# PhishDestroy domain threat record: itokentrade.com Content language: English Canonical HTML report: https://phishdestroy.io/domain/itokentrade.com/ Machine-readable companion: https://phishdestroy.io/domain/itokentrade.com/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-10-04 03:51:40 UTC - Last availability or vendor check: 2026-10-22 10:37:08 UTC - Stored record updated: 2026-10-22 15:45:57 UTC - VirusTotal detections in the stored snapshot: 6/91 - Independent public blocklist matches in the stored snapshot: 2 - Matching public blocklists: MetaMask, SEAL - Google Safe Browsing stored result: no stored flag ## Stored classification - Targeted brand: Celestia ## Stored infrastructure - Observed IP address: 188.114.96.3 - Registrar in stored WHOIS data: GMO Internet Group, Inc. d/b/a Onamae.com - Registrar country in stored WHOIS data: Unknown - Registration date (registry RDAP, itokentrade.com): 2026-10-01 22:28:52 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a10508-fe8f-73bf-aa98-666f6b37e7c2/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/itokentrade.com - Certificate Transparency search: https://crt.sh/?q=%25.itokentrade.com - Web Archive lookup: https://web.archive.org/web/*/https://itokentrade.com/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview itokentrade.com is an impersonation phishing page dressed up as a crypto token trading service. Its page title is simply "itokentrade", a generic name chosen to look like a legitimate trading platform to people searching for one. PhishDestroy first flagged it on 2026-10-04. As of 2026-10-19 the domain was still up, but its DNS no longer served the phishing content. A dormant domain like this can be pointed back at a live page at any time. How the scam works Impersonation sites like this copy the look and language of a trusted crypto service so visitors believe they are using the real thing. The victim is pushed to log in, deposit funds or connect a wallet. Anything typed in, such as passwords, recovery phrases or one-time codes, goes straight to the operators. Any deposit or wallet signature hands over assets that cannot be recovered. A plausible trading name such as "itokentrade" is the main bait, so the address bar is often the only clue that something is wrong. Evidence The classification has independent support from MetaMask and SEAL, which blocklist the domain alongside PhishDestroy. Both focus on threats to crypto wallets, so their listings point straight at wallet users. On VirusTotal, 6 of 91 engines flagged the site on 2026-10-06: BitDefender, CRDF, Forcepoint ThreatSeeker, G-Data, Gridinsoft and Kaspersky. That is a modest count, typical for a domain only days old, so most security tools would not have warned visitors yet. The domain also appears in 4 AlienVault OTX threat pulses, which means other researchers have tracked it too. Infrastructure The domain was registered on 2026-10-01 through GMO Internet Group (Onamae.com). PhishDestroy caught it three days later, a short gap that fits a site built for a quick campaign. It sits behind Cloudflare's network in the US, which hides the real origin server from view. The free Let's Encrypt certificate gives it a padlock icon, but that proves nothing about who runs the site. What to do If you entered a password, recovery phrase or 2FA code on itokentrade.com, assume that account or wallet is compromised. Change the password, reset 2FA, and move funds from any exposed wallet to a new one with a fresh seed phrase. If you connected a wallet or signed anything, revoke the site's token approvals with a trusted approval-checker and watch for unexpected transfers. Do not send more money if someone asks for "fees" to release a balance. Defenders should block the domain at DNS and proxy level and report it to Cloudflare and the registrar. