# PhishDestroy domain threat record: gtcao.com

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/gtcao.com/
Machine-readable companion: https://phishdestroy.io/domain/gtcao.com/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: not observed active
- First observed by PhishDestroy: 2026-10-25 07:56:18 UTC
- Last availability or vendor check: 2026-10-25 12:22:59 UTC
- Stored record updated: 2026-10-25 12:22:59 UTC
- VirusTotal detections in the stored snapshot: 1/92
- Independent public blocklist matches in the stored snapshot: 2
- Matching public blocklists: MetaMask, SEAL
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: Coinbase

## Stored infrastructure

- Observed IP address: 188.114.96.3
- Registrar in stored WHOIS data: GoDaddy.com, LLC
- Last stored HTTP status: 403
- Registration date in stored WHOIS data: 2026-06-29 10:17:33 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a1720e-518b-7380-bf6d-83dc1e728431/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/gtcao.com
- Certificate Transparency search: https://crt.sh/?q=%25.gtcao.com
- Web Archive lookup: https://web.archive.org/web/*/https://gtcao.com/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
PhishDestroy listed gtcao.com as a suspicious domain based on an automated detection rule. The intake system noted that the page provided insufficient content for deeper analysis. The domain was first observed by PhishDestroy on 2026-10-25, 118 days after its registration on 2026-06-29.

How the scam works
The current evidence does not reveal a specific fraudulent mechanism; the listing only indicates that the site is considered suspicious. In general, domains flagged as suspicious may be used for phishing, credential harvesting, or malware distribution, but no concrete behavior was observed on this page.

Evidence
URLScan captured the site on 2026-10-24 and returned a malicious engine verdict with a high confidence score, though its overall malicious flag was false. VirusTotal reported one suspicious detection from alphaMountain.ai, labeling the domain as spam, out of 92 scanning engines. Google Safe Browsing showed no flag on 2026-10-25, and external blocklists contained no entries, while PhishDestroy’s internal blocklist marks the domain as malicious. OTX lists five pulses referencing the domain.

Infrastructure
The domain was registered with GoDaddy.com, LLC on 2026-06-29 and is protected by Cloudflare DNS and CDN services. TLS was served by a Google Trust Services certificate valid from 2026-08-27 to 2026-11-25 for gtcao.com and its subdomains. The recorded IP address during scans was 172.67.135.201 (also seen as 188.114.97.0/3 and 2a06:98c1:3120::3). DNSSEC was not enabled.

