# PhishDestroy domain threat record: gpt30mentax.digital

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/gpt30mentax.digital/
Machine-readable companion: https://phishdestroy.io/domain/gpt30mentax.digital/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: unknown
- First observed by PhishDestroy: 2026-10-27 23:37:11 UTC
- Stored record updated: 2026-10-28 00:04:10 UTC
- VirusTotal detections in the stored snapshot: 19/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored infrastructure

- Observed IP address: 104.21.24.3
- Registrar in stored WHOIS data: Dynadot Inc
- Last stored HTTP status: 200
- Registration date in stored WHOIS data: 2026-04-27 11:55:48 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/019f88dd-0e12-7059-921b-f70ccbbfd67e/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/gpt30mentax.digital
- Certificate Transparency search: https://crt.sh/?q=%25.gpt30mentax.digital
- Web Archive lookup: https://web.archive.org/web/*/https://gpt30mentax.digital/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
PhishDestroy listed gpt30mentax.digital as a suspicious domain based on automated analysis of its content and reputation signals. The recorded page title is “Gpt 30 mentax | AI Trading Platform | Official Website” and the HTTP response was 200 on 2026-10-28. PhishDestroy first observed the domain on 2026-10-28, 184 days after its registration on 2026-04-27.

How the scam works
The detections linked to this domain match patterns commonly used by phishing or malware sites, such as deceptive branding and loading of third‑party scripts that could harvest credentials or deliver malicious payloads. No concrete malicious behavior was captured in the page snapshot, so the listing reflects risk indicated by external scanners rather than a confirmed attack vector.

Evidence
VirusTotal reported 19 detections from 92 engines on 2026-10-28, with 16 classified as malicious and 3 as suspicious; vendors include BitDefender, ESET, AlphaMountain.ai and others. Google Safe Browsing checked the URL on 2026-10-28 and reported no threat. urlscan.io captured the page on 2026-07-22, assigning a machine‑learning malicious score of 97 but an overall non‑malicious verdict. Cloudflare Radar scanned the domain on 2026-10-28 and flagged it as phishing and malware. OTX listed one pulse referencing the domain on 2026-10-28. No external blocklists reported the domain, while PhishDestroy’s internal list marked it as blocked on 2026-10-27.

Infrastructure
The domain was registered on 2026-04-27 through Dynadot Inc. DNS resolution returned Cloudflare IP addresses 172.67.214.193 and 104.21.24.3 (and corresponding IPv6 addresses). The TLS certificate observed on 2026-10-22 was issued by Google Trust Services, valid until 2027-01-20, and the site was served behind Cloudflare’s WAF with HSTS enabled. ASN 13335 (Cloudflare) and ASN 15169 (Google) are present, and DNSSEC was not enabled.

What to do
Do not submit login credentials, personal data, or download files from this site; if you have already done so, change any associated passwords and monitor accounts for unauthorized activity. Organizations should block gpt30mentax.digital at firewalls or proxies and review logs for connections to its IP addresses. No wallet‑related remediation is required because wallet recommendations are disabled.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/019f88dd-0e12-7059-921b-f70ccbbfd67e/
Cloudflare Radar report: https://radar.cloudflare.com/scan/356e96d6-2f7e-48e1-923c-6ac9866d7e38
Stored capture screenshot: https://urlscan.io/screenshots/019f88dd-0e12-7059-921b-f70ccbbfd67e.png
Cloudflare Radar screenshot (2026-10-27T23:42:36Z): https://screenshots.phishdestroy.io/cf/356e96d6-2f7e-48e1-923c-6ac9866d7e38.png
URLScan screenshot (2026-04-29T10:23:09Z): https://screenshots.phishdestroy.io/us/019dd8c3-7c75-72cf-86a0-b0253d9036aa.png
URLScan capture report: https://urlscan.io/result/019dd8c3-7c75-72cf-86a0-b0253d9036aa/
URLScan screenshot (2026-07-21T11:30:39Z): https://screenshots.phishdestroy.io/us/019f8471-1dc5-75ce-b74b-a739766cf55d.png
URLScan capture report: https://urlscan.io/result/019f8471-1dc5-75ce-b74b-a739766cf55d/
URLScan screenshot (2026-07-22T01:23:32Z): https://screenshots.phishdestroy.io/us/019f876b-958d-716b-8c64-36bb0fb2e4b2.png
URLScan capture report: https://urlscan.io/result/019f876b-958d-716b-8c64-36bb0fb2e4b2/
URLScan screenshot (2026-10-27T23:47:12Z): https://screenshots.phishdestroy.io/us/01a17fc2-9482-76ab-97f2-93b2004b0602.png
URLScan capture report: https://urlscan.io/result/01a17fc2-9482-76ab-97f2-93b2004b0602/
VirusTotal report: https://www.virustotal.com/gui/domain/gpt30mentax.digital
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=gpt30mentax.digital
Archived copy: https://web.archive.org/web/20261027233844/https://gpt30mentax.digital/
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-27 23:48:36 UTC

