# PhishDestroy domain threat record: gpt-trade-global.com Content language: English Canonical HTML report: https://phishdestroy.io/domain/gpt-trade-global.com/ Machine-readable companion: https://phishdestroy.io/domain/gpt-trade-global.com/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: unknown - First observed by PhishDestroy: 2026-10-28 00:46:01 UTC - Stored record updated: 2026-10-28 01:13:09 UTC - VirusTotal detections in the stored snapshot: 18/92 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: no stored flag ## Stored infrastructure - Observed IP address: 104.21.32.13 - Registrar in stored WHOIS data: MainReg Inc. - Last stored HTTP status: 200 - Registration date in stored WHOIS data: 2026-03-08 06:56:02 UTC ## Evidence links - URLScan report: https://urlscan.io/result/019f88dd-0a73-733a-9282-5484d22bf06f/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/gpt-trade-global.com - Certificate Transparency search: https://crt.sh/?q=%25.gpt-trade-global.com - Web Archive lookup: https://web.archive.org/web/*/https://gpt-trade-global.com/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview PhishDestroy added gpt-trade-global.com to its internal blocklist on 2026-10-28 after the intake flagged the domain because VirusTotal returned fifteen malicious detections. The page that was fetched on that date returned HTTP 200 and carried the title “GPT Trade Global | Educational Resources on Financial Concepts,” indicating it claimed to be an educational resource on finance. The domain was first seen by PhishDestroy on 2026-10-28, 234 days after its registration on 2026-03-08. How the scam works No specific malicious behavior was observed on the captured page, but the presence of numerous malicious and phishing detections shows the domain could be leveraged for typical phishing or malware distribution tactics. Such schemes often present legitimate‑looking content to entice visitors, then attempt credential harvesting, drive‑by downloads, or redirection to fraudulent services. Without concrete evidence of a payload, the risk remains generic and warrants caution. Evidence VirusTotal analysis on 2026-10-21 (retrieved 2026-10-28) reported 15 malicious and 3 suspicious detections from 92 engines, totaling 18 flags. Google Safe Browsing checked on 2026-10-28 did not flag the domain. urlscan.io captured the site on 2026-07-22, gave an overall clean verdict but its engine scored it malicious with a 98‑point confidence tag. Cloudflare Radar scan on 2026-10-28 marked the domain malicious for malware. OTX listed one pulse referencing the domain on 2026-10-28. PhishDestroy’s internal blocklist contains the domain, while external blocklists showed zero hits at the time of checking. Infrastructure The domain was registered on 2026-03-08 through MainReg Inc. and resolved to Cloudflare‑served IP addresses 104.21.32.13 and 172.67.182.34. TLS was issued by Google Trust Services, valid from 2026-09-02 to 2026-12-01. DNSSEC was not enabled. Cloudflare’s location record indicated Toronto, Canada as the network location at the time of observation. What to do Treat the site as suspicious; avoid entering credentials, personal data, or downloading files. If any credentials were submitted, change them immediately and enable multi‑factor authentication. Security teams should block the exact domain, monitor outbound traffic for connections to its recorded IPs, and review logs for any access attempts. No wallet‑related actions are required because wallet recommendations are disabled. