# PhishDestroy domain threat record: kdtrader.com

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/kdtrader.com/
Machine-readable companion: https://phishdestroy.io/domain/kdtrader.com/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: unknown
- First observed by PhishDestroy: 2026-10-26 16:18:44 UTC
- Stored record updated: 2026-10-26 20:36:46 UTC
- VirusTotal detections in the stored snapshot: 0/92
- Independent public blocklist matches in the stored snapshot: 2
- Matching public blocklists: MetaMask, SEAL
- Google Safe Browsing stored result: no stored flag

## Stored infrastructure

- Observed IP address: 188.114.96.1
- Registrar in stored WHOIS data: GoDaddy.com, LLC
- Last stored HTTP status: 200
- Registration date in stored WHOIS data: 2019-11-02 08:49:24 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a175c6-a264-7559-a199-7c292668c197/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/kdtrader.com
- Certificate Transparency search: https://crt.sh/?q=%25.kdtrader.com
- Web Archive lookup: https://web.archive.org/web/*/https://kdtrader.com/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
The captured screenshot of kdtrader.com, taken on 2026-10-26, shows a dark screen with an app-style square logo, the heading Connect your wallet, the instruction to use a decentralized application to access, and a bright green Connect wallet button. PhishDestroy listed the domain following a URLScan malicious verdict, with first observation on 2026-10-26. The domain registration date recorded is 2019-11-02.

How the scam works
The page presents a wallet-connection prompt that asks visitors to connect a decentralized application wallet before proceeding. Once connected, drainer contracts can seek token approvals or transaction signatures that transfer assets away without any visible exchange of funds. As a category risk, this is the standard entry point for a crypto wallet drainer.

Evidence
The screenshot shows the Connect your wallet heading, the decentralized-application instruction and the green Connect wallet button as observed on 2026-10-26. URLScan returned a malicious verdict on 2026-10-26 with an ML score of 98 and a phishing category, and the redirect stayed on kdtrader.com with no cross-site hop observed. VirusTotal was not flagged on its analysis, and Spamhaus and Google Safe Browsing were also not flagged on 2026-10-26, while two external blocklists (MetaMask and SEAL) plus the PhishDestroy internal blocklist had it listed and OTX recorded 0 pulses. Site inspection revealed a uni-app stack with UniApp and webpackJsonp globals, Cloudflare beacon tracking, and 9 distinct script SHA256 hashes recorded for pivoting, one beginning bf2a7c49dae0.

Infrastructure
Missing headers are the main weakness: Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, COOP, COEP and CORP were all absent, while HSTS was present with max-age 31536000. The registrar is GoDaddy and Cloudflare served as both CDN and WAF; DNSSEC is unsigned, DMARC is present with no SPF lookups recorded and no DKIM evidence, and a CAA record is present. TLS 1.3, TLS_AES_256_GCM_SHA384, forward secrecy, ALPN h2.

What to do
If you connected a wallet or submitted data on this page, disconnect from kdtrader.com, review your wallet connections and token approvals and revoke anything you do not recognise, then move remaining assets to a wallet not used on this site. Report the page to your browser or wallet vendor, and block only the exact domain kdtrader.com. Defenders should add kdtrader.com to blocklists, watch the recorded script hashes for pivots, and hunt for the same uni-app template in related campaigns.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a175c6-a264-7559-a199-7c292668c197/
Cloudflare Radar report: https://radar.cloudflare.com/scan/474d8f05-58ec-4e4e-8386-dfaa46915cb4
Stored capture screenshot: https://urlscan.io/screenshots/01a175c6-a264-7559-a199-7c292668c197.png
Cloudflare Radar screenshot (2026-10-26T16:31:06Z): https://screenshots.phishdestroy.io/cf/474d8f05-58ec-4e4e-8386-dfaa46915cb4.png
URLScan screenshot (2026-10-26T16:34:26Z): https://screenshots.phishdestroy.io/us/01a1790f-7f60-7118-8e14-8f415f5e2a12.png
URLScan capture report: https://urlscan.io/result/01a1790f-7f60-7118-8e14-8f415f5e2a12/
VirusTotal report: https://www.virustotal.com/gui/domain/kdtrader.com
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=kdtrader.com
Revoke token approvals: https://revoke.cash/
Report crypto fraud (Chainabuse): https://www.chainabuse.com/report
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-26 20:36:46 UTC