## Stored page captures

- Primary capture: https://urlscan.io/screenshots/019f88dd-0e12-7059-921b-f70ccbbfd67e.png
  Captured: 2026-10-27 23:37:11 UTC
- URLScan capture 1: https://screenshots.phishdestroy.io/019f88dd-0e12-7059-921b-f70ccbbfd67e.png
  Source report: https://urlscan.io/result/019f88dd-0e12-7059-921b-f70ccbbfd67e/
- URLScan · 2026-04-29: https://screenshots.phishdestroy.io/us/019dd8c3-7c75-72cf-86a0-b0253d9036aa.png
  Captured: 2026-04-29 10:23:09 UTC
  Source report: https://urlscan.io/result/019dd8c3-7c75-72cf-86a0-b0253d9036aa/
  SHA-256: 9cd0635bb0ef1179bfaff2785d5d32bbf5a80eb48f7c051293790b4fc77d69b3
- URLScan · 2026-07-21: https://screenshots.phishdestroy.io/us/019f8471-1dc5-75ce-b74b-a739766cf55d.png
  Captured: 2026-07-21 11:30:39 UTC
  Source report: https://urlscan.io/result/019f8471-1dc5-75ce-b74b-a739766cf55d/
  SHA-256: 7079014282413929f1692b1745991bcac33db02c450452d4d157ab280a1391ad
- URLScan · 2026-07-22: https://screenshots.phishdestroy.io/us/019f876b-958d-716b-8c64-36bb0fb2e4b2.png
  Captured: 2026-07-22 01:23:32 UTC
  Source report: https://urlscan.io/result/019f876b-958d-716b-8c64-36bb0fb2e4b2/
  SHA-256: 3d6a285c89956282f50e861a6cc143cb6d80fc48a50676173ae75cc844d7de0b
- URLScan · 2026-10-27: https://screenshots.phishdestroy.io/us/01a17fc2-9482-76ab-97f2-93b2004b0602.png
  Captured: 2026-10-27 23:47:12 UTC
  Source report: https://urlscan.io/result/01a17fc2-9482-76ab-97f2-93b2004b0602/
  SHA-256: 7b9d629b48cacaacec4595594550f20a4d22d3f81421bf993371c8c492604410
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/356e96d6-2f7e-48e1-923c-6ac9866d7e38.png
  Captured: 2026-10-27 23:42:36 UTC
  Source report: https://radar.cloudflare.com/scan/356e96d6-2f7e-48e1-923c-6ac9866d7e38
  SHA-256: 4ba9a180f4218dc54b0511691063ba86ddf01bd44f30f764246e5db7c6226847

