# PhishDestroy threat dossier — investorswealth.pro ================================================================ Fetched: 2026-07-28 17:08:19 UTC Canonical: https://phishdestroy.io/domain/investorswealth.pro/ ## VERDICT ---------------------------------------------------------------- CRITICAL THREAT — DO NOT VISIT Composite threat score: 100/100 (PhishDestroy scoring — see methodology below) ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 14/91 security vendors flagged this domain Flagging vendors: ADMINUSLabs, alphaMountain.ai, BitDefender, Chong Lua Dao, CRDF, CyRadar, Forcepoint ThreatSeeker, Fortinet, G-Data, Gridinsoft, Kaspersky, Lionic, Netcraft, Sophos AlienVault OTX: 3 pulses (threat-intel feed mentions) Public blocklists: listed on 1 independent blocklist ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 188.114.97.3 (CA, Toronto) ASN: AS13335 Cloudflare, Inc. Hosting org: CloudFlare, Inc. Registrar: Dynadot Inc Nameservers: hal.ns.cloudflare.com, venus.ns.cloudflare.com Registered: 2025-08-20 Expires: 2026-08-20 Page title: investorswealth.pro HTTP response: 200 ## TLS CERTIFICATE ---------------------------------------------------------------- Issuer: Google Trust Services / WE1 Expires: 2026-09-09 Status: INVALID chain Fingerprint: fad8e81fcd5f0ce5caca549790ce3e3eb62978f93e2cae4ea00272522c2346c4 ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: pending notification queue. No abuse reports filed yet — this domain is waiting for the next cycle of our automated abuse-reporter. ## TIMELINE ---------------------------------------------------------------- Domain registered: 2025-08-20 (per WHOIS / CT — may reflect a renewal or transfer date, not first-ever registration) First detected: 2026-07-27 07:20:42 UTC (by PhishDestroy tracker) First reported: 2026-07-27 07:30:42 UTC (abuse notice filed) Last verified: 2026-07-28 16:20:22 UTC Current status: ACTIVE / observable ## EXTERNAL CORROBORATION (third-party evidence) ---------------------------------------------------------------- URLScan.io: https://urlscan.io/result/019fa2eb-a105-7242-b499-9741caa00526/ URLQuery: https://urlquery.net/report/d80dc0c7-4b2a-4e4c-b4b3-0117f82365bd Wayback Machine: https://web.archive.org/web/*/investorswealth.pro crt.sh CT logs: https://crt.sh/?q=%25.investorswealth.pro Google transparency: https://transparencyreport.google.com/safe-browsing/search?url=investorswealth.pro AlienVault OTX: https://otx.alienvault.com/indicator/domain/investorswealth.pro URLhaus: https://urlhaus.abuse.ch/host/investorswealth.pro/ ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-07-27 07:21:58 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] investorswealth.pro: Confirmed High-Risk Phishing Operation The domain investorswealth.pro has been confirmed as a high-risk phishing site based on multiple threat intelligence sources as of July 27, 2026. Analysis shows the domain remains active and was registered on August 20, 2025 through Dynadot Inc. DNS records indicate hosting on IP address 188.114.96.3, with Cloudflare-managed nameservers (hal.ns.cloudflare.com and venus.ns.cloudflare.com), suggesting use of a proxy service for infrastructure obfuscation. The domain is listed on at least one security blocklist, specifically by PhishDestroy, and is flagged by 14 out of 91 security vendors according to current VirusTotal results. This concentration of detections from reputable threat intelligence sources constitutes concrete evidence of phishing operations associated with this domain. No information is available regarding the specific content, targeted brand, or scam variant present on the site, as the page title and further web content analysis have not yet been referenced. However, the clustering of security vendor detections and blocklist inclusion strongly indicate that the domain is being used in active phishing campaigns. Given its recent creation date and continued active status, defenders should regard any interaction with investorswealth.pro as high risk. Immediate blocking at the network, endpoint, and email gateway levels is advised. Continued monitoring for related indicators of compromise is recommended, as is sharing this information with relevant response teams. Uncertainty remains about the exact tactics or lures employed, but the available evidence mandates a precautionary approach to this domain. ## EVIDENCE HASHES ---------------------------------------------------------------- PhishDestroy Case ID: PD-20260727-DA6249 Favicon MD5: c226149d011263bacbed78e7002a2282 TLS cert SHA-256: fad8e81fcd5f0ce5caca549790ce3e3eb62978f93e2cae4ea00272522c2346c4 ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (operator takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/investorswealth.pro/ JSON API: https://api.destroy.tools/v1/check?domain=investorswealth.pro Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: independent open-source threat-intelligence platform. Tracked: 212,176 domains (86,616 alive under monitoring, 124,530 confirmed takedowns/dead). Site: https://phishdestroy.io