## Stored page captures

- Primary capture: https://urlscan.io/screenshots/01a175c6-a264-7559-a199-7c292668c197.png
  Captured: 2026-10-26 16:18:44 UTC
- URLScan capture 1: https://screenshots.phishdestroy.io/01a175c6-a264-7559-a199-7c292668c197.png
  Source report: https://urlscan.io/result/01a175c6-a264-7559-a199-7c292668c197/
- URLScan · 2026-10-26: https://screenshots.phishdestroy.io/us/01a1790f-7f60-7118-8e14-8f415f5e2a12.png
  Captured: 2026-10-26 16:34:26 UTC
  Source report: https://urlscan.io/result/01a1790f-7f60-7118-8e14-8f415f5e2a12/
  SHA-256: bc73ad8aa267cbe35a2195797937a5e0547744c3c109b269b5a99731ff73e45f
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/474d8f05-58ec-4e4e-8386-dfaa46915cb4.png
  Captured: 2026-10-26 16:31:06 UTC
  Source report: https://radar.cloudflare.com/scan/474d8f05-58ec-4e4e-8386-dfaa46915cb4
  SHA-256: 8252ea1703cee86cb8acb4409088a64c61caa04e0023783cfbe7161ef6847c2e

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-26T16:33:05Z",
        "uuid": "01a175c6-a264-7559-a199-7c292668c197",
        "scanned_at": "2026-10-26T01:15:32Z",
        "final_url": "https://kdtrader.com/",
        "status": 200,
        "redirects": [
            {
                "to": "https://kdtrader.com/",
                "from": "https://kdtrader.com/"
            }
        ],
        "ip": "172.67.201.236",
        "domains": [
            "pct-trading.com",
            "admin.quantifyai.top",
            "static.cloudflareinsights.com",
            "cdn.dcloud.net.cn",
            "at.alicdn.com"
        ],
        "ips": [
            "124.174.83.126",
            "35.192.206.179",
            "163.181.60.212",
            "104.21.35.35",
            "104.16.80.73",
            "172.67.201.236"
        ],
        "asns": [
            "137718",
            "396982",
            "24429",
            "13335"
        ],
        "countries": [
            "CN",
            "US"
        ],
        "doc_hash": "7bc6e5d60855975114a98ccba285684a214076d12e8bbed0dab81200bb3378c6",
        "script_hashes": [
            "bf2a7c49dae03862dab63cbab5988ede7d814c3a2ce7c023f0aabca99f6fbfa2",
            "e37dd03f953af7b726382ac52cc1ae7f37bd385f20ea839cdc36029939a91c39",
            "b2bc5b30878eba3d66e8ec769a7407dab805a175dd33ce6017186a0a9c10c31c",
            "b079aa59c3a914217b2bf5f4e2f0b0699d85c3c5e9a692e4784168e9ea145a7a",
            "ee1058ecf154ec5842162ba4bbf377eb6936760b383714be1ffbae716a2849c8",
            "2ac1ac3ad7ef4c4926362c19855873a64a2df08c00b888975e92c75e436c629c",
            "2e6ffb8cf545a0c2f862b2911b8955c3f4c2a4646b854d3ca31630800ffbf4cc",
            "da221fe808021760c016d14eb22dc6641959396c254dc1112ab8899096ab089b",
            "5c8813c8732c741061564212c0a41bccd4bf2648d1acca2373b9b5add0ce5f1f"
        ],
        "globals": [
            "coverSupport",
            "a0_0xa678",
            "a0_0x4aa6",
            "a1_0x513ef2",
            "a1_0x4b94",
            "a1_0x4c13",
            "webpackJsonp",
            "a2_0x3d6b",
            "a2_0x2bb4",
            "__uniConfig",
            "__uniRoutes",
            "UniApp",
            "UniViewJSBridge",
            "UniServiceJSBridge",
            "uni",
            "wx",
            "getApp",
            "getCurrentPages",
            "clearImmediate",
            "setImmediate",
            "regeneratorRuntime",
            "__cfBeacon",
            "a4_0x1f7ca1",
            "a4_0x16a6",
            "a4_0x1d8f",
            "a23_0x1946ce",
            "a23_0xfdd8",
            "a23_0x23a0",
            "a24_0x4445ec",
            "a24_0x166f",
            "a24_0xa0e2",
            "a22_0xfb7b",
            "a22_0x2fa5b7",
            "a22_0xb6ab",
            "a18_0x4979b7",
            "a18_0x2206",
            "a18_0x480f",
            "a19_0x4193",
            "a19_0x51419b",
            "a19_0xcda1"
        ],
        "cookies": [
            "__uni__uid"
        ],
        "storage_keys": [
            "__storage_test__",
            "__DC_STAT_UUID",
            "devInfo",
            "h5_version",
            "_language",
            "WzDetail"
        ],
        "tls": {
            "san": [
                "kdtrader.com",
                "*.kdtrader.com"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "WE1",
            "subject": "kdtrader.com",
            "protocol": "QUIC",
            "valid_to": "2027-01-05T18:14:44Z",
            "valid_from": "2026-10-07T17:16:00Z"
        },
        "domain_age_days": 1349,
        "apex_age_days": 1349,
        "tls_age_days": 18,
        "tls_valid_days": 90,
        "requests": 176,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 98,
                "malicious": true
            },
            "overall": {
                "tags": [
                    "phishing"
                ],
                "score": 100,
                "brands": [
                    "generic"
                ],
                "malicious": true,
                "categories": [
                    "phishing"
                ]
            },
