# PhishDestroy domain threat record: greymont-evobit.digital

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/greymont-evobit.digital/
Machine-readable companion: https://phishdestroy.io/domain/greymont-evobit.digital/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: unknown
- First observed by PhishDestroy: 2026-10-27 23:38:43 UTC
- Stored record updated: 2026-10-28 00:15:28 UTC
- VirusTotal detections in the stored snapshot: 18/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored infrastructure

- Observed IP address: 185.62.58.129
- Registrar in stored WHOIS data: NICENIC INTERNATIONAL GROUP CO., LIMITED
- Last stored HTTP status: 200
- Registration date in stored WHOIS data: 2026-03-12 17:51:54 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/019cec4c-c9bc-731e-a78c-b47c88e3d991/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/greymont-evobit.digital
- Certificate Transparency search: https://crt.sh/?q=%25.greymont-evobit.digital
- Web Archive lookup: https://web.archive.org/web/*/https://greymont-evobit.digital/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
PhishDestroy listed greymont-evobit.digital as a suspicious domain. The recorded page title was “Greymont Evobit | AI Trading Automation Platform”. PhishDestroy first observed the domain on 2026-10-28 and recorded an HTTP 200 response on that date.

How the scam works
The detections associated with this domain do not identify a specific fraud technique; they only indicate that the site is linked to malicious activity. Suspicious domains are often used for phishing, malware distribution, or fraudulent financial services, but no concrete evidence of such behavior was observed on the recorded page.

Evidence
VirusTotal scanned the domain on 2026-10-27 and reported 18 detections (14 malicious, 4 suspicious) from 92 engines, with several vendors labeling it as phishing or malicious. Google Safe Browsing checked on 2026-10-28 and did not flag the site. Cloudflare Radar scanned on 2026-10-28 and returned a malicious verdict in the malware category. urlscan.io captured the page on 2026-03-14; its machine‑learning engine scored it 95 (malicious) but the overall verdict was non‑malicious. OTX listed three pulses referencing the domain as of 2026-10-28. PhishDestroy’s internal blocklist includes the domain, while external blocklists showed zero hits on the check date.

Infrastructure
The domain was registered on 2026-03-12 through NICENIC INTERNATIONAL GROUP CO., LIMITED. It resolved to IP 185.62.58.129, which was associated with Snel.com B.V. in the Netherlands and was fronted by Cloudflare’s CDN. The TLS certificate, issued by ZeroSSL, was valid from 2026-08-31 to 2026-11-29 and covered only the apex domain.

What to do
Avoid submitting credentials, personal data, or downloading files from this site. If any information was entered, change related passwords and monitor accounts for unusual activity. Defenders should block greymont-evobit.digital at firewalls or proxies and review web‑proxy logs for requests to this address.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/019cec4c-c9bc-731e-a78c-b47c88e3d991/
Cloudflare Radar report: https://radar.cloudflare.com/scan/68311cc8-d3f3-4ab2-92e4-367b2ba06bfd
Stored capture screenshot: https://urlscan.io/screenshots/019cec4c-c9bc-731e-a78c-b47c88e3d991.png
Cloudflare Radar screenshot (2026-10-27T23:41:58Z): https://screenshots.phishdestroy.io/cf/68311cc8-d3f3-4ab2-92e4-367b2ba06bfd.png
VirusTotal report: https://www.virustotal.com/gui/domain/greymont-evobit.digital
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=greymont-evobit.digital
Archived copy: https://web.archive.org/web/20261027234240/https://greymont-evobit.digital/
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-28 00:14:02 UTC

## Stored page captures

- Primary capture: https://urlscan.io/screenshots/019cec4c-c9bc-731e-a78c-b47c88e3d991.png
  Captured: 2026-10-27 23:38:43 UTC
- URLScan capture: https://screenshots.phishdestroy.io/019cec4c-c9bc-731e-a78c-b47c88e3d991.png
  Source report: https://urlscan.io/result/019cec4c-c9bc-731e-a78c-b47c88e3d991/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/68311cc8-d3f3-4ab2-92e4-367b2ba06bfd.png
  Captured: 2026-10-27 23:41:58 UTC
  Source report: https://radar.cloudflare.com/scan/68311cc8-d3f3-4ab2-92e4-367b2ba06bfd
  SHA-256: 66537178a74b527ab1fe181a6d5b4bb6ed52d515e2cc26f1374be238cf1b9c7b

