# PhishDestroy domain threat record: gtradeactfr.shop

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/gtradeactfr.shop/
Machine-readable companion: https://phishdestroy.io/domain/gtradeactfr.shop/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-28 02:10:46 UTC
- Last availability or vendor check: 2026-10-28 11:00:23 UTC
- Stored record updated: 2026-10-28 11:23:03 UTC
- VirusTotal detections in the stored snapshot: 16/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored infrastructure

- Observed IP address: 185.62.57.48
- Registrar in stored WHOIS data: NETIM
- Last stored HTTP status: 200
- Registration date in stored WHOIS data: 2026-08-02 11:39:07 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a01895-bd21-76eb-85dd-b7a0781e4613/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/gtradeactfr.shop
- Certificate Transparency search: https://crt.sh/?q=%25.gtradeactfr.shop
- Web Archive lookup: https://web.archive.org/web/*/https://gtradeactfr.shop/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
PhishDestroy listed gtradeactfr.shop as a suspicious domain based on automated analysis. The recorded page title reads "GtradeActFr | AI Trading Platform | Authorized Platform". The domain was first seen by PhishDestroy on 2026-10-28 and returned an HTTP 200 response on that date.

How the scam works
The combination of vendor detections and the site’s financial‑themed branding suggests it could be used for phishing or fraudulent investment offers, such as fake AI‑trading services that attempt to collect user credentials or funds. No concrete malicious payload or credential‑stealing form was observed on the captured page.

Evidence
VirusTotal scanned the domain on 2026-10-22 (retrieved 2026-10-28) and reported 13 malicious and 3 suspicious detections from 92 engines, with vendors including BitDefender, Fortinet and Kaspersky labeling it as phishing. Google Safe Browsing checked on 2026-10-28 and did not flag the site. urlscan.io captured the page on 2026-08-19; its engine verdict was malicious with a score of 99, though the overall verdict was benign. Cloudflare Radar scanned on 2026-10-28 and marked the domain malicious for malware, and OTX listed one pulse referencing the domain. PhishDestroy’s internal blocklist includes the domain, while external blocklists showed no hits at the time of checking.

Infrastructure
The domain had been registered 15 days before the first observation and used a TLS certificate issued by ZeroSSL, valid for 90 days. The recorded IP was 185.62.57.48, which belonged to Snel.com B.V. in the Netherlands, and the site was delivered via Cloudflare’s CDN using Cloudflare nameservers. No additional infrastructure details were identified beyond the recorded IP and hosting provider.

What to do
Do not enter login credentials, personal data, or financial information on the site; if any credentials were submitted, change them immediately. Monitor associated accounts for unauthorized activity and consider blocking the domain at the network perimeter. Defenders should add gtradeactfr.shop to threat‑intel feeds, log DNS queries for 185.62.57.48, and apply appropriate firewall rules to prevent future connections.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a01895-bd21-76eb-85dd-b7a0781e4613/
Cloudflare Radar report: https://radar.cloudflare.com/scan/1a6dfc64-9f81-43ab-85b8-1e4c4dd4f702
Stored capture screenshot: https://urlscan.io/screenshots/01a01895-bd21-76eb-85dd-b7a0781e4613.png
Cloudflare Radar screenshot (2026-10-28T02:13:24Z): https://screenshots.phishdestroy.io/cf/1a6dfc64-9f81-43ab-85b8-1e4c4dd4f702.png
URLScan screenshot (2026-08-18T15:45:23Z): https://screenshots.phishdestroy.io/us/01a0158c-621f-752a-9b7b-2ab8f9c8ee43.png
URLScan capture report: https://urlscan.io/result/01a0158c-621f-752a-9b7b-2ab8f9c8ee43/
URLScan screenshot (2026-10-28T02:16:29Z): https://screenshots.phishdestroy.io/us/01a1804b-33fd-738b-96fa-a2f79590ba92.png
URLScan capture report: https://urlscan.io/result/01a1804b-33fd-738b-96fa-a2f79590ba92/
VirusTotal report: https://www.virustotal.com/gui/domain/gtradeactfr.shop
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=gtradeactfr.shop
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-28 02:17:46 UTC

