# PhishDestroy domain threat record: gweryxalvo-spain.com

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/gweryxalvo-spain.com/
Machine-readable companion: https://phishdestroy.io/domain/gweryxalvo-spain.com/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: unknown
- First observed by PhishDestroy: 2026-10-28 02:11:55 UTC
- Stored record updated: 2026-10-28 02:30:34 UTC
- VirusTotal detections in the stored snapshot: 16/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: ethereum

## Stored infrastructure

- Observed IP address: 188.114.96.1
- Registrar in stored WHOIS data: Dynadot Inc
- Last stored HTTP status: 200
- Registration date in stored WHOIS data: 2026-07-09 02:43:36 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a0806c-bb34-7039-a93a-27a5ee2a3fb1/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/gweryxalvo-spain.com
- Certificate Transparency search: https://crt.sh/?q=%25.gweryxalvo-spain.com
- Web Archive lookup: https://web.archive.org/web/*/https://gweryxalvo-spain.com/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
PhishDestroy listed gweryxalvo-spain.com on 2026-10-28 after the domain was first seen by our system. The recorded page returned HTTP 200 and carried the title "Gweryxalvo | Plataforma Digital para una Experiencia Más Clara 2026". The domain was registered on 2026-07-09, 111 days before the first detection.

How the scam works
No specific fraudulent workflow was observed on the page; the domain is flagged because multiple security vendors associate similar sites with phishing, malware distribution, or credential harvesting. Such listings warn that the site could be used to lure visitors into disclosing data or downloading malicious content.

Evidence
VirusTotal scanned the domain on 2026-10-18 and reported 13 malicious and 3 suspicious detections out of 92 engines (16 total). Google Safe Browsing checked the URL on 2026-10-28 and returned no warning. URLScan captured the site on 2026-09-08; its overall verdict was clean, but its engine score flagged the URL as malicious with a 99‑point confidence. OTX listed one pulse referencing the domain, and PhishDestroy’s internal blocklist marks it as malicious while external blocklists showed zero hits on the same date. Cloudflare Radar also labeled the domain as malware‑related.

Infrastructure
The recorded registration shows Dynadot Inc as registrar, created on 2026-07-09 and expiring on 2027-07-09. The recorded DNS entries on 2026-10-28 listed Cloudflare‑managed addresses such as 188.114.96.1 and 188.114.97.0, with AAAA records 2a06:98c1:3120:: and 2a06:98c1:3121::. Nameservers were evan.ns.cloudflare.com and wally.ns.cloudflare.com. The TLS certificate observed on 2026-10-28 was issued by Google Trust Services, valid from 2026-09-06 to 2026-12-05, and the response headers included a Cloudflare WAF indicator.

What to do
Visitors should avoid entering credentials, personal data, or downloading files from this site and change any passwords if they suspect they were entered. Organizations should block the domain at perimeter firewalls, monitor logs for traffic to the listed hostnames, and add the domain to threat‑intel feeds for continued observation.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a0806c-bb34-7039-a93a-27a5ee2a3fb1/
Cloudflare Radar report: https://radar.cloudflare.com/scan/fdb87d54-e8db-4316-9205-4a872412be51
Stored capture screenshot: https://urlscan.io/screenshots/01a0806c-bb34-7039-a93a-27a5ee2a3fb1.png
Cloudflare Radar screenshot (2026-10-28T02:13:07Z): https://screenshots.phishdestroy.io/cf/fdb87d54-e8db-4316-9205-4a872412be51.png
URLScan screenshot (2026-09-07T20:45:17Z): https://screenshots.phishdestroy.io/us/01a07d9e-25fa-71cd-8e2f-2ee40f9ff57c.png
URLScan capture report: https://urlscan.io/result/01a07d9e-25fa-71cd-8e2f-2ee40f9ff57c/
VirusTotal report: https://www.virustotal.com/gui/domain/gweryxalvo-spain.com
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=gweryxalvo-spain.com
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-28 02:14:44 UTC

## Stored page captures

- Primary capture: https://urlscan.io/screenshots/01a0806c-bb34-7039-a93a-27a5ee2a3fb1.png
  Captured: 2026-10-28 02:11:55 UTC
- URLScan · 2026-09-07: https://screenshots.phishdestroy.io/us/01a07d9e-25fa-71cd-8e2f-2ee40f9ff57c.png
  Captured: 2026-09-07 20:45:17 UTC
  Source report: https://urlscan.io/result/01a07d9e-25fa-71cd-8e2f-2ee40f9ff57c/
  SHA-256: d70fc5697d27aaaace9dd2f38706e23b4822a3ff941e7baaf0d109628af72e91
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/fdb87d54-e8db-4316-9205-4a872412be51.png
  Captured: 2026-10-28 02:13:07 UTC
  Source report: https://radar.cloudflare.com/scan/fdb87d54-e8db-4316-9205-4a872412be51
  SHA-256: ca4174f7d8621f0843a9e31af2f5575e85957cd44b3fe5ad42c2ff39e08ac248