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-27T23:47:26Z",
        "uuid": "019f88dd-0e12-7059-921b-f70ccbbfd67e",
        "scanned_at": "2026-07-22T08:07:01Z",
        "final_url": "https://gpt30mentax.digital/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://gpt30mentax.digital/",
                "from": "http://gpt30mentax.digital/",
                "status": 307
            }
        ],
        "ip": "172.67.214.193",
        "domains": [
            "cdnjs.cloudflare.com",
            "cdn.jsdelivr.net",
            "fonts.googleapis.com",
            "static.cloudflare.com"
        ],
        "ips": [
            "2606:4700::6811:d005",
            "2a00:1450:400a:1009::5f",
            "104.17.25.14",
            "172.67.214.193"
        ],
        "asns": [
            "13335",
            "15169"
        ],
        "countries": [
            "CH"
        ],
        "doc_hash": "4e2b46ff30d36323e7e190002e8563406afb3b1a06c4bab39acde38a57d789e4",
        "script_hashes": [
            "ccf00d1923b0131a10e0c6d26f95e5dee6ebf8621a27e83c5a2f68a2e0093142"
        ],
        "globals": [
            "LANG_MSGS",
            "ClientJS",
            "_xpg9b2an",
            "toggleTermsPopup",
            "__cfQR",
            "__cfRLUnblockHandlers",
            "__lgT0"
        ],
        "cookies": [
            "entry_url"
        ],
        "tls": {
            "san": [
                "gpt30mentax.digital"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "WE1",
            "subject": "gpt30mentax.digital",
            "protocol": "QUIC",
            "valid_to": "2026-09-23T18:59:13Z",
            "valid_from": "2026-06-25T17:59:39Z"
        },
        "domain_age_days": 85,
        "apex_age_days": 85,
        "tls_age_days": 26,
        "tls_valid_days": 90,
        "requests": 17,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 97,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "cloudflare",
            "content-type": "text/html; charset=utf-8",
            "strict-transport-security": "max-age=15552000; includeSubDomains; preload",
            "content-security-policy": "default-src 'self'; frame-ancestors 'self'; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://cdnjs.cloudflare.com; font-src 'self' https://fonts.gstatic.com https://cdnjs.cloudfla",
            "x-frame-options": "SAMEORIGIN",
            "x-content-type-options": "nosniff",
            "referrer-policy": "strict-origin",
            "permissions-policy": "camera=(), microphone=(), geolocation=()",
            "cross-origin-opener-policy": "same-origin"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-27T23:47:30Z",
        "uuid": "356e96d6-2f7e-48e1-923c-6ac9866d7e38",
        "scanned_at": "2026-10-27T23:42:36Z",
        "final_url": "https://gpt30mentax.digital/",
        "status": 200,
        "history": [
            {
                "url": "https://gpt30mentax.digital/",
                "status": 200
            }
        ],
        "dom_hash": "ad31b812478496fe2e4e6ee1edd5e3e521cead0a4a6e18dd2b07c29fadf3301e",
        "doc_hash": "b5ad4f14ba315e4ea38f3d24acdf4b70978234f810f2fdb7d4b65fd7df3ce574",
        "phishing_v2": [
            "phishing"
        ],
        "domain_risks": [
            "Malware",
            "Security threats",
            "CIPA Filter",
            "CIPA"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "gpt30mentax.digital",
                "type": "A",
                "value": "104.21.24.3"
            },
            {
                "name": "gpt30mentax.digital",
                "type": "A",
                "value": "172.67.214.193"
            },
            {
                "name": "gpt30mentax.digital",
                "type": "AAAA",
                "value": "2606:4700:3035::6815:1803"
            },
            {
                "name": "gpt30mentax.digital",
                "type": "AAAA",
                "value": "2606:4700:3032::ac43:d6c1"
            }
        ],
        "dnssec_valid": false,
        "ip": "127.0.1.12",
        "verdict": {
            "tags": [
                "malware"
            ],
            "malicious": true,
            "categories": [
                "malware"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-27T23:41:00Z",
        "analysis_at": "2026-10-25T00:27:59Z",
        "stats": {
            "timeout": 0,
            "harmless": 42,
            "malicious": 16,
            "suspicious": 3,
            "undetected": 31
        },
        "detections": {
            "CRDF": "malicious",
            "DNS8": "suspicious",