What to do
Do not submit any credentials or personal information to the site; if you have, change the associated passwords immediately. Network defenders should block the domain and monitor outbound traffic for connections to its recorded IPs. Users should remain cautious of unsolicited messages referencing Coinbase or similar brands and verify URLs before interacting.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a1720e-518b-7380-bf6d-83dc1e728431/
Cloudflare Radar report: https://radar.cloudflare.com/scan/7d144ba0-e7e4-4d18-aae3-69e4e22d7a88
URLQuery report: https://urlquery.net/report/4d947535-7505-4143-b91f-c927e463f616
Stored capture screenshot: https://i.ibb.co/xbWZ57J/336271a24255.png
Cloudflare Radar screenshot (2026-10-25T08:36:31Z): https://screenshots.phishdestroy.io/cf/7d144ba0-e7e4-4d18-aae3-69e4e22d7a88.png
URLQuery screenshot: https://screenshots.phishdestroy.io/uq/4d947535-7505-4143-b91f-c927e463f616.png
URLScan screenshot (2026-10-23T16:41:59Z): https://screenshots.phishdestroy.io/us/01a169a3-ad87-73e9-81d9-8aa812e5103a.png
URLScan capture report: https://urlscan.io/result/01a169a3-ad87-73e9-81d9-8aa812e5103a/
URLScan screenshot (2026-10-24T09:55:58Z): https://screenshots.phishdestroy.io/us/01a16d56-45ea-76a9-a82e-8fe17fbe4c4d.png
URLScan capture report: https://urlscan.io/result/01a16d56-45ea-76a9-a82e-8fe17fbe4c4d/
VirusTotal report: https://www.virustotal.com/gui/domain/gtcao.com
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=gtcao.com
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-25 08:42:17 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/xbWZ57J/336271a24255.png
  Captured: 2026-10-25 07:56:18 UTC
- URLScan capture 1: https://screenshots.phishdestroy.io/01a1720e-518b-7380-bf6d-83dc1e728431.png
  Captured: 2026-10-25 07:56:18 UTC
  Source report: https://urlscan.io/result/01a1720e-518b-7380-bf6d-83dc1e728431/
- URLScan capture 2: https://urlscan.io/screenshots/01a16d56-45ea-76a9-a82e-8fe17fbe4c4d.png
  Captured: 2026-10-25 07:54:50 UTC
  Source report: https://urlscan.io/result/01a1720e-518b-7380-bf6d-83dc1e728431/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/7d144ba0-e7e4-4d18-aae3-69e4e22d7a88.png
  Captured: 2026-10-25 08:36:31 UTC
  Source report: https://radar.cloudflare.com/scan/7d144ba0-e7e4-4d18-aae3-69e4e22d7a88
  SHA-256: de762a2f243423f1cd8662817b10dd210ec41103a6c9fd2ec439c7803dea0074
- URLQuery: https://screenshots.phishdestroy.io/uq/4d947535-7505-4143-b91f-c927e463f616.png
  Source report: https://urlquery.net/report/4d947535-7505-4143-b91f-c927e463f616
  SHA-256: 3d6c2968ecb14aaa1eaf800a54e13bf05981af1932b3f400778562f72f8e387c
- URLScan · 2026-10-23: https://screenshots.phishdestroy.io/us/01a169a3-ad87-73e9-81d9-8aa812e5103a.png
  Captured: 2026-10-23 16:41:59 UTC
  Source report: https://urlscan.io/result/01a169a3-ad87-73e9-81d9-8aa812e5103a/
  SHA-256: 4db86834949ac49b2a27fa7374a983b3052e1b2eae2f4c25a1e669c70704cabd
- URLScan · 2026-10-24: https://screenshots.phishdestroy.io/us/01a16d56-45ea-76a9-a82e-8fe17fbe4c4d.png
  Captured: 2026-10-24 09:55:58 UTC
  Source report: https://urlscan.io/result/01a16d56-45ea-76a9-a82e-8fe17fbe4c4d/
  SHA-256: 0cf4a8dafbea17365f534c321e0a26c82d24fd76486f085cbbcb95a32f23124c