## Stored page captures

- Primary capture: https://urlscan.io/screenshots/01a01895-bd21-76eb-85dd-b7a0781e4613.png
  Captured: 2026-10-28 02:10:46 UTC
- URLScan capture 1: https://screenshots.phishdestroy.io/01a01895-bd21-76eb-85dd-b7a0781e4613.png
  Captured: 2026-10-28 04:31:04 UTC
  Source report: https://urlscan.io/result/01a01895-bd21-76eb-85dd-b7a0781e4613/
- URLScan · 2026-08-18: https://screenshots.phishdestroy.io/us/01a0158c-621f-752a-9b7b-2ab8f9c8ee43.png
  Captured: 2026-08-18 15:45:23 UTC
  Source report: https://urlscan.io/result/01a0158c-621f-752a-9b7b-2ab8f9c8ee43/
  SHA-256: 740659663d6cd8a7789cb7ba81599902fcc9a985128f876b5894606bda4eb840
- URLScan · 2026-10-28: https://screenshots.phishdestroy.io/us/01a1804b-33fd-738b-96fa-a2f79590ba92.png
  Captured: 2026-10-28 02:16:29 UTC
  Source report: https://urlscan.io/result/01a1804b-33fd-738b-96fa-a2f79590ba92/
  SHA-256: 78f6a2d9df16d18032ffb693c3b0ef38362001d30766461d2345ce94d99c36fb
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/1a6dfc64-9f81-43ab-85b8-1e4c4dd4f702.png
  Captured: 2026-10-28 02:13:24 UTC
  Source report: https://radar.cloudflare.com/scan/1a6dfc64-9f81-43ab-85b8-1e4c4dd4f702
  SHA-256: cffabb4d45a747955f5fb2785434af78d8369e65b3ae4d1254e2b16b7a128671

