# PhishDestroy domain threat record: optigain.pro

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/optigain.pro/
Machine-readable companion: https://phishdestroy.io/domain/optigain.pro/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: unknown
- First observed by PhishDestroy: 2026-10-26 19:56:54 UTC
- Stored record updated: 2026-10-26 20:36:45 UTC
- VirusTotal detections in the stored snapshot: 15/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: ledger

## Stored infrastructure

- Observed IP address: 185.62.58.129
- Registrar in stored WHOIS data: Spaceship, Inc.
- Last stored HTTP status: 200
- Registration date in stored WHOIS data: 2026-09-14 10:08:35 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a0c896-1a0f-746f-a1d5-cd402f7a3f9d/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/optigain.pro
- Certificate Transparency search: https://crt.sh/?q=%25.optigain.pro
- Web Archive lookup: https://web.archive.org/web/*/https://optigain.pro/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
The captured screenshot dated 2026-10-26 shows an Optigain landing page headlined Optigain empowers AI-driven automated trading bots beside a panel titled Open your Optigain account. The form requests given name, family name, email address and phone number behind a Verify you are human check, while a footer disclaimer states the site functions solely as a marketing platform. PhishDestroy listed optigain.pro after VirusTotal flagged it as malicious and internal review accepted the case on 2026-10-26. The domain was first seen by PhishDestroy on 2026-10-26.

How the scam works
The page presents a streamlined sign-up path engineered for rapid onboarding, inviting visitors to submit identifying details under an AI trading automation offer. As a category risk, such forms can capture names, email addresses and phone numbers for follow-up social-engineering or investment-lure approaches. The on-page disclaimer that the site does not facilitate any trading or investment services conflicts with the trading-bot claims used to draw sign-ups.

Evidence
The screenshot shows the trading-bot headline, feature tiles labelled Encrypted sessions and Secure by design, Terms of Service, Privacy Policy and Cookie Policy links, and a Cloudflare human-verification checkbox. The urlscan scan captured on 2026-09-22 returned an engine verdict of malicious with an ML score of 99 while its overall verdict stayed clean, and its redirect funnel only moved the request from http to https with status 307. VirusTotal flagged the domain as malicious with vendors including Kaspersky, BitDefender and Sophos labelling it phishing; Cloudflare Radar returned a malicious verdict on 2026-10-26, OTX recorded 3 pulses checked on 2026-10-26, while Google Safe Browsing did not flag it on 2026-10-26 and external blocklists returned 0 entries that day. Site inspection recorded globals ClientJS and toggleTermsPopup with no recognizable SPA framework, 20 requests with trackers Cloudflare, Google Fonts, Google Static and jsDelivr, and 1 distinct script SHA256 hash retained for pivoting, ccf00d1923b0.

Infrastructure
Notable weaknesses lead: CSP and HSTS absent, X-Frame-Options absent, X-Content-Type-Options absent, Permissions-Policy absent, COOP, COEP and CORP absent, Referrer-Policy set to no-referrer-when-downgrade; SPF lookups recorded at zero with no DKIM or DMARC; DNSSEC unsigned. TLS 1.3, TLS_AES_128_GCM_SHA256, forward secrecy, ALPN h2; a CAA record is present. Registration was recorded on 2026-09-14 through registrar Spaceship, Inc., with Cloudflare nameservers and hosting recorded at Snel.com B.V.

What to do
If you submitted data through this form, change your password on the genuine trading service you use and enable two-factor authentication, and treat any unsolicited investment contact referencing Optigain with suspicion. Monitor your email and financial accounts for follow-up targeting and forward the capture to your security team. Defenders should block optigain.pro at DNS and proxy layers and add the recorded script hash to hunting rules.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a0c896-1a0f-746f-a1d5-cd402f7a3f9d/
Cloudflare Radar report: https://radar.cloudflare.com/scan/7c78cf74-d950-4920-9dae-7abf222bd97c
Stored capture screenshot: https://urlscan.io/screenshots/01a0c896-1a0f-746f-a1d5-cd402f7a3f9d.png
Cloudflare Radar screenshot (2026-10-26T19:58:23Z): https://screenshots.phishdestroy.io/cf/7c78cf74-d950-4920-9dae-7abf222bd97c.png
URLScan screenshot (2026-09-21T09:01:01Z): https://screenshots.phishdestroy.io/us/01a0c332-6952-774b-9d6b-18066b623acd.png
URLScan capture report: https://urlscan.io/result/01a0c332-6952-774b-9d6b-18066b623acd/
URLScan screenshot (2026-09-21T10:53:29Z): https://screenshots.phishdestroy.io/us/01a0c399-5d12-701b-b1e9-aefb8f227887.png
URLScan capture report: https://urlscan.io/result/01a0c399-5d12-701b-b1e9-aefb8f227887/
VirusTotal report: https://www.virustotal.com/gui/domain/optigain.pro
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=optigain.pro
Archived copy: https://web.archive.org/web/20261026195808/https://optigain.pro/
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-26 20:36:45 UTC