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a10508-fe8f-73bf-aa98-666f6b37e7c2/ VirusTotal report: https://www.virustotal.com/gui/domain/itokentrade.com Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=itokentrade.com Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-19 09:31:31 UTC ## Stored page captures - Primary capture: https://i.ibb.co/PsBSpkYC/4ec1d091af07.png Captured: 2026-10-04 03:51:40 UTC - URLScan capture: https://screenshots.phishdestroy.io/01a10508-fe8f-73bf-aa98-666f6b37e7c2.png Captured: 2026-10-04 03:51:40 UTC Source report: https://urlscan.io/result/01a10508-fe8f-73bf-aa98-666f6b37e7c2/ ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-20T19:33:28Z", "uuid": "01a10508-fe8f-73bf-aa98-666f6b37e7c2", "scanned_at": "2026-10-04T03:50:51Z", "final_url": "https://m.itokentrade.com/", "status": 200, "redirected": "parent-domain", "redirects": [ { "to": "https://itokentrade.com/", "from": "http://itokentrade.com/", "status": 307 }, { "to": "https://m.itokentrade.com/", "from": "https://itokentrade.com/" } ], "ip": "188.114.96.3", "domains": [ "itokentrade.com", "apiweb.itokentrade.com" ], "ips": [ "188.114.96.3" ], "asns": [ "13335" ], "doc_hash": "4e0b0fba634fd01aa13c42465b2fa515444d58c49ce7916c760d651248cc5e6d", "script_hashes": [ "bcee984fd52b4a82bd6b23543bb33f6472e076c125edbdd8756d29ca230628cb", "6a57d3d09108f534d0e4917aa58c68a097d6923e736dbcb6b3d3235a45b98409", "9592ed68c85cfe547df4b96d72226468d3176a405835e247bd26b4d6d9f3d2e6", "309fbabff84fc5d37b4526113ee36e71aca5b4d656a5faa9b8dae23dec63e526", "39bd72dde7538a33e2fd11645beae7b0091104be75aec5f655883058c0963773", "4340198e80cdeef16fc5d919bd8ac000b0416c905e66cc60bc3db0dcdd387697", "104840bf105259d57d70c1dd737c254d63a696ff7c20bcb1e26d5b00c5a46d45", "24ebdea828e938d3a45128b41979b320b4cbd40c8c0d4bad6a9cd9bc3bfa4e0c", "4b27ebd2aa41a50d78bbfe53bb88b14a0ec9a0934b6b8149537521d4f018fcf7", "095a76cf495f202cad8234a7c51b1efde923df806a664209c3a494ab70955777" ], "globals": [ "TradingView", "addLink", "addMeta", "lib", "rem", "dpr", "__VUE_INSTANCE_SETTERS__", "__INTLIFY_PROD_DEVTOOLS__", "__INTLIFY_JIT_COMPILATION__", "__INTLIFY_DROP_MESSAGE_COMPILER__", "__VUE_I18N_FULL_INSTALL__", "__VUE_I18N_LEGACY_API__", "PubSub", "__config", "__theme", "__VUE__", "__vite_is_modern_browser", "_Highcharts" ], "storage_keys": [ "trustdefi_THEME", "main", "trustdefi_LANGUAGE" ], "tls": { "san": [ "*.itokentrade.com", "itokentrade.com" ], "cipher": "AES_128_GCM", "issuer": "YE1", "subject": "itokentrade.com", "protocol": "QUIC", "valid_to": "2026-12-30T23:15:01Z", "valid_from": "2026-10-01T23:15:02Z" }, "domain_age_days": 2, "apex_age_days": 3031, "tls_age_days": 2, "tls_valid_days": 89, "requests": 88, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 11, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "cloudflare", "content-type": "text/html", "strict-transport-security": "max-age=31536000" } }, "vt": { "v": 1, "fetched_at": "2026-10-21T13:18:11Z", "analysis_at": "2026-10-18T11:44:22Z", "stats": { "timeout": 0, "harmless": 55, "malicious": 0, "suspicious": 0, "undetected": 37 }, "reputation": 0, "registrar": "GMO Internet Group, Inc. d/b/a Onamae.com", "created": "2026-10-01T22:28:52Z", "expires": "2027-10-01T22:28:52Z", "updated": "2026-10-01T22:28:52Z", "first_seen": "2026-10-01T23:09:44Z", "dns": [ { "ttl": 21600, "type": "NS", "value": "angela.ns.cloudflare.com" }, { "ttl": 300, "type": "TXT", "value": "v=spf1 include:spf.emaildee.com ~all" }, { "ttl": 300, "type": "A", "value": "104.21.64.56" }, { "ttl": 300, "type": "AAAA", "value": "2606:4700:3036::ac43:b060" }, { "ttl": 21600, "type": "NS", "value": "rocky.ns.cloudflare.com" }, { "ttl": 300, "type": "MX", "value": "mail.emaildee.com", "priority": 5 }, { "ttl": 300, "type": "A", "value": "172.67.176.96" }, { "ttl": 300, "type": "AAAA", "value": "2606:4700:3030::6815:4038" }, { "ttl": 1800, "type": "SOA", "rname": "dns.cloudflare.com", "value": "angela.ns.cloudflare.com" } ], "dns_at": "2026-10-04T22:46:07Z", "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c", "cert": { "san": [ "*.itokentrade.com", "itokentrade.com" ], "issuer": "Let's Encrypt / YE1", "serial": "61eaf685e33d3c38ace107c8e9ec6f879d8", "sha256": "17fcf21ec5392ed02c052d8c2d288fa1b46828d191fc773074311d926ed57020", "subject": "itokentrade.com", "valid_to": "2026-12-30T23:15:01Z", "valid_from": "2026-10-01T23:15:02Z" }, "whois": { "registrar": "GMO Internet Group, Inc. d/b/a Onamae.com", "registrar_iana_id": "49", "registrar_url": "https://internet.gmo/", "created": "2026-10-01T22:28:52Z", "updated": "2026-10-01T22:28:52Z", "expires": "2027-10-01T22:28:52Z", "status": [ "ok" ], "nameservers": [ "a11.share-dns.com", "b11.share-dns.net" ], "dnssec": "unsigned" }, "rdap": { "status": [ "client transfer prohibited", "client update prohibited" ], "events": { "expiration": "2027-09-30T15:00:00Z", "last changed": "2026-10-02T06:33:54Z", "registration": "2026-10-01T13:28:52Z", "registrar expiration": "2027-09-30T15:00:00Z", "last update of RDAP database": "2026-10-18T11:47:06Z" } } } } ```