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-28T02:13:51Z",
        "uuid": "01a0806c-bb34-7039-a93a-27a5ee2a3fb1",
        "scanned_at": "2026-09-08T09:50:14Z",
        "final_url": "https://gweryxalvo-spain.com/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://gweryxalvo-spain.com/",
                "from": "http://gweryxalvo-spain.com/",
                "status": 307
            }
        ],
        "ip": "104.21.27.74",
        "domains": [
            "cdn.jsdelivr.net",
            "cdnjs.cloudflare.com",
            "modernroomdesigns.com",
            "fonts.gstatic.com",
            "static.cloudflareinsights.com",
            "fonts.googleapis.com"
        ],
        "ips": [
            "172.67.222.66",
            "172.253.62.94",
            "104.16.80.73",
            "104.17.24.14",
            "151.101.193.229",
            "142.251.163.95",
            "104.21.27.74"
        ],
        "asns": [
            "13335",
            "15169",
            "54113"
        ],
        "countries": [
            "US"
        ],
        "doc_hash": "c41346bedc0b497e6b6b0b8be9826a7ad045c8aa6fa101456cf075484da4628d",
        "script_hashes": [
            "4082edfaa0f4837bfa6ea5de436af8c395b7f6c65db26b87d2978143aab01885"
        ],
        "globals": [
            "polylang",
            "_language",
            "_loader",
            "GEO_API_URL",
            "_phone_error",
            "_form_unknown_error",
            "__offerChatWidgetMounted",
            "intlTelInput",
            "__cfBeacon"
        ],
        "cookies": [
            "_subid",
            "csrftoken"
        ],
        "tls": {
            "san": [
                "gweryxalvo-spain.com",
                "*.gweryxalvo-spain.com"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "WE1",
            "subject": "gweryxalvo-spain.com",
            "protocol": "TLS 1.3",
            "valid_to": "2026-12-05T05:45:54Z",
            "valid_from": "2026-09-06T04:47:15Z"
        },
        "domain_age_days": 61,
        "apex_age_days": 61,
        "tls_age_days": 2,
        "tls_valid_days": 90,
        "requests": 15,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 99,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "cloudflare",
            "content-type": "text/html; charset=utf-8",
            "x-frame-options": "DENY",
            "x-content-type-options": "nosniff",
            "referrer-policy": "same-origin",
            "cross-origin-opener-policy": "same-origin"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-28T02:13:53Z",
        "uuid": "fdb87d54-e8db-4316-9205-4a872412be51",
        "scanned_at": "2026-10-28T02:13:07Z",
        "final_url": "https://gweryxalvo-spain.com/",
        "status": 200,
        "history": [
            {
                "url": "https://gweryxalvo-spain.com/",
                "status": 200
            }
        ],
        "dom_hash": "86a03739eb04f006ac97debe0d6fc32d004b2d39f9eab809e6e3db37dba97e6f",
        "doc_hash": "a664985c054393dcedb0554552f45505ca7af2b4ce3cb91260bfe9c83e055d8b",
        "phishing_v2": [
            "phishing"
        ],
        "domain_risks": [
            "Malware",
            "Security threats",
            "CIPA Filter",
            "CIPA"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "gweryxalvo-spain.com",
                "type": "A",
                "value": "188.114.96.0"
            },
            {
                "name": "gweryxalvo-spain.com",
                "type": "A",
                "value": "188.114.97.0"
            },
            {
                "name": "gweryxalvo-spain.com",
                "type": "AAAA",
                "value": "2a06:98c1:3120::"
            },
            {
                "name": "gweryxalvo-spain.com",
                "type": "AAAA",
                "value": "2a06:98c1:3121::"
            }
        ],
        "dnssec_valid": false,
        "ip": "127.0.1.10",
        "verdict": {
            "tags": [
                "malware"
            ],
            "malicious": true,
            "categories": [
                "malware"
            ]
        },
        "whois": {
            "registrar": "Dynadot Inc",
            "created": "2026-07-09T04:43:36Z",
            "updated": "2026-07-09T04:44:13Z",
            "expires": "2027-07-09T04:43:36Z",
            "nameservers": [
                "evan.ns.cloudflare.com",
                "wally.ns.cloudflare.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-28T02:12:40Z",
        "analysis_at": "2026-10-18T07:42:02Z",
        "stats": {
            "timeout": 0,
            "harmless": 44,
            "malicious": 13,
            "suspicious": 3,
            "undetected": 32
        },
        "detections": {
            "CRDF": "malicious",
            "DNS8": "suspicious",
            "ESET": "suspicious",
            "VIPRE": "phishing",
            "G-Data": "phishing",
            "Lionic": "phishing",
            "Sophos": "phishing",