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-27T23:44:02Z",
        "uuid": "019cec4c-c9bc-731e-a78c-b47c88e3d991",
        "scanned_at": "2026-03-14T12:23:08Z",
        "final_url": "https://greymont-evobit.digital/",
        "status": 200,
        "ip": "188.114.96.3",
        "domains": [
            "cdnjs.cloudflare.com",
            "fonts.googleapis.com"
        ],
        "ips": [
            "142.251.208.170",
            "104.17.25.14",
            "188.114.96.3"
        ],
        "asns": [
            "15169",
            "13335"
        ],
        "countries": [
            "US"
        ],
        "doc_hash": "12169e8c78f9d07cb3769900dc926b2389921dff8be9e92b47208c2e13be48ed",
        "script_hashes": [
            "ccf00d1923b0131a10e0c6d26f95e5dee6ebf8621a27e83c5a2f68a2e0093142"
        ],
        "globals": [
            "LANG_MSGS",
            "_aflxf",
            "toggleTermsPopup",
            "__cfQR",
            "__cfRLUnblockHandlers"
        ],
        "tls": {
            "san": [
                "greymont-evobit.digital"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "WE1",
            "subject": "greymont-evobit.digital",
            "protocol": "QUIC",
            "valid_to": "2026-06-11T15:06:12Z",
            "valid_from": "2026-03-13T14:06:23Z"
        },
        "domain_age_days": 1,
        "apex_age_days": 1,
        "tls_age_days": 0,
        "tls_valid_days": 90,
        "requests": 15,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 95,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "cloudflare",
            "content-type": "text/html; charset=utf-8",
            "strict-transport-security": "max-age=31536000; includeSubDomains; preload",
            "content-security-policy": "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://static.cloudflare.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://cdnjs.cloudflare.com; font-src",
            "x-frame-options": "SAMEORIGIN",
            "x-content-type-options": "nosniff",
            "referrer-policy": "strict-origin-when-cross-origin",
            "permissions-policy": "camera=(), microphone=(), geolocation=()",
            "cross-origin-opener-policy": "same-origin"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-27T23:44:04Z",
        "uuid": "68311cc8-d3f3-4ab2-92e4-367b2ba06bfd",
        "scanned_at": "2026-10-27T23:41:58Z",
        "final_url": "https://greymont-evobit.digital/",
        "status": 200,
        "history": [
            {
                "url": "https://greymont-evobit.digital/",
                "status": 200
            }
        ],
        "dom_hash": "e6a26bb29badda7bb1356724a47cb98431b6d3e380259179d22348162d20acef",
        "doc_hash": "01ee6ac187512529cc4880f4af5b3a2b038eeb668a3d11a876cd9c551032a80b",
        "phishing_v2": [
            "phishing"
        ],
        "domain_risks": [
            "Malware",
            "Security threats",
            "CIPA Filter",
            "CIPA"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "greymont-evobit.digital",
                "type": "A",
                "value": "185.62.58.129"
            }
        ],
        "dnssec_valid": false,
        "ip": "127.0.1.26",
        "verdict": {
            "tags": [
                "malware"
            ],
            "malicious": true,
            "categories": [
                "malware"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-28T00:12:07Z",
        "analysis_at": "2026-10-26T23:25:12Z",
        "stats": {
            "timeout": 0,
            "harmless": 44,
            "malicious": 14,
            "suspicious": 4,
            "undetected": 30
        },
        "detections": {
            "CRDF": "malicious",
            "DNS8": "suspicious",
            "ESET": "suspicious",
            "VIPRE": "phishing",
            "G-Data": "phishing",
            "Lionic": "phishing",
            "Sophos": "phishing",
            "Webroot": "malicious",
            "Fortinet": "phishing",
            "SOCRadar": "phishing",
            "Kaspersky": "phishing",
            "Seclookup": "malicious",
            "Gridinsoft": "suspicious",
            "SafeToOpen": "phishing",
            "BitDefender": "phishing",
            "Chong Lua Dao": "malicious",
            "alphaMountain.ai": "spam",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "categories": {
            "Sophos": "phishing and fraud",
            "Webroot": "Phishing and Other Frauds",
            "alphaMountain.ai": "Spam, Suspicious (alphaMountain.ai)",
            "Forcepoint ThreatSeeker": "phishing and other frauds"
        },
        "created": "2026-03-12T00:00:00Z",
        "updated": "2026-03-13T00:00:00Z",
        "first_seen": "2026-03-13T08:18:30Z",
        "dns": [
            {
                "ttl": 21600,
                "type": "NS",
                "value": "brett.ns.cloudflare.com"
            },
            {
                "ttl": 1800,
                "type": "SOA",
                "rname": "dns.cloudflare.com",
                "value": "brett.ns.cloudflare.com"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "princess.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "185.62.58.129"
            }
        ],
        "dns_at": "2026-10-26T23:25:32Z",
        "jarm": "40d40d40d00000000043d43d00043d6aff5ab0f4fc31897186312c9e639319",
        "cert": {
            "san": [
                "greymont-evobit.digital"
            ],
            "issuer": "ZeroSSL GmbH / ZeroSSL ECC DV SSL CA 2",
            "serial": "59bc5680692c88ee57516d7cd9412d53",
            "sha256": "53fd3589233a20a51dd19572bd2cc5be6381ee50b9d866c937fc23a30e85dfa5",
            "subject": "greymont-evobit.digital",
            "valid_to": "2026-11-29T23:59:59Z",
            "valid_from": "2026-08-31T00:00:00Z"
        },
        "whois": [],
        "rdap": {
            "status": [
                "client delete prohibited",
                "client transfer prohibited"
            ],
            "events": {
                "expiration": "2027-03-12T16:00:00Z",
                "registration": "2026-03-12T16:00:00Z",