## Stored page captures

- Primary capture: https://urlscan.io/screenshots/01a0c896-1a0f-746f-a1d5-cd402f7a3f9d.png
  Captured: 2026-10-26 19:56:54 UTC
- URLScan capture 1: https://screenshots.phishdestroy.io/01a0c896-1a0f-746f-a1d5-cd402f7a3f9d.png
  Source report: https://urlscan.io/result/01a0c896-1a0f-746f-a1d5-cd402f7a3f9d/
- URLScan · 2026-09-21: https://screenshots.phishdestroy.io/us/01a0c332-6952-774b-9d6b-18066b623acd.png
  Captured: 2026-09-21 09:01:01 UTC
  Source report: https://urlscan.io/result/01a0c332-6952-774b-9d6b-18066b623acd/
  SHA-256: 69b26a6af68a951a34f8b268a3b1cfcea7f21a054cdc1bb6de25f710070bf690
- URLScan · 2026-09-21: https://screenshots.phishdestroy.io/us/01a0c399-5d12-701b-b1e9-aefb8f227887.png
  Captured: 2026-09-21 10:53:29 UTC
  Source report: https://urlscan.io/result/01a0c399-5d12-701b-b1e9-aefb8f227887/
  SHA-256: 0b3e0223bc5ae2d6a2452235f2e4723ce2871ffdc5a3c8064fcf3c43edb33908
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/7c78cf74-d950-4920-9dae-7abf222bd97c.png
  Captured: 2026-10-26 19:58:23 UTC
  Source report: https://radar.cloudflare.com/scan/7c78cf74-d950-4920-9dae-7abf222bd97c
  SHA-256: 28bbe924be47872a3803dbfb6fbedebd3d9658229fd985566ec3f4c2458f94cc