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-25T08:04:42Z",
        "uuid": "01a1720e-518b-7380-bf6d-83dc1e728431",
        "scanned_at": "2026-10-25T07:55:13Z",
        "final_url": "https://gtcao.com/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://gtcao.com/",
                "from": "http://gtcao.com/",
                "status": 307
            }
        ],
        "ip": "172.67.135.201",
        "domains": [
            "webapi.gtcao.com",
            "static.cloudflareinsights.com"
        ],
        "ips": [
            "172.67.135.201"
        ],
        "asns": [
            "13335"
        ],
        "doc_hash": "1882405e34dd456995b055912bcc078b2cb485a40665c7f3f658e6b5c045080b",
        "script_hashes": [
            "bcee984fd52b4a82bd6b23543bb33f6472e076c125edbdd8756d29ca230628cb",
            "791ff103561753d5829dd4b49affa109aeb1fe1779e1840e94d375c63c3f47de",
            "5a6dff48ba548932e7681deb75c4a3d12f82b8793040665562720c41b187ffd9",
            "d2e4a76318dbdc1be22f6a463756e08d2bd5d5f71d426603f95be0f57a3868be",
            "cba7af84502d51c277b047b237a1c5812ee08d002137ed982b6299d3ea22999e",
            "1de73cee9b9c61d29f9448d74deba5809c799c53d175929192c3269458602baf",
            "4edffd59eca1b82fc676858fa58d4ac3331cde93bc71552669456b64f9359bbc",
            "45a30aeef3f20978a87cf69edb18be251c193cd9d06bca4a58c85924e3e2d11f",
            "6235ac3e51d0e9ba2be8c9cc4be7ba9448a2d0bea87319f43847adf1ae4845f5",
            "72959092115d1b3f4ea23bf2b76c06ab8db549343d2d095f4757d8d7d1f2ba61"
        ],
        "globals": [
            "addLink",
            "addMeta",
            "TradingView",
            "lib",
            "rem",
            "dpr",
            "__VUE_INSTANCE_SETTERS__",
            "__INTLIFY_PROD_DEVTOOLS__",
            "__INTLIFY_JIT_COMPILATION__",
            "__INTLIFY_DROP_MESSAGE_COMPILER__",
            "__VUE_I18N_FULL_INSTALL__",
            "__VUE_I18N_LEGACY_API__",
            "setImmediate",
            "clearImmediate",
            "PubSub",
            "__config",
            "__theme",
            "__VUE__",
            "__vite_is_modern_browser",
            "__isBfcacheRestore",
            "_Highcharts"
        ],
        "cookies": [
            "app_device_id"
        ],
        "storage_keys": [
            "production_THEME",
            "main",
            "app_device_id",
            "production_LANGUAGE"
        ],
        "tls": {
            "san": [
                "gtcao.com",
                "*.gtcao.com"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "WE1",
            "subject": "gtcao.com",
            "protocol": "QUIC",
            "valid_to": "2026-11-25T12:46:40Z",
            "valid_from": "2026-08-27T11:50:29Z"
        },
        "domain_age_days": 117,
        "apex_age_days": 117,
        "tls_age_days": 58,
        "tls_valid_days": 90,
        "requests": 75,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 98,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "cloudflare",
            "content-type": "text/html",
            "strict-transport-security": "max-age=31536000"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-25T08:41:46Z",
        "uuid": "7d144ba0-e7e4-4d18-aae3-69e4e22d7a88",
        "scanned_at": "2026-10-25T08:36:31Z",
        "final_url": "https://gtcao.com/cdn-cgi/phish-bypass",
        "status": 400,
        "history": [
            {
                "url": "https://gtcao.com/",
                "status": 403
            },
            {
                "url": "https://gtcao.com/cdn-cgi/phish-bypass",
                "status": 400
            }
        ],
        "dom_hash": "7fc99aa2d89e0695afe980fa5a4f6850d050e60e0805209b2ab086fa92f20e16",
        "doc_hash": "0c70b5f49fe5740571b0e1d54ed808905de8b4d803353cb4febd4b6bbb175450",
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "gtcao.com",
                "type": "A",
                "value": "188.114.97.0"
            },
            {
                "name": "gtcao.com",
                "type": "A",
                "value": "188.114.96.0"
            },
            {
                "name": "gtcao.com",
                "type": "AAAA",
                "value": "2a06:98c1:3121::"
            },
            {
                "name": "gtcao.com",
                "type": "AAAA",
                "value": "2a06:98c1:3120::"
            }
        ],
        "dnssec_valid": false,
        "ip": "188.114.97.0",
        "whois": {
            "registrar": "GoDaddy.com, LLC",
            "created": "2026-06-29T12:17:33Z",
            "updated": "2026-06-29T12:21:58Z",
            "expires": "2027-06-29T12:17:33Z",
            "nameservers": [
                "dan.ns.cloudflare.com",
                "love.ns.cloudflare.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-25T08:34:44Z",
        "analysis_at": "2026-10-23T19:43:53Z",
        "stats": {
            "timeout": 0,
            "harmless": 55,
            "malicious": 0,
            "suspicious": 1,
            "undetected": 36
        },
        "detections": {
            "alphaMountain.ai": "spam"
        },
        "reputation": 0,
        "categories": {
            "alphaMountain.ai": "Spam (alphaMountain.ai)"
        },
        "registrar": "GoDaddy.com, LLC",
        "created": "2026-06-29T12:17:33Z",
        "expires": "2027-06-29T12:17:33Z",
        "updated": "2026-06-29T12:21:58Z",
        "first_seen": "2024-03-06T04:50:57Z",
        "dns": [
            {
                "ttl": 300,
                "type": "A",
                "value": "104.21.7.74"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "love.ns.cloudflare.com"
            },
            {
                "ttl": 1800,
                "type": "SOA",
                "rname": "dns.cloudflare.com",