            "Fortinet": "phishing",
            "SOCRadar": "phishing",
            "Kaspersky": "phishing",
            "Seclookup": "malicious",
            "Gridinsoft": "suspicious",
            "BitDefender": "phishing",
            "alphaMountain.ai": "phishing",
            "Bfore.Ai PreCrime": "malicious",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "tags": [
            "dga"
        ],
        "categories": {
            "alphaMountain.ai": "Phishing (alphaMountain.ai)"
        },
        "registrar": "Dynadot Inc",
        "created": "2026-07-09T04:43:36Z",
        "expires": "2027-07-09T04:43:36Z",
        "updated": "2026-07-09T04:44:13Z",
        "first_seen": "2026-07-09T05:03:09Z",
        "dns": [
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3035::ac43:a90d"
            },
            {
                "ttl": 1800,
                "type": "SOA",
                "rname": "dns.cloudflare.com",
                "value": "evan.ns.cloudflare.com"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "evan.ns.cloudflare.com"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "wally.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3037::6815:1b4a"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "172.67.169.13"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "104.21.27.74"
            }
        ],
        "dns_at": "2026-10-18T07:47:16Z",
        "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c",
        "cert": {
            "san": [
                "gweryxalvo-spain.com",
                "*.gweryxalvo-spain.com"
            ],
            "issuer": "Google Trust Services / WE1",
            "serial": "37c4a55bec110b3b13917d3992d6bdd5",
            "sha256": "0659252072bfc67a1cd06c23ae7b4ea5abf04c7606c1e720eb0f2ac3071b7c89",
            "subject": "gweryxalvo-spain.com",
            "valid_to": "2026-12-05T05:45:54Z",
            "valid_from": "2026-09-06T04:47:15Z"
        },
        "whois": {
            "registrar": "Dynadot Inc",
            "registrar_iana_id": "472",
            "registrar_url": "http://www.dynadot.com",
            "created": "2026-07-09T04:43:36Z",
            "updated": "2026-07-09T04:44:13Z",
            "expires": "2027-07-09T04:43:36Z",
            "status": [
                "clientTransferProhibited"
            ],
            "nameservers": [
                "evan.ns.cloudflare.com",
                "wally.ns.cloudflare.com"
            ],
            "dnssec": "unsigned"
        },
        "rdap": {
            "status": [
                "transfer prohibited"
            ],
            "events": {
                "expiration": "2027-07-09T04:43:36Z",
                "last changed": "2026-07-09T04:44:13Z",
                "registration": "2026-07-09T04:43:36Z",
                "registrar expiration": "2027-07-09T04:43:36Z",
                "last update of RDAP database": "2026-10-16T07:22:13Z"
            }
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-28T02:14:04Z",
        "mail_config": {
            "spf_lookups": 0
        },
        "caa_records": {
            "domain": "gweryxalvo-spain.com"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_by": [
                "CloudFlare Family"
            ],
            "blocked_count": 1
        },
        "robots_txt": {
            "agents": [
                "*"
            ],
            "present": true,
            "sitemaps": [
                "https://gweryxalvo-spain.com/sitemap.xml"
            ]
        },
        "sitemap": {
            "present": true,
            "url_count": 7
        },
        "social_tags": {
            "ogUrl": "https://gweryxalvo-spain.com/",
            "title": "Gweryxalvo | Plataforma Digital para una Experiencia Más Clara 2026",
            "ogType": "website",
            "robots": "index, follow, max-image-preview:large, max-snippet:-1, max-video-preview:-1",
            "ogImage": "https://gweryxalvo-spain.com/static/template_18/zeongrow/image.png",
            "ogTitle": "Gweryxalvo | Plataforma Digital para una Experiencia Más Clara 2026",
            "ogSiteName": "Gweryxalvo",
            "themeColor": "#f4f6fb",
            "description": "Gweryxalvo reúne herramientas intuitivas y una organización eficiente para facilitar la comprensión de la información, mejorar la interacción con los datos y ofrecer una experiencia digital más cómoda y fluida.",
            "twitterCard": "summary_large_image",
            "canonicalUrl": "https://gweryxalvo-spain.com/",
            "ogDescription": "Gweryxalvo reúne herramientas intuitivas y una organización eficiente para facilitar la comprensión de la información, mejorar la interacción con los datos y ofrecer una experiencia digital más cómoda y fluida."
        },
        "trackers": {
            "requests": 10,
            "trackers": [
                {
                    "name": "Cloudflare",
                    "company": "Cloudflare",
                    "country": "US",
