# PhishDestroy domain threat record: m-tradwise.com Content language: English Canonical HTML report: https://phishdestroy.io/domain/m-tradwise.com/ Machine-readable companion: https://phishdestroy.io/domain/m-tradwise.com/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-10-26 16:18:45 UTC - Last availability or vendor check: 2026-10-27 23:04:18 UTC - Stored record updated: 2026-10-27 23:23:28 UTC - VirusTotal detections in the stored snapshot: 0/92 - Independent public blocklist matches in the stored snapshot: 2 - Matching public blocklists: MetaMask, SEAL - Google Safe Browsing stored result: no stored flag ## Stored infrastructure - Observed IP address: 64.20.39.203 - Registrar in stored WHOIS data: TUCOWS.COM, CO. - Registrar country in stored WHOIS data: CA - Last stored HTTP status: 200 - Registration date in stored WHOIS data: 2026-09-17 20:53:05 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a17910-25f5-74a7-8f51-654bdaafcaef/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/m-tradwise.com - Certificate Transparency search: https://crt.sh/?q=%25.m-tradwise.com - Web Archive lookup: https://web.archive.org/web/*/https://m-tradwise.com/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview The captured screenshot shows a dark-themed page headlined SAFE INVESTMENT WITH M-TRADWISE CRYPTO INVESTMENTS, beside a GET LIFETIME INCOME ON INVESTMENT call to action and an OPEN DEPOSIT button, with a live crypto price ticker, Registration and Login links and a language switcher. PhishDestroy listed m-tradwise.com as a fraudulent-investment category risk after multi-source intake on 2026-10-26, first seen by PhishDestroy on 2026-10-26. How the scam works The page steers visitors toward opening a deposit under a promise of lifetime income, the pattern seen in schemes that solicit crypto deposits against guaranteed returns. Registration and login entry points collect credentials and deposit intent, so the mechanism enables fund loss without any verifiable investment outcome. Evidence The screenshot documents the lifetime-income offer, the OPEN DEPOSIT button, the ticker and the registration and login forms. URLScan scored the capture malicious with an ML score of 96 and labelled it phishing and cryptoscam on 2026-10-26, while a redirect from the HTTP form to the HTTPS form returned a 307 status; Cloudflare Radar recorded a Scam risk. VirusTotal did not flag it, and Spamhaus listed it as not listed, yet blocklists MetaMask and SEAL plus the PhishDestroy internal list flagged it (2 external lists) and OTX recorded 4 pulses. Site inspection shows a jQuery, GSAP and CreateJS/Adobe Animate stack with Tawk chat, Google Tag Manager and Clarity trackers, and 5 distinct script SHA256 hashes recorded for campaign pivoting, the first hash beginning f554d2f09272. Infrastructure Registrar of record is Tucows Domains Inc., registered 2026-09-17, with hosting recorded at Interserver, Inc and no WAF or firewall recorded for m-tradwise.com. Weaknesses lead: Content-Security-Policy, HSTS/strict-transport, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, COOP, COEP and CORP all absent; DNSSEC unsigned. Then TLS 1.3 with AES-256-GCM, forward secrecy and ALPN h2; SPF and DKIM present with DMARC; CAA present. What to do If you submitted credentials or deposit details on m-tradwise.com, change the password on any genuine service where you reused it, enable 2FA there, and contact your financial provider about any transfer you made. Defenders should block m-tradwise.com only, use the recorded script hashes for campaign pivoting, and monitor for related registrations. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a17910-25f5-74a7-8f51-654bdaafcaef/ Cloudflare Radar report: https://radar.cloudflare.com/scan/4f23ca92-9735-4d81-9937-f9c255f3fd41 URLQuery report: https://urlquery.net/report/037baede-1c73-4e15-89c0-55c88508e09e Stored capture screenshot: https://urlscan.io/screenshots/01a17910-25f5-74a7-8f51-654bdaafcaef.png Cloudflare Radar screenshot (2026-10-26T16:31:05Z): https://screenshots.phishdestroy.io/cf/4f23ca92-9735-4d81-9937-f9c255f3fd41.png URLQuery screenshot: https://screenshots.phishdestroy.io/uq/037baede-1c73-4e15-89c0-55c88508e09e.png URLScan screenshot (2026-10-26T16:49:14Z): https://screenshots.phishdestroy.io/us/01a1791d-53e7-724a-87a2-909099295b38.png URLScan capture report: https://urlscan.io/result/01a1791d-53e7-724a-87a2-909099295b38/ VirusTotal report: https://www.virustotal.com/gui/domain/m-tradwise.com Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=m-tradwise.com Archived copy: https://web.archive.org/web/20261026162544/https://m-tradwise.com/ Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-26 20:12:19 UTC ## Stored page captures - Primary capture: https://urlscan.io/screenshots/01a17910-25f5-74a7-8f51-654bdaafcaef.png Captured: 2026-10-26 16:36:25 UTC - URLScan capture 1: https://screenshots.phishdestroy.io/01a17910-25f5-74a7-8f51-654bdaafcaef.png Captured: 2026-10-26 16:36:25 UTC Source report: https://urlscan.io/result/01a17910-25f5-74a7-8f51-654bdaafcaef/ - URLScan capture 2: https://urlscan.io/screenshots/01a17702-e1a8-701e-b54e-381e811da238.png Captured: 2026-10-26 16:18:45 UTC Source report: https://urlscan.io/result/01a17910-25f5-74a7-8f51-654bdaafcaef/ - URLScan · 2026-10-26: https://screenshots.phishdestroy.io/us/01a1791d-53e7-724a-87a2-909099295b38.png Captured: 2026-10-26 16:49:14 UTC Source report: https://urlscan.io/result/01a1791d-53e7-724a-87a2-909099295b38/ SHA-256: d25e45d75fc2a516d7cf345ae59abbe10eaaca697ebd4e393e3ffa1c8b4598b6 - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/4f23ca92-9735-4d81-9937-f9c255f3fd41.png Captured: 2026-10-26 16:31:05 UTC Source report: https://radar.cloudflare.com/scan/4f23ca92-9735-4d81-9937-f9c255f3fd41 SHA-256: ed8d645b19d97a0aae12eeadbfd31b6b1d105d5bc6d3af9450d8c87661219d3f - URLQuery: https://screenshots.phishdestroy.io/uq/037baede-1c73-4e15-89c0-55c88508e09e.png Source report: https://urlquery.net/report/037baede-1c73-4e15-89c0-55c88508e09e SHA-256: b829fbb3a5cf64f23eaa3fa24abd018607863d7c38897bb0f9fa46ee84b79232 ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-26T17:06:16Z", "uuid": "01a17910-25f5-74a7-8f51-654bdaafcaef", "scanned_at": "2026-10-26T16:34:32Z", "final_url": "https://m-tradwise.com/", "status": 200, "redirected": "https-only", "redirects": [ { "to": "https://m-tradwise.com/", "from": "http://m-tradwise.com/", "status": 307 } ], "ip": "64.20.39.203", "domains": [ "www.tradingview-widget.com", "s2.coinmarketcap.com", "widget.coinlib.io", "s3-symbol-logo.tradingview.com", "embed.tawk.to", "widgetdata.tradingview.com", "widget-sheriff.tradingview-widget.com", "s3.tradingview.com", "va.tawk.to", "www.googletagmanager.com", "cdnjs.cloudflare.com", "fonts.gstatic.com", "fonts.googleapis.com", "code.createjs.com", "www.clarity.ms", "static.whatshelp.io" ], "ips": [ "142.251.20.97", "108.138.7.88", "172.66.161.212", "108.138.26.10", "142.251.127.94", "142.251.14.95", "216.150.16.129", "23.44.215.195", "185.111.111.157", "104.17.25.14", "64.20.39.203" ], "asns": [ "15169", "16509", "13335", "20940", "212238", "19318" ], "countries": [ "US", "CZ", "DE" ], "link_domains": [ "coinlib.io", "www.tradingview.com" ], "doc_hash": "04d05978fdb111358073ab0524e5c1fafc0826615c206987618416b8bd8a4747", "script_hashes": [ "f554d2f09272c6f71447ebfe4532d3b1dd1959bce669f9a5ccc99e64ef511729", "3080edfd181c84e9a02b4b7c3de1445ff5e8c4d855500deb776b6615dc2a138f", "b0ae81165dd22ea20a9dfe56e8d184a5b931fd484f8779fd0ca5c5da56d59f90", "87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de", "a2e77918046fe456ba3d874ccddd3d0bf40a9774c0ffe5d70b08e069b777e847" ], "globals": [ "$", "jQuery", "gsapVersions", "notifier", "StickySidebar", "createjs", "JSON3", "AdobeAn", "canvas", "stage", "exportRoot", "anim_container", "dom_overlay_container", "fnStartAnimation", "init", "handleFileLoad", "handleComplete", "Tawk_API", "Tawk_LoadStart", "select", "tar", "minMoneyur2", "minMoneyu2", "maxMoneyu2", "valut", "minMoneyur3", "minMoneyu3", "maxMoneyu3", "minMoneyur4", "minMoneyu4", "maxMoneyu4", "minMoneyr", "minMoney", "maxMoney", "amount", "daily", "weekly", "mountly", "Modal", "$_Tawk_AccountKey" ], "cookies": [ "XSRF-TOKEN", "cryptocurrency_investments_session", "twk_idm_key", "TawkConnectionTime" ], "storage_keys": [ "exist_test" ], "domain_age_days": 1091, "apex_age_days": 1091, "tls_age_days": 37, "tls_valid_days": 89, "requests": 310, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 96, "malicious": true }, "overall": { "tags": [ "phishing" ], "score": 100, "brands": [ "cryptoscam" ], "malicious": true, "categories": [ "phishing" ] }, "urlscan": { "tags": [ "phishing" ], "score": 100, "brands": [ "Crypto Scam" ], "malicious": true, "categories": [ "phishing" ] } }, "headers": { "content-type": "image/png" } }, "cf": { "v": 1, "fetched_at": "2026-10-26T16:33:17Z", "uuid": "4f23ca92-9735-4d81-9937-f9c255f3fd41", "scanned_at": "2026-10-26T16:31:05Z", "final_url": "https://m-tradwise.com/", "status": 200, "history": [ { "url": "https://m-tradwise.com/", "status": 200 } ], "dom_hash": "822a839cb1eac93a824b1acd177e6ddd9e018e25fd4c13b645f6b91f0941357b", "doc_hash": "42f6df9731498836b02bf0e9478ca05207b879edba70ae7263ae5569c59dc458", "url_risks": [ "Scam" ], "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "m-tradwise.com", "type": "A", "value": "64.20.39.203" } ], "dnssec_valid": false, "ip": "64.20.39.203", "whois": { "registrar": "Tucows Domains Inc.", "created": "2026-09-17T22:53:05Z", "updated": "2026-09-19T03:13:38Z", "expires": "2027-09-17T22:53:05Z", "nameservers": [ "dns2000a.trouble-free.net", "dns2000b.trouble-free.net" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-26T20:09:35Z", "analysis_at": "2026-10-26T17:08:44Z", "stats": { "timeout": 0, "harmless": 56, "malicious": 0, "suspicious": 0, "undetected": 36 }, "reputation": 0, "created": "2023-10-30T00:00:00Z", "updated": "2025-11-03T00:00:00Z", "first_seen": "2023-11-01T08:04:23Z", "dns": [ { "ttl": 14400, "type": "MX", "value": "m-tradwise.com", "priority": 0 }, { "ttl": 21600, "type": "SOA", "rname": "not-monitored-email.interserver.net", "value": "dns2000a.trouble-free.net" }, { "ttl": 14400, "type": "TXT", "value": "v=spf1 +a +mx +ip4:64.20.39.202 include:relay.mailbaby.net ~all" }, { "ttl": 21600, "type": "NS", "value": "dns2000a.trouble-free.net" }, { "ttl": 21600, "type": "NS", "value": "dns2000b.trouble-free.net" }, { "ttl": 14400, "type": "A", "value": "64.20.39.203" } ], "dns_at": "2026-10-26T17:14:03Z", "jarm": "29d29d00029d29d00042d43d00041d598ac0c1012db967bb1ad0ff2491b3ae", "cert": { "san": [ "*.m-tradwise.com", "m-tradwise.com", "wh1558344.ispot.cc" ], "issuer": "Let's Encrypt / YR1", "serial": "50f313cfa111af94a913d58c1be7a8fe369", "sha256": "3194c0001b268dca6014c4012930dec954f3585e32a3f0c0e6c5ec30203a37bc", "subject": "wh1558344.ispot.cc", "valid_to": "2026-12-18T03:36:22Z", "valid_from": "2026-09-19T03:36:23Z" }, "whois": [], "rdap": { "events": { "last changed": "2026-09-19T03:13:38Z", "registration": "2026-09-17T22:53:05Z", "registrar expiration": "2027-09-17T22:53:05Z", "last update of RDAP database": "2026-09-19T03:13:38Z" }, "registrar": "TUCOWS.COM, CO.", "registrar_iana_id": "69" } }, "webcheck": { "v": 1, "fetched_at": "2026-10-26T16:39:03Z", "mail_config": { "mx": [ "m-tradwise.com" ], "spf": "v=spf1 +a +mx +ip4:64.20.39.202 include:relay.mailbaby.net ~all", "dkim": [ "default" ], "dmarc": true, "dkim_bits": 2048, "spf_lookups": 5 }, "caa_records": { "domain": "m-tradwise.com" }, "block_lists": { "resolvers": 