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-28T02:16:48Z",
        "uuid": "01a01895-bd21-76eb-85dd-b7a0781e4613",
        "scanned_at": "2026-08-19T05:54:28Z",
        "final_url": "https://gtradeactfr.shop/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://gtradeactfr.shop/",
                "from": "http://gtradeactfr.shop/",
                "status": 307
            }
        ],
        "ip": "188.114.97.3",
        "domains": [
            "cdnjs.cloudflare.com",
            "cdn.jsdelivr.net",
            "fonts.googleapis.com",
            "static.cloudflare.com"
        ],
        "ips": [
            "151.101.129.229",
            "142.251.127.95",
            "104.17.24.14",
            "188.114.97.3"
        ],
        "asns": [
            "54113",
            "15169",
            "13335"
        ],
        "countries": [
            "US"
        ],
        "doc_hash": "58f49fb07de70f90714f68a192d248293a6435a95286cb8d59585d76593b477d",
        "script_hashes": [
            "ccf00d1923b0131a10e0c6d26f95e5dee6ebf8621a27e83c5a2f68a2e0093142"
        ],
        "globals": [
            "LANG_MSGS",
            "ClientJS",
            "_dz5gkv22",
            "toggleTermsPopup",
            "__cfQR",
            "__cfRLUnblockHandlers",
            "__lgT0"
        ],
        "cookies": [
            "entry_url"
        ],
        "tls": {
            "san": [
                "gtradeactfr.shop"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "WE1",
            "subject": "gtradeactfr.shop",
            "protocol": "TLS 1.3",
            "valid_to": "2026-11-01T08:36:31Z",
            "valid_from": "2026-08-03T07:36:33Z"
        },
        "domain_age_days": 15,
        "apex_age_days": 15,
        "tls_age_days": 15,
        "tls_valid_days": 90,
        "requests": 17,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 99,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "cloudflare",
            "content-type": "text/html; charset=utf-8",
            "strict-transport-security": "max-age=31536000; includeSubDomains; preload",
            "content-security-policy": "connect-src 'self' https://cloudflareinsights.com; frame-ancestors 'self'; default-src 'self'; img-src 'self' data: blob:; font-src 'self' https://fonts.gstatic.com https://cdnjs.cloudflare.com; scrip",
            "x-frame-options": "SAMEORIGIN",
            "x-content-type-options": "nosniff",
            "referrer-policy": "no-referrer-when-downgrade",
            "permissions-policy": "camera=(), microphone=(), geolocation=()",
            "cross-origin-opener-policy": "same-origin"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-28T02:16:51Z",
        "uuid": "1a6dfc64-9f81-43ab-85b8-1e4c4dd4f702",
        "scanned_at": "2026-10-28T02:13:24Z",
        "final_url": "https://gtradeactfr.shop/",
        "status": 200,
        "history": [
            {
                "url": "https://gtradeactfr.shop/",
                "status": 200
            }
        ],
        "dom_hash": "9d9a70d07ee8a3815cc2d7500ffc2785d3781cd2e134ac1ec91431470f6a5646",
        "doc_hash": "c6dd1a200f8a5da71b97dc5e2dc41bd739d51bf9a56a225f21336693ae7fcffe",
        "phishing_v2": [
            "phishing"
        ],
        "domain_risks": [
            "Malware",
            "Security threats",
            "CIPA Filter",
            "CIPA"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "gtradeactfr.shop",
                "type": "A",
                "value": "185.62.57.48"
            }
        ],
        "dnssec_valid": false,
        "ip": "127.0.1.11",
        "verdict": {
            "tags": [
                "malware"
            ],
            "malicious": true,
            "categories": [
                "malware"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-28T02:12:42Z",
        "analysis_at": "2026-10-22T15:38:58Z",
        "stats": {
            "timeout": 0,
            "harmless": 43,
            "malicious": 13,
            "suspicious": 3,
            "undetected": 33
        },
        "detections": {
            "CRDF": "malicious",
            "DNS8": "suspicious",
            "ESET": "suspicious",
            "VIPRE": "phishing",
            "G-Data": "phishing",
            "Lionic": "phishing",
            "Sophos": "phishing",
            "CyRadar": "phishing",
            "Fortinet": "phishing",
            "SOCRadar": "phishing",
            "Kaspersky": "phishing",
            "Seclookup": "malicious",
            "Gridinsoft": "suspicious",
            "BitDefender": "phishing",
            "alphaMountain.ai": "phishing",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "categories": {
            "Sophos": "phishing and fraud",
            "alphaMountain.ai": "Phishing (alphaMountain.ai)"
        },
        "first_seen": "2026-08-03T07:58:10Z",
        "dns": [
            {
                "ttl": 300,
                "type": "A",
                "value": "185.62.57.48"
            },
            {
                "ttl": 1800,
                "type": "SOA",
                "rname": "dns.cloudflare.com",
                "value": "alexia.ns.cloudflare.com"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "alexia.ns.cloudflare.com"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "chuck.ns.cloudflare.com"
            }
        ],
        "dns_at": "2026-10-22T15:49:04Z",
        "jarm": "40d40d40d00000000043d43d00043d6aff5ab0f4fc31897186312c9e639319",
        "cert": {
            "san": [
                "gtradeactfr.shop"
            ],
            "issuer": "ZeroSSL GmbH / ZeroSSL ECC DV SSL CA 2",
            "serial": "a0de45deebf1fb5fd3d9c483ae4ea593",
            "sha256": "5597c46b92a554163d4fec78b3d1a4a76d0256762c10446b5bf89103eede95dc",
            "subject": "gtradeactfr.shop",