                    "category": "Hosting",
                    "requests": 1
                },
                {
                    "name": "Google Fonts",
                    "company": "Google",
                    "country": "US",
                    "category": "Hosting",
                    "requests": 1
                },
                {
                    "name": "Google Static",
                    "company": "Google",
                    "country": "US",
                    "category": "Hosting",
                    "requests": 1
                },
                {
                    "name": "jsDelivr",
                    "company": "jsDelivr",
                    "category": "Hosting",
                    "requests": 3
                }
            ]
        },
        "mixed_content": {
            "no_sri": [
                "https://cdn.jsdelivr.net/npm/intl-tel-input@23.0.12/build/js/intlTelInput.min.js"
            ],
            "third_party_scripts": 1
        },
        "status": {
            "up": true,
            "code": 200,
            "timings": {
                "dns": 106,
                "tls": 97,
                "wait": 223,
                "connect": 58,
                "download": 2
            },
            "response_ms": 486
        },
        "tls_connection": {
            "alpn": "h2",
            "cipher": "TLS_AES_256_GCM_SHA384",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1",
                "TLSv1.1",
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                80,
                443,
                8080
            ]
        },
        "carbon": {
            "bytes": 76156,
            "co2_grams": 0.0028,
            "cleaner_than": 28
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "108.162.193.165",
                    "host": "evan.ns.cloudflare.com"
                },
                {
                    "ip": "172.64.32.239",
                    "host": "wally.ns.cloudflare.com"
                }
            ],
            "zone": "gweryxalvo-spain.com"
        },
        "cookies": {
            "cookies": [
                {
                    "name": "_subid",
                    "session": true
                },
                {
                    "name": "csrftoken",
                    "same_site": "Lax"
                }
            ]
        },
        "location": {
            "ip": "2a06:98c1:3121::3",
            "asn": "13335",
            "org": "CloudFLARENET-EU",
            "city": "London",
            "country": "GB"
        },
        "ssl": {
            "issuer": "Google Trust Services / WE1",
            "subject": "gweryxalvo-spain.com"
        },
        "dns": {
            "A": [
                "188.114.96.3",
                "188.114.97.3"
            ],
            "NS": [
                "wally.ns.cloudflare.com",
                "evan.ns.cloudflare.com"
            ],
            "SOA": "{\"nsname\": \"evan.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2414340227, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}",
            "AAAA": [
                "2a06:98c1:3121::3",
                "2a06:98c1:3120::3"
            ]
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "hsts": {
            "message": "Site does not serve any HSTS headers."
        },
        "http_security": {
            "xFrameOptions": "DENY",
            "referrerPolicy": "same-origin",
            "xXSSProtection": false,
            "permissionsPolicy": false,
            "xContentTypeOptions": "nosniff",
            "contentSecurityPolicy": false,
            "strictTransportPolicy": false,
            "crossOriginOpenerPolicy": "same-origin",
            "crossOriginEmbedderPolicy": false,
            "crossOriginResourcePolicy": false
        },
        "firewall": {
            "waf": "Cloudflare",
            "has_waf": true
        },
        "get_ip": {
            "ip": "2a06:98c1:3120::3",
            "family": 6
        },
        "redirects": {
            "chain": [
                "https://gweryxalvo-spain.com"
            ]
        },
        "linked_pages": {
            "internal_count": 10
        },
        "whois": {
            "registrar": "Dynadot Inc",
            "created": "2026-07-09T04:43:36Z",
            "updated": "2026-07-09T04:44:13Z",
            "expires": "2027-07-09T04:43:36Z",
            "status": [
                "clientTransferProhibited https://icann.org/epp"
            ],
            "nameservers": [
                "evan.ns.cloudflare.com",
                "wally.ns.cloudflare.com"
            ]
        },
        "headers": {
            "headers": {
                "server": "cloudflare",
                "content-type": "text/html; charset=utf-8",
                "x-frame-options": "DENY",
                "x-content-type-options": "nosniff",
                "referrer-policy": "same-origin",
                "cross-origin-opener-policy": "same-origin"
            }
        }
    }
}
```