12, "blocked_count": 0 }, "archives": { "last": "2026-10-26T16:25:44Z", "first": "2023-11-02T08:37:55Z", "changes": 6, "days_archived": 7, "scans_per_day": 0.01, "avg_page_bytes": 6940 }, "robots_txt": { "agents": [ "*" ], "present": true }, "social_tags": { "title": "M-TRADWISE CRYPTO INVESTMENTS – Safe investment with M-TRADWISE CRYPTO INVESTMENTS" }, "trackers": { "requests": 219, "trackers": [ { "name": "Tawk", "company": "Tawk", "country": "US", "category": "Customer Interaction", "requests": 1 }, { "name": "Cloudflare", "company": "Cloudflare", "country": "US", "category": "Hosting", "requests": 1 }, { "name": "CreateJS", "company": "CreateJS", "category": "Hosting", "requests": 1 }, { "name": "Google Fonts", "company": "Google", "country": "US", "category": "Hosting", "requests": 1 }, { "name": "Google Static", "company": "Google", "country": "US", "category": "Hosting", "requests": 1 } ] }, "mixed_content": { "no_sri": [ "https://s3.tradingview.com/external-embedding/embed-widget-market-overview.js", "https://s3.tradingview.com/external-embedding/embed-widget-forex-cross-rates.js", "https://s3.tradingview.com/external-embedding/embed-widget-ticker-tape.js", "https://code.createjs.com/createjs-2015.11.26.min.js" ], "third_party_scripts": 4 }, "status": { "up": true, "code": 200, "timings": { "dns": 3, "tls": 202, "wait": 881, "connect": 93, "download": 157 }, "response_ms": 1336 }, "tls_connection": { "alpn": "h2", "cipher": "TLS_AES_256_GCM_SHA384", "protocol": "TLSv1.3", "versions": [ "TLSv1.2", "TLSv1.3" ], "authorized": true, "forward_secrecy": true }, "ports": { "open": [ 21, 22, 25, 53, 80, 110, 143, 443, 587, 993, 995, 3306 ] }, "carbon": { "bytes": 84331, "co2_grams": 0.0031, "cleaner_than": 26 }, "dns_server": { "ns": [ { "ip": "64.20.39.202", "host": "dns2000a.trouble-free.net" }, { "ip": "64.20.39.203", "host": "dns2000b.trouble-free.net" } ], "zone": "m-tradwise.com" }, "cookies": { "cookies": [ { "name": "XSRF-TOKEN", "secure": true, "same_site": "Lax" }, { "name": "cryptocurrency_investments_session", "secure": true, "http_only": true, "same_site": "Lax" } ] }, "location": { "ip": "64.20.39.203", "asn": "19318", "org": "Interserver, Inc", "city": "Secaucus", "country": "US" }, "ssl": { "issuer": "Let's Encrypt / YR1", "subject": "wh1558344.ispot.cc" }, "dns": { "A": [ "64.20.39.203" ], "MX": [ "{\"exchange\": \"m-tradwise.com\", \"priority\": 0}" ], "NS": [ "dns2000a.trouble-free.net", "dns2000b.trouble-free.net" ], "SOA": "{\"nsname\": \"dns2000a.trouble-free.net\", \"hostmaster\": \"not-monitored-email.interserver.net\", \"serial\": 2026102605, \"refresh\": 3600, \"retry\": 1800, \"expire\": 1209600, \"minttl\": 86400}", "TXT": [ "v=spf1 +a +mx +ip4:64.20.39.202 include:relay.mailbaby.net ~all" ] }, "dnssec": { "ds": false, "rrsig": false, "dnskey": false }, "hsts": { "message": "Site does not serve any HSTS headers." }, "http_security": { "xFrameOptions": false, "referrerPolicy": false, "xXSSProtection": false, "permissionsPolicy": false, "xContentTypeOptions": false, "contentSecurityPolicy": false, "strictTransportPolicy": false, "crossOriginOpenerPolicy": false, "crossOriginEmbedderPolicy": false, "crossOriginResourcePolicy": false }, "get_ip": { "ip": "64.20.39.203", "family": 4 }, "redirects": { "chain": [ "https://m-tradwise.com" ] }, "linked_pages": { "external": [ "https://coinlib.io/", "https://www.tradingview.com/" ], "external_count": 2, "internal_count": 12 }, "whois": { "registrar": "Tucows Domains Inc.", "created": "2026-09-17T22:53:05Z", "updated": "2026-09-19T03:13:38Z", "expires": "2027-09-17T22:53:05Z", "status": [ "ok https://icann.org/epp" ], "nameservers": [ "dns2000a.trouble-free.net", "dns2000b.trouble-free.net" ] }, "headers": { "headers": { "server": "LiteSpeed", "content-type": "text/html; charset=UTF-8", "x-powered-by": "PHP/7.3.33" } } } } ```