            "valid_to": "2026-11-29T23:59:59Z",
            "valid_from": "2026-08-31T00:00:00Z"
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-28T02:17:07Z",
        "mail_config": {
            "spf_lookups": 0
        },
        "caa_records": {
            "domain": "gtradeactfr.shop"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_by": [
                "CloudFlare Family"
            ],
            "blocked_count": 1
        },
        "archives": {
            "last": "2026-10-28T02:11:58Z",
            "first": "2026-10-28T02:11:58Z",
            "changes": 0,
            "days_archived": 1,
            "avg_page_bytes": 11170
        },
        "robots_txt": {
            "agents": [
                "*"
            ],
            "present": true,
            "sitemaps": [
                "https://gtradeactfr.shop/sitemap.xml"
            ]
        },
        "sitemap": {
            "present": true,
            "url_count": 140
        },
        "social_tags": {
            "ogUrl": "https://gtradeactfr.shop/",
            "title": "GtradeActFr | AI Trading Platform | Authorized Platform",
            "ogType": "website",
            "robots": "index, follow",
            "ogTitle": "GtradeActFr | Premium AI-Powered Trading",
            "ogSiteName": "GtradeActFr",
            "themeColor": "#180026",
            "description": "GtradeActFr delivers AI-powered trading guidance, automated bots, portfolio governance, and transparent market workflows for modern investors.",
            "twitterCard": "summary",
            "canonicalUrl": "https://gtradeactfr.shop/",
            "ogDescription": "Experience AI-powered trading guidance, automated bots, and transparent market workflows in a premium, intuitive environment."
        },
        "trackers": {
            "requests": 19,
            "trackers": [
                {
                    "name": "Cloudflare",
                    "company": "Cloudflare",
                    "country": "US",
                    "category": "Hosting",
                    "requests": 7
                },
                {
                    "name": "Google Fonts",
                    "company": "Google",
                    "country": "US",
                    "category": "Hosting",
                    "requests": 1
                },
                {
                    "name": "Google Static",
                    "company": "Google",
                    "country": "US",
                    "category": "Hosting",
                    "requests": 1
                },
                {
                    "name": "jsDelivr",
                    "company": "jsDelivr",
                    "category": "Hosting",
                    "requests": 3
                }
            ]
        },
        "mixed_content": {
            "no_sri": [
                "https://cdn.jsdelivr.net/npm/intl-tel-input@23/build/js/intlTelInput.min.js"
            ],
            "third_party_scripts": 1
        },
        "status": {
            "up": true,
            "code": 200,
            "timings": {
                "dns": 14,
                "tls": 44,
                "wait": 28,
                "connect": 30,
                "download": 49
            },
            "response_ms": 165
        },
        "tls_connection": {
            "alpn": "h2",
            "cipher": "TLS_AES_128_GCM_SHA256",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "ocsp_stapled": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                80,
                443
            ]
        },
        "carbon": {
            "bytes": 38162,
            "co2_grams": 0.0014,
            "cleaner_than": 43
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "172.64.34.175",
                    "host": "alexia.ns.cloudflare.com"
                },
                {
                    "ip": "108.162.193.86",
                    "host": "chuck.ns.cloudflare.com"
                }
            ],
            "zone": "gtradeactfr.shop"
        },
        "location": {
            "ip": "185.62.57.48",
            "asn": "62370",
            "org": "Snel.com B.V.",
            "city": "Rotterdam",
            "country": "NL"
        },
        "ssl": {
            "issuer": "ZeroSSL GmbH / ZeroSSL ECC DV SSL CA 2",
            "subject": "gtradeactfr.shop"
        },
        "dns": {
            "A": [
                "185.62.57.48"
            ],
            "NS": [
                "alexia.ns.cloudflare.com",
                "chuck.ns.cloudflare.com"
            ],
            "SOA": "{\"nsname\": \"alexia.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2416362111, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}"
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "hsts": {
            "message": "Site does not serve any HSTS headers."
        },
        "http_security": {
            "xFrameOptions": false,
            "referrerPolicy": "no-referrer-when-downgrade",
            "xXSSProtection": false,
            "permissionsPolicy": false,
            "xContentTypeOptions": false,
            "contentSecurityPolicy": false,
            "strictTransportPolicy": false,
            "crossOriginOpenerPolicy": false,
            "crossOriginEmbedderPolicy": false,
            "crossOriginResourcePolicy": false
        },
        "get_ip": {
            "ip": "185.62.57.48",
            "family": 4
        },
        "redirects": {
            "chain": [
                "https://gtradeactfr.shop"
            ]
        },
        "linked_pages": {
            "internal_count": 38
        },
        "headers": {
            "headers": {
                "content-type": "text/html; charset=utf-8",
                "referrer-policy": "no-referrer-when-downgrade"
            }
        }
    }
}
```