            "urlscan": {
                "tags": [
                    "phishing"
                ],
                "score": 100,
                "brands": [
                    "Generic"
                ],
                "malicious": true,
                "categories": [
                    "phishing"
                ]
            }
        },
        "headers": {
            "server": "cloudflare",
            "content-type": "text/html",
            "strict-transport-security": "max-age=31536000"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-26T16:33:18Z",
        "uuid": "474d8f05-58ec-4e4e-8386-dfaa46915cb4",
        "scanned_at": "2026-10-26T16:31:06Z",
        "final_url": "https://kdtrader.com/",
        "status": 200,
        "history": [
            {
                "url": "https://kdtrader.com/",
                "status": 200
            },
            {
                "url": "https://kdtrader.com/",
                "status": 200
            }
        ],
        "dom_hash": "79dc18a085e4ff0d7f5efe65f61b3c0b14ac347cc92c211fed211d8aa4230159",
        "doc_hash": "7bc6e5d60855975114a98ccba285684a214076d12e8bbed0dab81200bb3378c6",
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "kdtrader.com",
                "type": "A",
                "value": "188.114.96.0"
            },
            {
                "name": "kdtrader.com",
                "type": "A",
                "value": "188.114.97.0"
            },
            {
                "name": "kdtrader.com",
                "type": "AAAA",
                "value": "2a06:98c1:3121::"
            },
            {
                "name": "kdtrader.com",
                "type": "AAAA",
                "value": "2a06:98c1:3120::"
            }
        ],
        "dnssec_valid": false,
        "ip": "188.114.96.0",
        "whois": {
            "registrar": "GoDaddy.com, LLC",
            "created": "2019-11-02T09:49:24Z",
            "updated": "2026-10-22T07:09:06Z",
            "expires": "2027-11-02T09:49:24Z",
            "nameservers": [
                "erin.ns.cloudflare.com",
                "piers.ns.cloudflare.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-26T16:28:07Z",
        "analysis_at": "2026-08-09T18:25:08Z",
        "stats": {
            "timeout": 0,
            "harmless": 56,
            "malicious": 0,
            "suspicious": 0,
            "undetected": 36
        },
        "reputation": 0,
        "registrar": "GoDaddy.com, LLC",
        "created": "2019-11-02T09:49:24Z",
        "expires": "2026-11-02T09:49:24Z",
        "updated": "2025-12-16T15:45:36Z",
        "first_seen": "2026-03-07T07:59:17Z",
        "dns": [
            {
                "ttl": 1800,
                "type": "SOA",
                "rname": "dns.cloudflare.com",
                "value": "erin.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3030::6815:4ce3"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "104.21.76.227"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "piers.ns.cloudflare.com"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "erin.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "172.67.201.236"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3032::ac43:c9ec"
            }
        ],
        "dns_at": "2026-08-09T18:35:38Z",
        "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c",
        "cert": {
            "san": [
                "kdtrader.com",
                "*.kdtrader.com"
            ],
            "issuer": "Google Trust Services / WE1",
            "serial": "cca95cd1d2f142b313ad9e52ab0cc942",
            "sha256": "5f8a71b74985f1b710b3c0a83c77ca18c870c0322f8a66e8e1fd45cb357f8a72",
            "subject": "kdtrader.com",
            "valid_to": "2026-11-07T17:45:43Z",
            "valid_from": "2026-08-09T16:48:12Z"
        },
        "whois": {
            "registrar": "GoDaddy.com, LLC",
            "registrar_iana_id": "146",
            "registrar_url": "http://www.godaddy.com",
            "created": "2019-11-02T09:49:24Z",
            "updated": "2025-12-16T15:45:36Z",
            "expires": "2026-11-02T09:49:24Z",
            "status": [
                "clientDeleteProhibited",
                "clientRenewProhibited",
                "clientTransferProhibited",
                "clientUpdateProhibited"
            ],
            "nameservers": [
                "erin.ns.cloudflare.com",
                "piers.ns.cloudflare.com"
            ],
            "dnssec": "unsigned"
        },
        "rdap": {
            "status": [
                "client delete prohibited",
                "client renew prohibited",
                "client transfer prohibited",
                "client update prohibited"
            ],
            "events": {
                "expiration": "2026-11-02T09:49:24Z",
                "last changed": "2025-12-16T15:45:36Z",
                "registration": "2019-11-02T09:49:24Z",
                "last update of RDAP database": "2026-08-09T18:35:30Z"
            }
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-26T16:39:26Z",