            "ESET": "suspicious",
            "VIPRE": "phishing",
            "G-Data": "phishing",
            "Lionic": "phishing",
            "Sophos": "phishing",
            "CyRadar": "phishing",
            "Webroot": "malicious",
            "Fortinet": "phishing",
            "SOCRadar": "phishing",
            "Kaspersky": "phishing",
            "Seclookup": "malicious",
            "Gridinsoft": "suspicious",
            "BitDefender": "phishing",
            "Chong Lua Dao": "malicious",
            "alphaMountain.ai": "phishing",
            "Bfore.Ai PreCrime": "malicious",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "tags": [
            "dga"
        ],
        "created": "2026-04-27T00:00:00Z",
        "updated": "2026-04-27T00:00:00Z",
        "first_seen": "2026-04-27T14:54:23Z",
        "dns": [
            {
                "ttl": 21600,
                "type": "NS",
                "value": "cash.ns.cloudflare.com"
            },
            {
                "ttl": 1800,
                "type": "SOA",
                "rname": "dns.cloudflare.com",
                "value": "cash.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "172.67.214.193"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3035::6815:1803"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "liv.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "104.21.24.3"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3032::ac43:d6c1"
            }
        ],
        "dns_at": "2026-10-25T00:36:13Z",
        "jarm": "27d40d40d00040d00042d43d00041df04c41293ba84f6efe3a613b22f983e6",
        "cert": {
            "san": [
                "gpt30mentax.digital"
            ],
            "issuer": "Google Trust Services / WE1",
            "serial": "99f00d11d388fb04136230995c01abaa",
            "sha256": "90aa76e7aaaf90d5f57b63aeb3c12433b8fd2a9c425e9fb14ec3f99b47df324c",
            "subject": "gpt30mentax.digital",
            "valid_to": "2027-01-20T02:17:50Z",
            "valid_from": "2026-10-22T01:17:52Z"
        },
        "whois": [],
        "rdap": {
            "status": [
                "transfer prohibited"
            ],
            "events": {
                "expiration": "2027-04-27T13:55:48Z",
                "last changed": "2026-04-27T14:03:57Z",
                "registration": "2026-04-27T13:55:48Z",
                "registrar expiration": "2027-04-27T13:55:48Z",
                "last update of RDAP database": "2026-10-16T07:02:18Z"
            },
            "registrar": "DYNADOT LLC",
            "registrar_iana_id": "472"
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-27T23:48:05Z",
        "mail_config": {
            "spf_lookups": 0
        },
        "caa_records": {
            "domain": "gpt30mentax.digital"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_by": [
                "CloudFlare Family"
            ],
            "blocked_count": 1
        },
        "archives": {
            "last": "2026-10-27T23:38:44Z",
            "first": "2026-10-12T09:48:57Z",
            "changes": 1,
            "days_archived": 2,
            "scans_per_day": 0.06,
            "avg_page_bytes": 41676
        },
        "robots_txt": {
            "agents": [
                "*",
                "Amazonbot",
                "Applebot-Extended",
                "Bytespider",
                "CCBot"
            ],
            "present": true,
            "sitemaps": [
                "https://gpt30mentax.digital/sitemap.xml"
            ]
        },
        "sitemap": {
            "present": true,
            "url_count": 140
        },
        "social_tags": {
            "title": "Gpt 30 mentax | AI Trading Platform | Official Website",
            "robots": "index, follow",
            "themeColor": "#0f0f1a",
            "description": "Gpt 30 mentax delivers a premium snapshot of automated trading bots and AI-driven trading support, emphasizing streamlined workflows, decisive controls, and seamless operation...",
            "canonicalUrl": "https://gpt30mentax.digital/"
        },
        "trackers": {
            "requests": 19,
            "trackers": [
                {
                    "name": "Cloudflare",
                    "company": "Cloudflare",
                    "country": "US",
                    "category": "Hosting",
                    "requests": 9
                },
                {
                    "name": "Google Fonts",
                    "company": "Google",
                    "country": "US",
                    "category": "Hosting",
                    "requests": 1