                "registrar expiration": "2027-03-12T16:00:00Z",
                "last update of RDAP database": "2026-10-26T23:25:21Z"
            },
            "registrar": "NICENIC INTERNATIONAL GROUP CO., LIMITED",
            "registrar_iana_id": "3765"
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-27T23:44:22Z",
        "mail_config": {
            "spf_lookups": 0
        },
        "caa_records": {
            "domain": "greymont-evobit.digital"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_by": [
                "CloudFlare Family"
            ],
            "blocked_count": 1
        },
        "archives": {
            "last": "2026-10-27T23:42:40Z",
            "first": "2026-10-27T23:42:40Z",
            "changes": 0,
            "days_archived": 1,
            "avg_page_bytes": 12829
        },
        "robots_txt": {
            "agents": [
                "*"
            ],
            "present": true,
            "sitemaps": [
                "https://greymont-evobit.digital/sitemap.xml"
            ]
        },
        "sitemap": {
            "present": true,
            "url_count": 175
        },
        "social_tags": {
            "ogUrl": "https://greymont-evobit.digital/",
            "title": "Greymont Evobit | AI Trading Automation Platform",
            "ogType": "website",
            "robots": "index, follow",
            "ogTitle": "Greymont Evobit | AI Trading Automation Platform",
            "ogSiteName": "Greymont Evobit",
            "themeColor": "#23292e",
            "description": "Greymont Evobit showcases AI-powered trading automation insights, bot-workflow breakdowns, feature highlights, and risk-conscious controls for modern markets...",
            "twitterCard": "summary",
            "canonicalUrl": "https://greymont-evobit.digital/",
            "ogDescription": "Greymont Evobit delivers AI-driven automation insights, bot-workflow breakdowns, feature highlights, and risk-aware controls for modern multi-asset trading."
        },
        "trackers": {
            "requests": 22,
            "trackers": [
                {
                    "name": "Cloudflare",
                    "company": "Cloudflare",
                    "country": "US",
                    "category": "Hosting",
                    "requests": 7
                },
                {
                    "name": "Google Fonts",
                    "company": "Google",
                    "country": "US",
                    "category": "Hosting",
                    "requests": 1
                },
                {
                    "name": "Google Static",
                    "company": "Google",
                    "country": "US",
                    "category": "Hosting",
                    "requests": 4
                },
                {
                    "name": "jsDelivr",
                    "company": "jsDelivr",
                    "category": "Hosting",
                    "requests": 3
                }
            ]
        },
        "mixed_content": {
            "no_sri": [
                "https://cdn.jsdelivr.net/npm/intl-tel-input@23/build/js/intlTelInput.min.js"
            ],
            "third_party_scripts": 1
        },
        "status": {
            "up": true,
            "code": 200,
            "timings": {
                "dns": 15,
                "tls": 21,
                "wait": 15,
                "connect": 15,
                "download": 50
            },
            "response_ms": 116
        },
        "tls_connection": {
            "alpn": "h2",
            "cipher": "TLS_AES_128_GCM_SHA256",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "ocsp_stapled": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                80,
                443
            ]
        },
        "carbon": {
            "bytes": 46589,
            "co2_grams": 0.0017,
            "cleaner_than": 38
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "172.64.34.17",
                    "host": "princess.ns.cloudflare.com"
                },
                {
                    "ip": "173.245.59.76",
                    "host": "brett.ns.cloudflare.com"
                }
            ],
            "zone": "greymont-evobit.digital"
        },
        "location": {
            "ip": "185.62.58.129",
            "asn": "62370",
            "org": "Snel.com B.V.",
            "city": "Schiedam",
            "country": "NL"
        },
        "ssl": {
            "issuer": "ZeroSSL GmbH / ZeroSSL ECC DV SSL CA 2",
            "subject": "greymont-evobit.digital"
        },
        "dns": {
            "A": [
                "185.62.58.129"
            ],
            "NS": [
                "princess.ns.cloudflare.com",
                "brett.ns.cloudflare.com"
            ],
            "SOA": "{\"nsname\": \"brett.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2415763553, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}"
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "hsts": {
            "message": "Site does not serve any HSTS headers."
        },
        "http_security": {
            "xFrameOptions": false,
            "referrerPolicy": "no-referrer-when-downgrade",
            "xXSSProtection": false,
            "permissionsPolicy": false,
            "xContentTypeOptions": false,
            "contentSecurityPolicy": false,
            "strictTransportPolicy": false,
            "crossOriginOpenerPolicy": false,
            "crossOriginEmbedderPolicy": false,
            "crossOriginResourcePolicy": false
        },
        "get_ip": {
            "ip": "185.62.58.129",
            "family": 4
        },
        "redirects": {
            "chain": [
                "https://greymont-evobit.digital"
            ]
        },
        "linked_pages": {
            "internal_count": 45
        },
        "headers": {
            "headers": {
                "content-type": "text/html; charset=utf-8",
                "referrer-policy": "no-referrer-when-downgrade"
            }
        }
    }
}
```