49", "subject": "glurvextopin-official.org", "valid_to": "2026-12-28T02:36:18Z", "valid_from": "2026-09-29T01:37:50Z" }, "whois": { "registrar": "Dynadot Inc", "registrar_iana_id": "472", "registrar_url": "http://www.dynadot.com", "created": "2026-06-02T16:16:18Z", "updated": "2026-08-12T01:55:44Z", "expires": "2027-06-02T16:16:18Z", "status": [ "clientTransferProhibited" ], "nameservers": [ "dayana.ns.cloudflare.com", "louis.ns.cloudflare.com" ], "dnssec": "unsigned" }, "rdap": { "status": [ "transfer prohibited" ], "events": { "expiration": "2027-06-02T16:16:18Z", "last changed": "2026-06-02T16:16:22Z", "registration": "2026-06-02T16:16:18Z", "registrar expiration": "2027-06-02T16:16:18Z", "last update of RDAP database": "2026-10-16T07:12:23Z" } } }, "webcheck": { "v": 1, "fetched_at": "2026-10-27T21:37:22Z", "mail_config": { "spf_lookups": 0 }, "caa_records": { "domain": "glurvextopin-official.org" }, "block_lists": { "resolvers": 12, "blocked_by": [ "CloudFlare Family" ], "blocked_count": 1 }, "archives": { "last": "2026-10-27T21:26:08Z", "first": "2026-10-12T05:57:15Z", "changes": 4, "days_archived": 5, "scans_per_day": 0.26, "avg_page_bytes": 19026 }, "robots_txt": { "agents": [ "*" ], "present": true, "sitemaps": [ "https://glurvextopin-official.org/sitemap.xml" ] }, "sitemap": { "present": true, "url_count": 7 }, "social_tags": { "ogUrl": "https://glurvextopin-official.org/", "title": "Glurvextopin™ [2026] | Official Platform for Financial Management and Data Analysis", "ogType": "website", "robots": "index, follow, max-image-preview:large, max-snippet:-1, max-video-preview:-1", "ogImage": "https://glurvextopin-official.org/static/template_18/zeongrow/image.png", "ogTitle": "Glurvextopin™ [2026] | Official Platform for Financial Management and Data Analysis", "ogSiteName": "Glurvextopin", "themeColor": "#0A0A1A", "description": "Glurvextopin™ is an official platform designed for advanced financial management and strategic data analysis. It provides structured tools for transparency, efficiency, and data-driven decision-making.", "twitterCard": "summary_large_image", "canonicalUrl": "https://glurvextopin-official.org/", "ogDescription": "Glurvextopin™ is an official platform designed for advanced financial management and strategic data analysis. It provides structured tools for transparency, efficiency, and data-driven decision-making." }, "trackers": { "requests": 16, "trackers": [ { "name": "Cloudflare", "company": "Cloudflare", "country": "US", "category": "Hosting", "requests": 1 }, { "name": "Google Fonts", "company": "Google", "country": "US", "category": "Hosting", "requests": 1 }, { "name": "Google Static", "company": "Google", "country": "US", "category": "Hosting", "requests": 4 }, { "name": "jsDelivr", "company": "jsDelivr", "category": "Hosting", "requests": 3 } ] }, "mixed_content": { "no_sri": [ "https://cdn.jsdelivr.net/npm/intl-tel-input@23.0.12/build/js/intlTelInput.min.js" ], "third_party_scripts": 1 }, "status": { "up": true, "code": 200, "timings": { "dns": 8, "tls": 29, "wait": 210, "connect": 7, "download": 9 }, "response_ms": 263 }, "tls_connection": { "alpn": "h2", "cipher": "TLS_AES_256_GCM_SHA384", "protocol": "TLSv1.3", "versions": [ "TLSv1", "TLSv1.1", "TLSv1.2", "TLSv1.3" ], "authorized": true, "forward_secrecy": true }, "ports": { "open": [ 80, 443, 8080 ] }, "carbon": { "bytes": 76417, "co2_grams": 0.0028, "cleaner_than": 28 }, "dns_server": { "ns": [ { "ip": "108.162.195.89", "host": "louis.ns.cloudflare.com" }, { "ip": "172.64.34.103", "host": "dayana.ns.cloudflare.com" } ], "zone": "glurvextopin-official.org" }, "cookies": { "cookies": [ { "name": "_subid", "session": true }, { "name": "csrftoken", "same_site": "Lax" } ] }, "location": { "ip": "2a06:98c1:3120::3", "asn": "13335", "org": "Cloudflare, Inc.", "city": "Washington", "country": "US" }, "ssl": { "issuer": "Google Trust Services / WE1", "subject": "glurvextopin-official.org" }, "dns": { "A": [ "188.114.96.3", "188.114.97.3" ], "NS": [ "dayana.ns.cloudflare.com", "louis.ns.cloudflare.com" ], "SOA": "{\"nsname\": \"dayana.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2417305491, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}", "AAAA": [ "2a06:98c1:3120::3", "2a06:98c1:3121::3" ] }, "dnssec": { "ds": false, "rrsig": false, "dnskey": false }, "hsts": { "message": "Site does not serve any HSTS headers." }, "http_security": { "xFrameOptions": "DENY", "referrerPolicy": "same-origin", "xXSSProtection": false, "permissionsPolicy": false, "xContentTypeOptions": "nosniff", "contentSecurityPolicy": false, "strictTransportPolicy": false, "crossOriginOpenerPolicy": "same-origin", "crossOriginEmbedderPolicy": false, "crossOriginResourcePolicy": false }, "firewall": { "waf": "Cloudflare", "has_waf": true }, "get_ip": { "ip": "2a06:98c1:3121::3", "family": 6 }, "redirects": { "chain": [ "https://glurvextopin-official.org" ] }, "linked_pages": { "internal_count": 9 }, "whois": { "registrar": "Dynadot Inc", "created": "2026-06-02T16:16:18Z", "updated": "2026-08-12T01:55:44Z", "expires": "2027-06-02T16:16:18Z", "status": [ "clientTransferProhibited https://icann.org/epp" ], "nameservers": [ "dayana.ns.cloudflare.com", "louis.ns.cloudflare.com" ] }, "headers": { "headers": { "server": "cloudflare", "content-type": "text/html; charset=utf-8", "x-frame-options": "DENY", "x-content-type-options": "nosniff", "referrer-policy": "same-origin", "cross-origin-opener-policy": "same-origin" } } } } ```