                },
                {
                    "name": "jsDelivr",
                    "company": "jsDelivr",
                    "category": "Hosting",
                    "requests": 1
                }
            ]
        },
        "mixed_content": {
            "no_sri": [
                "https://static.cloudflare.com/beacon.min.js",
                "https://challenges.cloudflare.com/turnstile/v0/api.js",
                "https://cdn.jsdelivr.net/npm/clientjs@0.2.1/dist/client.min.js"
            ],
            "third_party_scripts": 3
        },
        "status": {
            "up": true,
            "code": 200,
            "timings": {
                "dns": 14,
                "tls": 51,
                "wait": 154,
                "connect": 54,
                "download": 41
            },
            "response_ms": 314
        },
        "tls_connection": {
            "alpn": "h2",
            "cipher": "TLS_AES_256_GCM_SHA384",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                80,
                443,
                8080
            ]
        },
        "carbon": {
            "bytes": 141662,
            "co2_grams": 0.0052,
            "cleaner_than": 14
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "108.162.192.188",
                    "host": "liv.ns.cloudflare.com"
                },
                {
                    "ip": "173.245.59.81",
                    "host": "cash.ns.cloudflare.com"
                }
            ],
            "zone": "gpt30mentax.digital"
        },
        "location": {
            "ip": "2606:4700:3035::6815:1803",
            "asn": "13335",
            "org": "Cloudflare, Inc.",
            "city": "Toronto",
            "country": "CA"
        },
        "ssl": {
            "issuer": "Google Trust Services / WE1",
            "subject": "gpt30mentax.digital"
        },
        "dns": {
            "A": [
                "172.67.214.193",
                "104.21.24.3"
            ],
            "NS": [
                "cash.ns.cloudflare.com",
                "liv.ns.cloudflare.com"
            ],
            "SOA": "{\"nsname\": \"cash.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2418158337, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}",
            "AAAA": [
                "2606:4700:3035::6815:1803",
                "2606:4700:3032::ac43:d6c1"
            ]
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "hsts": {
            "header": "max-age=15552000; includeSubDomains; preload",
            "message": "HSTS max-age is 15552000, below the 31536000 minimum."
        },
        "http_security": {
            "xFrameOptions": "SAMEORIGIN",
            "referrerPolicy": "strict-origin",
            "xXSSProtection": false,
            "permissionsPolicy": "camera=(), microphone=(), geolocation=()",
            "xContentTypeOptions": "nosniff",
            "contentSecurityPolicy": "default-src 'self'; frame-src https://challenges.cloudflare.com; frame-ancestors 'self'; font-src 'self' https://fonts.g",
            "strictTransportPolicy": "max-age=15552000; includeSubDomains; preload",
            "crossOriginOpenerPolicy": "same-origin",
            "crossOriginEmbedderPolicy": false,
            "crossOriginResourcePolicy": false
        },
        "firewall": {
            "waf": "Cloudflare",
            "has_waf": true
        },
        "get_ip": {
            "ip": "2606:4700:3032::ac43:d6c1",
            "family": 6
        },
        "redirects": {
            "chain": [
                "https://gpt30mentax.digital"
            ]
        },
        "linked_pages": {
            "internal_count": 12
        },
        "headers": {
            "headers": {
                "server": "cloudflare",
                "content-type": "text/html; charset=utf-8",
                "strict-transport-security": "max-age=15552000; includeSubDomains; preload",
                "content-security-policy": "default-src 'self'; frame-src https://challenges.cloudflare.com; frame-ancestors 'self'; font-src 'self' https://fonts.gstatic.com https://cdnjs.cloudflare.com; img-src 'self' data: blob:; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://cdnjs.cloudflare.com; script-src 'self' '",
                "x-frame-options": "SAMEORIGIN",
                "x-content-type-options": "nosniff",
                "referrer-policy": "strict-origin",
                "permissions-policy": "camera=(), microphone=(), geolocation=()",
                "cross-origin-opener-policy": "same-origin"
            }
        }
    }
}
```