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/019f88dd-0a73-733a-9282-5484d22bf06f/ Cloudflare Radar report: https://radar.cloudflare.com/scan/9272dd13-c23f-4faf-867a-e1afa0084e83 Stored capture screenshot: https://urlscan.io/screenshots/019f88dd-0a73-733a-9282-5484d22bf06f.png Cloudflare Radar screenshot (2026-10-28T00:54:56Z): https://screenshots.phishdestroy.io/cf/9272dd13-c23f-4faf-867a-e1afa0084e83.png URLScan screenshot (2026-03-10T09:47:44Z): https://screenshots.phishdestroy.io/us/019cd725-1294-729f-bc1e-81078ee6a28e.png URLScan capture report: https://urlscan.io/result/019cd725-1294-729f-bc1e-81078ee6a28e/ URLScan screenshot (2026-03-10T09:54:46Z): https://screenshots.phishdestroy.io/us/019cd72b-82df-701c-8b16-4b69300822ca.png URLScan capture report: https://urlscan.io/result/019cd72b-82df-701c-8b16-4b69300822ca/ URLScan screenshot (2026-03-10T09:59:17Z): https://screenshots.phishdestroy.io/us/019cd72f-ac00-707e-bf67-1789fe42c161.png URLScan capture report: https://urlscan.io/result/019cd72f-ac00-707e-bf67-1789fe42c161/ URLScan screenshot (2026-05-08T08:48:47Z): https://screenshots.phishdestroy.io/us/019e06c6-52d1-7485-b0d4-9002b6f02906.png URLScan capture report: https://urlscan.io/result/019e06c6-52d1-7485-b0d4-9002b6f02906/ URLScan screenshot (2026-10-28T00:49:10Z): https://screenshots.phishdestroy.io/us/01a17ffb-526c-74c5-aaa4-4eec8b407bde.png URLScan capture report: https://urlscan.io/result/01a17ffb-526c-74c5-aaa4-4eec8b407bde/ URLScan screenshot (2026-10-28T00:55:00Z): https://screenshots.phishdestroy.io/us/01a17fff-7fdb-77c7-b272-274bc0583468.png URLScan capture report: https://urlscan.io/result/01a17fff-7fdb-77c7-b272-274bc0583468/ VirusTotal report: https://www.virustotal.com/gui/domain/gpt-trade-global.com Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=gpt-trade-global.com Archived copy: https://web.archive.org/web/20261028004722/https://gpt-trade-global.com/ Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-28 00:56:23 UTC ## Stored page captures - Primary capture: https://urlscan.io/screenshots/019f88dd-0a73-733a-9282-5484d22bf06f.png Captured: 2026-10-28 00:46:01 UTC - URLScan capture 1: https://screenshots.phishdestroy.io/019f88dd-0a73-733a-9282-5484d22bf06f.png Source report: https://urlscan.io/result/019f88dd-0a73-733a-9282-5484d22bf06f/ - URLScan · 2026-03-10: https://screenshots.phishdestroy.io/us/019cd725-1294-729f-bc1e-81078ee6a28e.png Captured: 2026-03-10 09:47:44 UTC Source report: https://urlscan.io/result/019cd725-1294-729f-bc1e-81078ee6a28e/ SHA-256: 366c3a19383637aa8aa29332e814b3d0d68eb8bfb775597973a40e249a16dbd8 - URLScan · 2026-03-10: https://screenshots.phishdestroy.io/us/019cd72b-82df-701c-8b16-4b69300822ca.png Captured: 2026-03-10 09:54:46 UTC Source report: https://urlscan.io/result/019cd72b-82df-701c-8b16-4b69300822ca/ SHA-256: 366c3a19383637aa8aa29332e814b3d0d68eb8bfb775597973a40e249a16dbd8 - URLScan · 2026-03-10: https://screenshots.phishdestroy.io/us/019cd72f-ac00-707e-bf67-1789fe42c161.png Captured: 2026-03-10 09:59:17 UTC Source report: https://urlscan.io/result/019cd72f-ac00-707e-bf67-1789fe42c161/ SHA-256: 366c3a19383637aa8aa29332e814b3d0d68eb8bfb775597973a40e249a16dbd8 - URLScan · 2026-05-08: https://screenshots.phishdestroy.io/us/019e06c6-52d1-7485-b0d4-9002b6f02906.png Captured: 2026-05-08 08:48:47 UTC Source report: https://urlscan.io/result/019e06c6-52d1-7485-b0d4-9002b6f02906/ SHA-256: 366c3a19383637aa8aa29332e814b3d0d68eb8bfb775597973a40e249a16dbd8 - URLScan · 2026-10-28: https://screenshots.phishdestroy.io/us/01a17ffb-526c-74c5-aaa4-4eec8b407bde.png Captured: 2026-10-28 00:49:10 UTC Source report: https://urlscan.io/result/01a17ffb-526c-74c5-aaa4-4eec8b407bde/ SHA-256: 843aa87a46a74d9839c0b050e45937ed75a91f217b9ae919036635146335c619 - URLScan · 2026-10-28: https://screenshots.phishdestroy.io/us/01a17fff-7fdb-77c7-b272-274bc0583468.png Captured: 2026-10-28 00:55:00 UTC Source report: https://urlscan.io/result/01a17fff-7fdb-77c7-b272-274bc0583468/ SHA-256: b6313f423bdb929d21b54069bb79044bc1bb6a2b8cd048c89eec7674d0949a3e - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/9272dd13-c23f-4faf-867a-e1afa0084e83.png Captured: 2026-10-28 00:54:56 UTC Source report: https://radar.cloudflare.com/scan/9272dd13-c23f-4faf-867a-e1afa0084e83 SHA-256: 647468f3655b631d58598e1ac05a033b872764176fe8f350093459bdf1b1214b ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-28T00:55:20Z", "uuid": "019f88dd-0a73-733a-9282-5484d22bf06f", "scanned_at": "2026-07-22T08:07:01Z", "final_url": "https://gpt-trade-global.com/", "status": 200, "redirected": "https-only", "redirects": [ { "to": "https://gpt-trade-global.com/", "from": "http://gpt-trade-global.com/", "status": 307 } ], "ip": "172.67.182.34", "domains": [ "cdnjs.cloudflare.com", "cdn.jsdelivr.net", "fonts.googleapis.com", "static.cloudflare.com" ], "ips": [ "104.17.207.5", "192.178.170.95", "104.17.24.14", "172.67.182.34" ], "asns": [ "13335", "15169" ], "countries": [ "US" ], "doc_hash": "a25549c323629023e55b212960d4c22c3dfede87c90bbe686f0682e42521a54b", "script_hashes": [ "ccf00d1923b0131a10e0c6d26f95e5dee6ebf8621a27e83c5a2f68a2e0093142" ], "globals": [ "LANG_MSGS", "ClientJS", "_b1g1ps2", "toggleTermsPopup", "__cfQR", "__cfRLUnblockHandlers", "__lgT0" ], "cookies": [ "entry_url" ], "tls": { "san": [ "gpt-trade-global.com" ], "cipher": "AES_128_GCM", "issuer": "WE1", "subject": "gpt-trade-global.com", "protocol": "QUIC", "valid_to": "2026-10-03T12:54:13Z", "valid_from": "2026-07-05T11:54:18Z" }, "domain_age_days": 135, "apex_age_days": 135, "tls_age_days": 16, "tls_valid_days": 90, "requests": 17, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 98, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "cloudflare", "content-type": "text/html; charset=utf-8", "strict-transport-security": "max-age=63072000; includeSubDomains; preload", "content-security-policy": "script-src 'self' 'unsafe-inline' 'unsafe-eval' https://static.cloudflare.com https://cdn.jsdelivr.net; font-src 'self' https://fonts.gstatic.com https://cdnjs.cloudflare.com; style-src 'self' 'unsafe", "x-frame-options": "SAMEORIGIN", "x-content-type-options": "nosniff", "referrer-policy": "strict-origin", "permissions-policy": "camera=(), microphone=(), geolocation=()", "cross-origin-opener-policy": "same-origin" } }, "cf": { "v": 1, "fetched_at": "2026-10-28T00:55:23Z", "uuid": "9272dd13-c23f-4faf-867a-e1afa0084e83", "scanned_at": "2026-10-28T00:54:56Z", "final_url": "https://gpt-trade-global.com/", "status": 200, "history": [ { "url": "https://gpt-trade-global.com/", "status": 200 } ], "dom_hash": "a8558412ed9a4392b45cd9115d81b56bd41d6a004393f0422fb414a80691e081", "doc_hash": "b3a2d8433135164da7bf8501a151ca0c9f1d9abdaafb250c8149ff509cbead9f", "phishing_v2": [ "phishing" ], "domain_risks": [ "Malware", "Security threats", "CIPA Filter", "CIPA" ], "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "gpt-trade-global.com", "type": "A", "value": "172.67.182.34" }, { "name": "gpt-trade-global.com", "type": "A", "value": "104.21.32.13" }, { "name": "gpt-trade-global.com", "type": "AAAA", "value": "2606:4700:3037::6815:200d" }, { "name": "gpt-trade-global.com", "type": "AAAA", "value": "2606:4700:3033::ac43:b622" } ], "dnssec_valid": false, "ip": "127.0.1.1", "verdict": { "tags": [ "malware" ], "malicious": true, "categories": [ "malware" ] }, "whois": { "registrar": "MainReg Inc.", "created": "2026-03-08T07:56:02Z", "updated": "2026-03-08T11:20:03Z", "expires": "2027-03-08T07:56:02Z", "nameservers": [ "tricia.ns.cloudflare.com", "zahir.ns.cloudflare.com" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-28T00:53:56Z", "analysis_at": "2026-10-21T13:56:47Z", "stats": { "timeout": 0, "harmless": 42, "malicious": 15, "suspicious": 3, "undetected": 32 }, "detections": { "CRDF": "malicious", "DNS8": "suspicious", "ESET": "suspicious", "VIPRE": "malware", "G-Data": "phishing", "Lionic": "phishing", "Sophos": "phishing", "CyRadar": "phishing", "Webroot": "malicious", "Fortinet": "phishing", "SOCRadar": "phishing", "Kaspersky": "phishing", "Seclookup": "malicious", "Gridinsoft": "suspicious", "BitDefender": "phishing", "Chong Lua Dao": "malicious", "alphaMountain.ai": "phishing", "Forcepoint ThreatSeeker": "phishing" }, "reputation": 0, "created": "2026-03-08T00:00:00Z", "updated": "2026-03-08T00:00:00Z", "first_seen": "2026-03-08T11:38:26Z", "dns": [ { "ttl": 300, "type": "AAAA", "value": "2606:4700:3037::6815:200d" }, { "ttl": 300, "type": "A", "value": "172.67.182.34" }, { "ttl": 21600, "type": "NS", "value": "zahir.ns.cloudflare.com" }, { "ttl": 300, "type": "TXT", "value": "v=spf1 ip4:46.166.131.92 ~all" }, { "ttl": 300, "type": "A", "value": "104.21.32.13" }, { "ttl": 300, "type": "TXT", "value": "google-site-verification=y_yIPRc3z6ZPxuOoaF4HzRsHefqleNzalq9jPfL9mk4" }, { "ttl": 300, "type": "MX", "value": "mail.gpt-trade-global.com", "priority": 10 }, { "ttl": 21600, "type": "NS", "value": "tricia.ns.cloudflare.com" }, { "ttl": 1800, "type": "SOA", "rname": "dns.cloudflare.com", "value": "tricia.ns.cloudflare.com" }, { "ttl": 300, "type": "AAAA", "value": "2606:4700:3033::ac43:b622" } ], "dns_at": "2026-10-21T14:02:35Z", "jarm": "27d40d40d00040d00042d43d00041df04c41293ba84f6efe3a613b22f983e6", "cert": { "san": [ "gpt-trade-global.com" ], "issuer": "Google Trust Services / WE1", "serial": "88a4c3e3c985f8bb13a2c3fbfa9d1c5b", "sha256": "3649f5514555a67a9e2f74fd0f7b26a04ee4cffb5b6f6ff0450360f15756c83e", "subject": "gpt-trade-global.com", "valid_to": "2026-12-01T13:31:33Z", "valid_from": "2026-09-02T12:31:38Z" }, "whois": [], "rdap": { "status": [ "active" ], "events": { "last changed": "2026-03-08T00:00:00Z", "registration": "2026-03-08T00:00:00Z", "registrar expiration": "2027-03-08T00:00:00Z", "last update of RDAP database": "2026-10-18T13:46:00Z" }, "registrar": "MainReg Inc.", "registrar_iana_id": "1917" } }, "webcheck": { "v": 1, "fetched_at": "2026-10-28T00:55:43Z", "mail_config": { "mx": [ "mail.gpt-trade-global.com" ], "spf": "v=spf1 ip4:46.166.131.92 ~all", "spf_lookups": 0 }, "caa_records": { "domain": "gpt-trade-global.com" }, "block_lists": { "resolvers": 12, "blocked_by": [ "CloudFlare Family" ], "blocked_count": 1 }, "archives": { "last": "2026-10-28T00:47:22Z", "first": "2026-10-17T10:37:24Z", "changes": 1, "days_archived": 2, "scans_per_day": 0.09, "avg_page_bytes": 41878 }, "robots_txt": { "agents": [ "*", "Amazonbot", "Applebot-Extended", "Bytespider", "CCBot" ], "present": true, "sitemaps": [ "https://gpt-trade-global.com/sitemap.xml" ] }, "sitemap": { "present": true, "url_count": 175 }, "social_tags": { "ogUrl": "https://gpt-trade-global.com/", "title": "GPT Trade Global | Educational Resources on Financial Concepts", "ogType": "website", "robots": "index, follow", "ogTitle": "GPT Trade Global Market Education", "ogSiteName": "GPT Trade Global", "themeColor": "#0f1114", "description": "GPT Trade Global presents informational resources on financial concepts, connecting learners with independent third-party educational providers for Stocks, Commodities, and Forex knowledge.", "twitterCard": "summary", "canonicalUrl": "https://gpt-trade-global.com/", "ogDescription": "GPT Trade Global provides informational resources on stocks, commodities, and forex through independent educational providers, emphasizing awareness and understanding." }, "trackers": { "requests": 18, "trackers": [ { "name": "Cloudflare", "company": "Cloudflare", "country": "US", "category": "Hosting", "requests": 8 }, { "name": "Google Fonts", "company": "Google", "country": "US", "category": "Hosting", "requests": 1 }, { "name": "jsDelivr", "company": "jsDelivr", "category": "Hosting", "requests": 1 } ] }, "mixed_content": { "no_sri": [ "https://static.cloudflare.com/beacon.min.js", "https://challenges.cloudflare.com/turnstile/v0/api.js", "https://cdn.jsdelivr.net/npm/clientjs@0.2.1/dist/client.min.js" ], "third_party_scripts": 3 }, "status": { "up": true, "code": 200, "timings": { "dns": 3, "tls": 17, "wait": 234, "connect": 6, "download": 20 }, "response_ms": 280 }, "tls_connection": { "alpn": "h2", "cipher": "TLS_AES_256_GCM_SHA384", "protocol": "TLSv1.3", "versions": [ "TLSv1.2", "TLSv1.3" ], "authorized": true, "forward_secrecy": true }, "ports": { "open": [ 80, 443, 8080 ] }, "carbon": { "bytes": 144785, "co2_grams": 0.0053, "cleaner_than": 14 }, "dns_server": { "ns": [ { "ip": "108.162.195.145", "host": "zahir.ns.cloudflare.com" }, { "ip": "173.245.58.232", "host": "tricia.ns.cloudflare.com" } ], "zone": "gpt-trade-global.com" }, "cookies": { "cookies": [ { "name": "entry_url", "secure": true, "same_site": "Lax" } ] }, "location": { "ip": "2606:4700:3033::ac43:b622", "asn": "13335", "org": "Cloudflare, Inc.", "city": "Toronto", "country": "CA" }, "ssl": { "issuer": "Google Trust Services / WE1", "subject": "gpt-trade-global.com" }, "dns": { "A": [ "172.67.182.34", "104.21.32.13" ], "MX": [ "{\"exchange\": \"mail.gpt-trade-global.com\", \"priority\": 10}" ], "NS": [ "zahir.ns.cloudflare.com", "tricia.ns.cloudflare.com" ], "SOA": "{\"nsname\": \"tricia.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2418083722, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}", "TXT": [ "v=spf1 ip4:46.166.131.92 ~all", "google-site-verification=y_yIPRc3z6ZPxuOoaF4HzRsHefqleNzalq9jPfL9mk4" ], "AAAA": [ "2606:4700:3037::6815:200d", "2606:4700:3033::ac43:b622" ] }, "dnssec": { "ds": false, "rrsig": false, "dnskey": false }, "hsts": { "header": "max-age=15552000; includeSubDomains; preload", "message": "HSTS max-age is 15552000, below the 31536000 minimum." }, "http_security": { "xFrameOptions": "SAMEORIGIN", "referrerPolicy": "strict-origin", "xXSSProtection": false, "permissionsPolicy": "camera=(), microphone=(), geolocation=()", "xContentTypeOptions": "nosniff", "contentSecurityPolicy": "img-src 'self' data: blob:; font-src 'self' https://fonts.gstatic.com https://cdnjs.cloudflare.com; frame-src https://ch", "strictTransportPolicy": "max-age=15552000; includeSubDomains; preload", "crossOriginOpenerPolicy": "same-origin", "crossOriginEmbedderPolicy": false, "crossOriginResourcePolicy": false }, "firewall": { "waf": "Cloudflare", "has_waf": true }, "get_ip": { "ip": "2606:4700:3033::ac43:b622", "family": 6 }, "redirects": { "chain": [ "https://gpt-trade-global.com" ] }, "tech_stack": { "technologies": [ "jsDelivr", "Cloudflare Turnstile", "Cloudflare Rocket Loader", "ClientJS", "Priority Hints", "Google Font API", "Font Awesome", "cdnjs", "HSTS", "Cloudflare", "Open Graph", "HTTP/3" ] }, "linked_pages": { "internal_count": 46 }, "whois": { "registrar": "MainReg Inc.", "created": "2026-03-08T07:56:02Z", "updated": "2026-03-08T11:20:03Z", "expires": "2027-03-08T07:56:02Z", "status": [ "ok https://icann.org/epp" ], "nameservers": [ "tricia.ns.cloudflare.com", "zahir.ns.cloudflare.com" ] }, "headers": { "headers": { "server": "cloudflare", "content-type": "text/html; charset=utf-8", "strict-transport-security": "max-age=15552000; includeSubDomains; preload", "content-security-policy": "img-src 'self' data: blob:; font-src 'self' https://fonts.gstatic.com https://cdnjs.cloudflare.com; frame-src https://challenges.cloudflare.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://cdnjs.cloudflare.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://static.", "x-frame-options": "SAMEORIGIN", "x-content-type-options": "nosniff", "referrer-policy": "strict-origin", "permissions-policy": "camera=(), microphone=(), geolocation=()", "cross-origin-opener-policy": "same-origin" } } } } ```