# PhishDestroy domain threat record: halytradyai.shop

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/halytradyai.shop/
Machine-readable companion: https://phishdestroy.io/domain/halytradyai.shop/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-28 02:13:32 UTC
- Last availability or vendor check: 2026-10-28 11:00:23 UTC
- Stored record updated: 2026-10-28 11:23:05 UTC
- VirusTotal detections in the stored snapshot: 19/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored infrastructure

- Observed IP address: 172.67.137.249
- Registrar in stored WHOIS data: NETIM
- Last stored HTTP status: 200
- Registration date in stored WHOIS data: 2026-05-24 09:46:58 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/019f88dd-b328-76dd-b77a-ae172c014886/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/halytradyai.shop
- Certificate Transparency search: https://crt.sh/?q=%25.halytradyai.shop
- Web Archive lookup: https://web.archive.org/web/*/https://halytradyai.shop/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
PhishDestroy has listed halytradyai.shop as a suspicious domain based on automated analysis and multiple vendor detections. The site was first seen by PhishDestroy on 2026-10-28. The recorded page title reads “HalyTrady+AI | a premium AI trading | Official Website”. An HTTP 200 response was recorded on 2026-07-22.

How the scam works
The current evidence does not point to a single fraud mechanism; instead the domain is flagged because it matches patterns commonly used for phishing, malware distribution, or fraudulent financial services. Such suspicious sites often present attractive offers—here an AI‑driven trading console—to lure visitors into providing credentials, payments, or personal data. Without concrete on‑page behavior, the risk remains that the site could be used to harvest information or deliver malicious payloads. Users should treat any unsolicited financial‑related service with caution.

Evidence
VirusTotal reported 16 malicious and 3 suspicious detections out of 92 engines on 2026-10-28 (analysis date 2026-10-23). Google Safe Browsing marked the domain as not flagged on 2026-10-28. urlscan.io returned an overall clean verdict but its engine scoring flagged the URL as malicious with a score of 98 on 2026-07-22. Cloudflare Radar classified the site as malicious, labeling it under the malware category on 2026-10-28. OTX lists three pulses mentioning the domain as of 2026-10-28. PhishDestroy’s internal blocklist includes the domain, while external blocklists showed zero matches on the same date.

Infrastructure
The domain was registered on 2026-05-24 through the registrar NETIM. Hosting is provided via Cloudflare’s network, with recorded IP addresses 172.67.137.249 and 104.21.73.27 (and corresponding IPv6 addresses). TLS was issued by Google Trust Services on 2026-05-24 and was valid until 2026-08-22 at the time of capture. The site employed HSTS, a content‑security policy, and Cloudflare’s WAF.

What to do
Visitors should avoid entering credentials, payment details, or personal information on the site; if any were submitted, change associated passwords and monitor accounts for unauthorized activity. Defenders should add halytradyai.shop to blocklists, monitor DNS queries for the recorded IPs, and review web‑proxy logs for any access to the domain. No evidence indicates active malware delivery, but precautionary network filtering is advised.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/019f88dd-b328-76dd-b77a-ae172c014886/
Cloudflare Radar report: https://radar.cloudflare.com/scan/09216d0f-f545-419c-8545-8465afe9a51c
Stored capture screenshot: https://urlscan.io/screenshots/019f88dd-b328-76dd-b77a-ae172c014886.png
Cloudflare Radar screenshot (2026-10-28T02:20:43Z): https://screenshots.phishdestroy.io/cf/09216d0f-f545-419c-8545-8465afe9a51c.png
VirusTotal report: https://www.virustotal.com/gui/domain/halytradyai.shop
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=halytradyai.shop
Archived copy: https://web.archive.org/web/20261028021708/https://halytradyai.shop/
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-28 04:57:28 UTC

## Stored page captures

- Primary capture: https://urlscan.io/screenshots/019f88dd-b328-76dd-b77a-ae172c014886.png
  Captured: 2026-10-28 02:13:32 UTC
- URLScan capture: https://screenshots.phishdestroy.io/019f88dd-b328-76dd-b77a-ae172c014886.png
  Captured: 2026-10-28 04:30:57 UTC
  Source report: https://urlscan.io/result/019f88dd-b328-76dd-b77a-ae172c014886/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/09216d0f-f545-419c-8545-8465afe9a51c.png
  Captured: 2026-10-28 02:20:43 UTC
  Source report: https://radar.cloudflare.com/scan/09216d0f-f545-419c-8545-8465afe9a51c
  SHA-256: 7b3e6285cf5383a4abc6dec0ea1c11489f96e4437ea4a1ebc882713e4d4068ca