                "value": "dan.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3036::ac43:87c9"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "dan.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "172.67.135.201"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3037::6815:74a"
            }
        ],
        "dns_at": "2026-10-23T19:49:07Z",
        "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c",
        "cert": {
            "san": [
                "gtcao.com",
                "*.gtcao.com"
            ],
            "issuer": "Google Trust Services / WE1",
            "serial": "1464f725de6476961322fec4d58f301f",
            "sha256": "2899ad9fa72a3bba7033b2ab4092537774949de48d1511322cf7fdcaaa902877",
            "subject": "gtcao.com",
            "valid_to": "2026-11-25T12:46:40Z",
            "valid_from": "2026-08-27T11:50:29Z"
        },
        "whois": {
            "registrar": "GoDaddy.com, LLC",
            "registrar_iana_id": "146",
            "registrar_url": "http://www.godaddy.com",
            "created": "2026-06-29T12:17:33Z",
            "updated": "2026-06-29T12:21:58Z",
            "expires": "2027-06-29T12:17:33Z",
            "status": [
                "clientDeleteProhibited",
                "clientRenewProhibited",
                "clientTransferProhibited",
                "clientUpdateProhibited"
            ],
            "nameservers": [
                "dan.ns.cloudflare.com",
                "love.ns.cloudflare.com"
            ],
            "dnssec": "unsigned"
        },
        "rdap": {
            "status": [
                "client delete prohibited",
                "client renew prohibited",
                "client transfer prohibited",
                "client update prohibited"
            ],
            "events": {
                "expiration": "2027-06-29T12:17:33Z",
                "last changed": "2026-06-29T12:21:58Z",
                "registration": "2026-06-29T12:17:33Z",
                "last update of RDAP database": "2026-10-23T19:48:50Z"
            }
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-25T08:29:25Z",
        "mail_config": {
            "spf_lookups": 0
        },
        "caa_records": {
            "domain": "gtcao.com"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_count": 0
        },
        "archives": {
            "last": "2026-10-25T07:55:02Z",
            "first": "2026-10-25T07:55:02Z",
            "changes": 0,
            "days_archived": 1,
            "avg_page_bytes": 4519
        },
        "robots_txt": {
            "agents": [
                "*"
            ],
            "present": true
        },
        "tls_connection": {
            "alpn": "h2",
            "cipher": "TLS_AES_256_GCM_SHA384",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1",
                "TLSv1.1",
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                80,
                443,
                8080
            ]
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "108.162.193.108",
                    "host": "dan.ns.cloudflare.com"
                },
                {
                    "ip": "108.162.194.119",
                    "host": "love.ns.cloudflare.com"
                }
            ],
            "zone": "gtcao.com"
        },
        "location": {
            "ip": "2a06:98c1:3120::3",
            "asn": "13335",
            "org": "CloudFLARENET-EU",
            "city": "London",
            "country": "GB"
        },
        "ssl": {
            "issuer": "Google Trust Services / WE1",
            "subject": "gtcao.com"
        },
        "dns": {
            "A": [
                "188.114.97.3",
                "188.114.96.3"
            ],
            "NS": [
                "dan.ns.cloudflare.com",
                "love.ns.cloudflare.com"
            ],
            "SOA": "{\"nsname\": \"dan.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2417496321, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}",
            "AAAA": [
                "2a06:98c1:3120::3",
                "2a06:98c1:3121::3"
            ]
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "hsts": {
            "message": "Site does not serve any HSTS headers."
        },
        "http_security": {
            "xFrameOptions": "SAMEORIGIN",
            "referrerPolicy": "same-origin",
            "xXSSProtection": false,
            "permissionsPolicy": false,
            "xContentTypeOptions": false,
            "contentSecurityPolicy": false,
            "strictTransportPolicy": false,
            "crossOriginOpenerPolicy": false,
            "crossOriginEmbedderPolicy": false,
            "crossOriginResourcePolicy": false
        },
        "firewall": {
            "waf": "Cloudflare",
            "has_waf": true
        },
        "get_ip": {
            "ip": "2a06:98c1:3121::3",
            "family": 6
        },
        "whois": {
            "registrar": "GoDaddy.com, LLC",
            "created": "2026-06-29T12:17:33Z",
            "updated": "2026-06-29T12:21:58Z",
            "expires": "2027-06-29T12:17:33Z",
            "status": [
                "clientDeleteProhibited https://icann.org/epp",
                "clientRenewProhibited https://icann.org/epp",
                "clientTransferProhibited https://icann.org/epp",
                "clientUpdateProhibited https://icann.org/epp"
            ],
            "nameservers": [
                "dan.ns.cloudflare.com",
                "love.ns.cloudflare.com"
            ]
        },
        "headers": {
            "headers": {
                "server": "cloudflare",
                "content-type": "text/html; charset=utf-8",
                "x-frame-options": "SAMEORIGIN",
                "referrer-policy": "same-origin"
            }
        }
    }
}
```