        "mail_config": {
            "dmarc": true,
            "spf_lookups": 0
        },
        "caa_records": {
            "domain": "kdtrader.com"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_count": 0
        },
        "archives": {
            "last": "2026-10-26T16:25:16Z",
            "first": "2011-10-09T13:01:09Z",
            "changes": 3,
            "days_archived": 6,
            "scans_per_day": 0,
            "avg_page_bytes": 2514
        },
        "robots_txt": {
            "agents": [
                "*",
                "Amazonbot",
                "Applebot-Extended",
                "Bytespider",
                "CCBot"
            ],
            "present": true
        },
        "social_tags": {
            "ogUrl": "https://quantifyai.top",
            "title": "The best trading platform Offers a safe, transparent, and fast trading experience!",
            "ogType": "product",
            "ogImage": "https://quantifyai.top/static/h5_logo1.png",
            "ogTitle": "The best trading platform Offers a safe, transparent, and fast trading experience!",
            "twitterCard": "summary_large_image",
            "ogDescription": "The best trading platform Offers a safe, transparent, and fast trading experience!"
        },
        "mixed_content": {
            "third_party_scripts": 0
        },
        "status": {
            "up": true,
            "code": 200,
            "timings": {
                "dns": 14,
                "tls": 48,
                "wait": 373,
                "connect": 8,
                "download": 0
            },
            "response_ms": 443
        },
        "tls_connection": {
            "alpn": "h2",
            "cipher": "TLS_AES_256_GCM_SHA384",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1",
                "TLSv1.1",
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                80,
                443,
                8080
            ]
        },
        "carbon": {
            "bytes": 2609,
            "co2_grams": 0.0001,
            "cleaner_than": 95
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "108.162.195.16",
                    "host": "piers.ns.cloudflare.com"
                },
                {
                    "ip": "108.162.192.113",
                    "host": "erin.ns.cloudflare.com"
                }
            ],
            "zone": "kdtrader.com"
        },
        "location": {
            "ip": "2a06:98c1:3121::3",
            "asn": "13335",
            "org": "CloudFLARENET-EU",
            "city": "London",
            "country": "GB"
        },
        "ssl": {
            "issuer": "Google Trust Services / WE1",
            "subject": "kdtrader.com"
        },
        "dns": {
            "A": [
                "188.114.96.3",
                "188.114.97.3"
            ],
            "NS": [
                "erin.ns.cloudflare.com",
                "piers.ns.cloudflare.com"
            ],
            "SOA": "{\"nsname\": \"erin.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2416882674, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}",
            "AAAA": [
                "2a06:98c1:3120::3",
                "2a06:98c1:3121::3"
            ]
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "hsts": {
            "header": "max-age=31536000",
            "message": "HSTS header does not include all subdomains."
        },
        "http_security": {
            "xFrameOptions": false,
            "referrerPolicy": false,
            "xXSSProtection": false,
            "permissionsPolicy": false,
            "xContentTypeOptions": false,
            "contentSecurityPolicy": false,
            "strictTransportPolicy": "max-age=31536000",
            "crossOriginOpenerPolicy": false,
            "crossOriginEmbedderPolicy": false,
            "crossOriginResourcePolicy": false
        },
        "firewall": {
            "waf": "Cloudflare",
            "has_waf": true
        },
        "get_ip": {
            "ip": "2a06:98c1:3121::3",
            "family": 6
        },
        "redirects": {
            "chain": [
                "https://kdtrader.com"
            ]
        },
        "whois": {
            "registrar": "GoDaddy.com, LLC",
            "created": "2019-11-02T09:49:24Z",
            "updated": "2026-10-22T07:09:06Z",
            "expires": "2027-11-02T09:49:24Z",
            "status": [
                "clientDeleteProhibited https://icann.org/epp",
                "clientRenewProhibited https://icann.org/epp",
                "clientTransferProhibited https://icann.org/epp",
                "clientUpdateProhibited https://icann.org/epp"
            ],
            "nameservers": [
                "erin.ns.cloudflare.com",
                "piers.ns.cloudflare.com"
            ]
        },
        "headers": {
            "headers": {
                "server": "cloudflare",
                "content-type": "text/html",
                "strict-transport-security": "max-age=31536000"
            }
        }
    }
}
```