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-28T02:26:32Z",
        "uuid": "019f88dd-b328-76dd-b77a-ae172c014886",
        "scanned_at": "2026-07-22T08:07:44Z",
        "final_url": "https://halytradyai.shop/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://halytradyai.shop/",
                "from": "http://halytradyai.shop/",
                "status": 307
            }
        ],
        "ip": "172.67.137.249",
        "domains": [
            "cdnjs.cloudflare.com",
            "cdn.jsdelivr.net",
            "fonts.googleapis.com",
            "static.cloudflare.com"
        ],
        "ips": [
            "2606:4700::6811:d005",
            "2a00:1450:4001:c25::5f",
            "104.17.25.14",
            "172.67.137.249"
        ],
        "asns": [
            "13335",
            "15169"
        ],
        "countries": [
            "DE"
        ],
        "doc_hash": "fff0eb776698d3c89e780d6a57e9c56ef23f4f4aa293cfb1a6726eb7e0c90b88",
        "script_hashes": [
            "ccf00d1923b0131a10e0c6d26f95e5dee6ebf8621a27e83c5a2f68a2e0093142"
        ],
        "globals": [
            "LANG_MSGS",
            "ClientJS",
            "_upgcy5d7",
            "toggleTermsPopup",
            "__cfQR",
            "__cfRLUnblockHandlers",
            "__lgT0"
        ],
        "cookies": [
            "entry_url"
        ],
        "tls": {
            "san": [
                "halytradyai.shop"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "WE1",
            "subject": "halytradyai.shop",
            "protocol": "TLS 1.3",
            "valid_to": "2026-08-22T13:27:44Z",
            "valid_from": "2026-05-24T12:27:46Z"
        },
        "domain_age_days": 58,
        "apex_age_days": 58,
        "tls_age_days": 58,
        "tls_valid_days": 90,
        "requests": 19,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 98,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "cloudflare",
            "content-type": "text/html; charset=utf-8",
            "strict-transport-security": "max-age=63072000; includeSubDomains; preload",
            "content-security-policy": "frame-ancestors 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://static.cloudflare.com https://cdn.jsdelivr.net; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://cd",
            "x-frame-options": "SAMEORIGIN",
            "x-content-type-options": "nosniff",
            "referrer-policy": "strict-origin",
            "permissions-policy": "camera=(), microphone=(), geolocation=()",
            "cross-origin-opener-policy": "same-origin"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-28T02:26:34Z",
        "uuid": "09216d0f-f545-419c-8545-8465afe9a51c",
        "scanned_at": "2026-10-28T02:20:43Z",
        "final_url": "https://halytradyai.shop/",
        "status": 200,
        "history": [
            {
                "url": "https://halytradyai.shop/",
                "status": 200
            }
        ],
        "dom_hash": "7f015ede26849b6705627721e8bcd502317a3a044227e1df0e1a4d204c1e855a",
        "doc_hash": "918c9d4f45cd33697f128525e5953612e7c9264de4bf5c1cdd92eed76ed075df",
        "phishing_v2": [
            "phishing"
        ],
        "domain_risks": [
            "Malware",
            "Security threats",
            "CIPA Filter",
            "CIPA"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "halytradyai.shop",
                "type": "A",
                "value": "172.67.137.249"
            },
            {
                "name": "halytradyai.shop",
                "type": "A",
                "value": "104.21.73.27"
            },
            {
                "name": "halytradyai.shop",
                "type": "AAAA",
                "value": "2606:4700:3032::6815:491b"
            },
            {
                "name": "halytradyai.shop",
                "type": "AAAA",
                "value": "2606:4700:3037::ac43:89f9"
            }
        ],
        "dnssec_valid": false,
        "ip": "127.0.1.6",
        "verdict": {
            "tags": [
                "malware"
            ],
            "malicious": true,
            "categories": [
                "malware"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-28T04:56:03Z",
        "analysis_at": "2026-10-23T14:08:15Z",
        "stats": {
            "timeout": 0,
            "harmless": 42,
            "malicious": 16,
            "suspicious": 3,
            "undetected": 31
        },
        "detections": {
            "CRDF": "malicious",
            "DNS8": "suspicious",
            "ESET": "suspicious",
            "VIPRE": "phishing",
            "G-Data": "phishing",
            "Lionic": "phishing",
            "Sophos": "phishing",
            "CyRadar": "phishing",
            "Webroot": "malicious",
            "Fortinet": "phishing",
            "SOCRadar": "phishing",
            "Kaspersky": "phishing",
            "Seclookup": "malicious",
            "Gridinsoft": "suspicious",
            "SafeToOpen": "phishing",
            "BitDefender": "phishing",
            "Chong Lua Dao": "malicious",
            "alphaMountain.ai": "phishing",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "created": "2026-05-24T00:00:00Z",
        "updated": "2026-05-24T00:00:00Z",
        "first_seen": "2026-05-24T13:43:30Z",
        "dns": [
            {
                "ttl": 21600,
                "type": "NS",
                "value": "ishaan.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3032::6815:491b"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3037::ac43:89f9"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "172.67.137.249"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "carrera.ns.cloudflare.com"
            },
            {
                "ttl": 1800,
                "type": "SOA",
                "rname": "dns.cloudflare.com",
                "value": "carrera.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "104.21.73.27"
            }
        ],
        "dns_at": "2026-10-23T14:13:42Z",
        "jarm": "27d40d40d00040d00042d43d00041df04c41293ba84f6efe3a613b22f983e6",
        "cert": {
            "san": [
                "halytradyai.shop"
            ],
            "issuer": "Google Trust Services / WE1",
            "serial": "7ab0977571ff9eeb138a30f7e0c0afaa",
            "sha256": "91773967eee2ca3aa9ef2163a035277def662b7c34708beac5dcd19fd582b93c",
            "subject": "halytradyai.shop",
            "valid_to": "2026-12-18T22:47:16Z",
            "valid_from": "2026-09-19T21:47:19Z"
        },
        "whois": []
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-28T02:25:57Z",
        "mail_config": {
            "spf_lookups": 0
        },
        "caa_records": {
            "domain": "halytradyai.shop"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_by": [
                "CloudFlare Family"
            ],
            "blocked_count": 1
        },
        "archives": {
            "last": "2026-10-28T02:17:08Z",
            "first": "2026-10-13T09:36:33Z",
            "changes": 1,
            "days_archived": 2,
            "scans_per_day": 0.07,
            "avg_page_bytes": 42730
        },
        "robots_txt": {
            "agents": [
                "*"
            ],
            "present": true,
            "sitemaps": [
                "https://halytradyai.shop/sitemap.xml"
            ]
        },
        "sitemap": {
            "present": true,
            "url_count": 140
        },
        "social_tags": {
            "ogUrl": "https://halytradyai.shop/",
            "title": "HalyTrady+AI | a premium AI trading | Official Website",
            "ogType": "website",
            "robots": "index, follow",
            "ogTitle": "HalyTrady+AI | Elite AI-driven trading console",
            "ogSiteName": "HalyTrady+AI",
            "themeColor": "#000000",
            "description": "HalyTrady+AI unveils a premium AI-driven trading console, featuring intelligent assistance, automated agents, precise execution controls, and risk-conscious setups for active market participants.",
            "twitterCard": "summary",
            "canonicalUrl": "https://halytradyai.shop/",
            "ogDescription": "Step into a premium AI-enabled trading workspace with adaptive automation, intelligent bots, execution controls, and risk-aware setup for active markets."
        },
        "trackers": {
            "requests": 18,
            "trackers": [
                {
                    "name": "Cloudflare",
                    "company": "Cloudflare",
                    "country": "US",
                    "category": "Hosting",
                    "requests": 8
                },
                {
                    "name": "Google Fonts",
                    "company": "Google",
                    "country": "US",
                    "category": "Hosting",
                    "requests": 1
                },
                {
                    "name": "jsDelivr",
                    "company": "jsDelivr",
                    "category": "Hosting",
                    "requests": 1
                }
            ]
        },
        "mixed_content": {
            "no_sri": [
                "https://static.cloudflare.com/beacon.min.js",
                "https://challenges.cloudflare.com/turnstile/v0/api.js",
                "https://cdn.jsdelivr.net/npm/clientjs@0.2.1/dist/client.min.js"
            ],
            "third_party_scripts": 3
        },
        "status": {
            "up": true,
            "code": 200,
            "timings": {
                "dns": 15,
                "tls": 25,
                "wait": 175,
                "connect": 24,
                "download": 25
            },
            "response_ms": 264
        },
        "tls_connection": {
            "alpn": "h2",
            "cipher": "TLS_AES_256_GCM_SHA384",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                80,
                443,
                8080
            ]
        },
        "carbon": {
            "bytes": 151009,
            "co2_grams": 0.0055,
            "cleaner_than": 13
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "108.162.194.231",
                    "host": "carrera.ns.cloudflare.com"
                },
                {
                    "ip": "108.162.195.213",
                    "host": "ishaan.ns.cloudflare.com"
                }
            ],
            "zone": "halytradyai.shop"
        },
        "cookies": {
            "cookies": [
                {
                    "name": "entry_url",
                    "secure": true,
                    "same_site": "Lax"
                }
            ]
        },
        "location": {
            "ip": "2606:4700:3037::ac43:89f9",
            "asn": "13335",
            "org": "Cloudflare, Inc.",
            "city": "Toronto",
            "country": "CA"
        },
        "ssl": {
            "issuer": "Google Trust Services / WE1",
            "subject": "halytradyai.shop"
        },
        "dns": {
            "A": [
                "104.21.73.27",
                "172.67.137.249"
            ],
            "NS": [
                "carrera.ns.cloudflare.com",
                "ishaan.ns.cloudflare.com"
            ],
            "SOA": "{\"nsname\": \"carrera.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2418085255, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}",
            "AAAA": [
                "2606:4700:3032::6815:491b",
                "2606:4700:3037::ac43:89f9"
            ]
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "hsts": {
            "header": "max-age=15552000; includeSubDomains; preload",
            "message": "HSTS max-age is 15552000, below the 31536000 minimum."
        },
        "http_security": {
            "xFrameOptions": "SAMEORIGIN",
            "referrerPolicy": "no-referrer-when-downgrade",
            "xXSSProtection": false,
            "permissionsPolicy": "camera=(), microphone=(), geolocation=()",
            "xContentTypeOptions": "nosniff",
            "contentSecurityPolicy": "script-src 'self' 'unsafe-inline' 'unsafe-eval' https://static.cloudflare.com https://cdn.jsdelivr.net https://challenge",
            "strictTransportPolicy": "max-age=15552000; includeSubDomains; preload",
            "crossOriginOpenerPolicy": "same-origin",
            "crossOriginEmbedderPolicy": false,
            "crossOriginResourcePolicy": false
        },
        "firewall": {
            "waf": "Cloudflare",
            "has_waf": true
        },
        "get_ip": {
            "ip": "2606:4700:3037::ac43:89f9",
            "family": 6
        },
        "redirects": {
            "chain": [
                "https://halytradyai.shop"
            ]
        },
        "tech_stack": {
            "technologies": [
                "jsDelivr",
                "Cloudflare Turnstile",
                "Cloudflare Rocket Loader",
                "ClientJS",
                "Priority Hints",
                "Google Font API",
                "Font Awesome",
                "cdnjs",
                "HSTS",
                "Cloudflare",
                "Open Graph",
                "HTTP/3"
            ]
        },
        "linked_pages": {
            "internal_count": 15
        },
        "headers": {
            "headers": {
                "server": "cloudflare",
                "content-type": "text/html; charset=utf-8",
                "strict-transport-security": "max-age=15552000; includeSubDomains; preload",
                "content-security-policy": "script-src 'self' 'unsafe-inline' 'unsafe-eval' https://static.cloudflare.com https://cdn.jsdelivr.net https://challenges.cloudflare.com; frame-src https://challenges.cloudflare.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://cdnjs.cloudflare.com; font-src 'self' https://f",
                "x-frame-options": "SAMEORIGIN",
                "x-content-type-options": "nosniff",
                "referrer-policy": "no-referrer-when-downgrade",
                "permissions-policy": "camera=(), microphone=(), geolocation=()",
                "cross-origin-opener-policy": "same-origin"
            }
        }
    }
}
```