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-26T19:58:42Z",
        "uuid": "01a0c896-1a0f-746f-a1d5-cd402f7a3f9d",
        "scanned_at": "2026-09-22T10:08:02Z",
        "final_url": "https://optigain.pro/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://optigain.pro/",
                "from": "http://optigain.pro/",
                "status": 307
            }
        ],
        "ip": "2606:4700:3033::ac43:9932",
        "domains": [
            "cdnjs.cloudflare.com",
            "cdn.jsdelivr.net",
            "fonts.googleapis.com"
        ],
        "ips": [
            "172.67.153.50",
            "2606:4700::6811:cf05",
            "2a00:1450:4001:c17::5f",
            "104.17.24.14",
            "2606:4700:3033::ac43:9932"
        ],
        "asns": [
            "13335",
            "15169"
        ],
        "countries": [
            "US",
            "DE"
        ],
        "doc_hash": "63b11b1b946f85b334a840f3153badb2b1f43e2c6480e0eefe0ffcfd85cced3b",
        "script_hashes": [
            "ccf00d1923b0131a10e0c6d26f95e5dee6ebf8621a27e83c5a2f68a2e0093142"
        ],
        "globals": [
            "LANG_MSGS",
            "ClientJS",
            "_mljw6",
            "toggleTermsPopup",
            "__cfQR",
            "__cfRLUnblockHandlers",
            "__lgT0"
        ],
        "cookies": [
            "entry_url"
        ],
        "tls": {
            "san": [
                "optigain.pro"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "WE1",
            "subject": "optigain.pro",
            "protocol": "TLS 1.3",
            "valid_to": "2026-12-13T12:31:24Z",
            "valid_from": "2026-09-14T11:31:26Z"
        },
        "domain_age_days": 7,
        "apex_age_days": 7,
        "tls_age_days": 7,
        "tls_valid_days": 90,
        "requests": 16,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 99,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "cloudflare",
            "content-type": "text/html; charset=utf-8",
            "strict-transport-security": "max-age=31536000; includeSubDomains; preload",
            "content-security-policy": "font-src 'self' https://fonts.gstatic.com https://cdnjs.cloudflare.com; img-src 'self' data: blob:; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://cdnjs.cloudflare.com; connect-",
            "x-frame-options": "SAMEORIGIN",
            "x-content-type-options": "nosniff",
            "referrer-policy": "strict-origin-when-cross-origin",
            "permissions-policy": "camera=(), microphone=(), geolocation=()",
            "cross-origin-opener-policy": "same-origin"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-26T19:58:46Z",
        "uuid": "7c78cf74-d950-4920-9dae-7abf222bd97c",
        "scanned_at": "2026-10-26T19:58:23Z",
        "final_url": "https://optigain.pro/",
        "status": 200,
        "history": [
            {
                "url": "https://optigain.pro/",
                "status": 200
            }
        ],
        "dom_hash": "bc586b96704a57d0edc811dd2d56b670823942504c5314a4497dd16285186f54",
        "doc_hash": "a1778192d951fcacfb611e75d0d3572373f7a8af37509e4de312a808bfc80246",
        "phishing_v2": [
            "phishing"
        ],
        "domain_risks": [
            "Malware",
            "Security threats",
            "CIPA Filter",
            "CIPA"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "optigain.pro",
                "type": "A",
                "value": "185.62.58.129"
            }
        ],
        "dnssec_valid": false,
        "ip": "185.62.58.129",
        "verdict": {
            "tags": [
                "malware"
            ],
            "malicious": true,
            "categories": [
                "malware"
            ]
        },
        "whois": {
            "registrar": "Spaceship, Inc.",
            "created": "2026-09-14T12:08:35Z",
            "updated": "2026-09-19T12:09:17Z",
            "expires": "2027-09-14T12:08:35Z",
            "nameservers": [
                "piers.ns.cloudflare.com",
                "anita.ns.cloudflare.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-26T20:28:41Z",
        "analysis_at": "2026-10-21T16:00:59Z",
        "stats": {
            "timeout": 0,
            "harmless": 46,
            "malicious": 12,
            "suspicious": 3,
            "undetected": 31
        },
        "detections": {
            "CRDF": "malicious",
            "DNS8": "suspicious",
            "ESET": "suspicious",
            "VIPRE": "phishing",
            "G-Data": "phishing",
            "Lionic": "phishing",
            "Sophos": "phishing",
            "Fortinet": "phishing",
            "SOCRadar": "phishing",
            "Kaspersky": "phishing",
            "Seclookup": "malicious",
            "Gridinsoft": "phishing",
            "BitDefender": "phishing",
            "alphaMountain.ai": "suspicious",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "categories": {
            "Sophos": "phishing and fraud",
            "alphaMountain.ai": "Suspicious (alphaMountain.ai)",
            "Forcepoint ThreatSeeker": "newly registered websites"
        },
        "first_seen": "2026-09-14T12:55:26Z",
        "dns": [
            {
                "ttl": 1800,
                "type": "SOA",
                "rname": "dns.cloudflare.com",
                "value": "anita.ns.cloudflare.com"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "piers.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "185.62.58.129"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "anita.ns.cloudflare.com"
            }
        ],
        "dns_at": "2026-10-21T16:06:16Z",
        "jarm": "40d40d40d00000000043d43d00043d6aff5ab0f4fc31897186312c9e639319",
        "cert": {
            "san": [
                "optigain.pro"
            ],
            "issuer": "ZeroSSL GmbH / ZeroSSL ECC DV SSL CA 2",
            "serial": "a1a39365924d386fcc4b99098ba3bccc",
            "sha256": "12df072f56c4388105f5a2462a866672a532edd4c8b38a1d3c22fb0d13854572",
            "subject": "optigain.pro",
            "valid_to": "2027-01-11T23:59:59Z",
            "valid_from": "2026-10-13T00:00:00Z"
        },
        "rdap": {
            "status": [
                "client transfer prohibited",
                "add period"
            ],
            "events": {
                "last changed": "2026-09-14T12:19:58Z",
                "registration": "2026-09-14T12:08:35Z",
                "registrar expiration": "2027-09-14T12:08:35Z",
                "last update of RDAP database": "2026-10-15T09:05:08Z"
            },
            "registrar": "Spaceship, Inc.",
            "registrar_iana_id": "3862"
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-26T19:59:04Z",
        "mail_config": {
            "spf_lookups": 0
        },
        "caa_records": {
            "domain": "optigain.pro"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_by": [
                "CloudFlare Family"
            ],
            "blocked_count": 1
        },
        "archives": {
            "last": "2026-10-26T19:58:08Z",
            "first": "2026-09-14T14:49:10Z",
            "changes": 1,
            "days_archived": 2,
            "scans_per_day": 0.02,
            "avg_page_bytes": 22872
        },
        "robots_txt": {
            "agents": [
                "*"
            ],
            "present": true,
            "sitemaps": [
                "https://optigain.pro/sitemap.xml"
            ]
        },
        "sitemap": {
            "present": true,
            "url_count": 140
        },
        "social_tags": {
            "ogUrl": "https://optigain.pro/",
            "title": "Optigain | AI Trading Platform | Official Platform",
            "ogType": "website",
            "robots": "index, follow",
            "ogTitle": "Optigain | Premium AI trading automation for institutions",
            "ogSiteName": "Optigain",
            "themeColor": "#f4faff",
            "description": "Optigain delivers enterprise-grade AI trading automation with configurable risk controls, execution-ready workflows, and transparent operational visibility for active traders.",
            "twitterCard": "summary",
            "canonicalUrl": "https://optigain.pro/",
            "ogDescription": "Optigain delivers enterprise-grade AI trading automation with configurable risk controls, execution-ready workflows, and transparent operational visibility for active traders."
        },
        "trackers": {
            "requests": 20,
            "trackers": [
                {
                    "name": "Cloudflare",
                    "company": "Cloudflare",
                    "country": "US",
                    "category": "Hosting",
                    "requests": 7
                },
                {
                    "name": "Google Fonts",
                    "company": "Google",
                    "country": "US",
                    "category": "Hosting",
                    "requests": 1
                },
                {
                    "name": "Google Static",
                    "company": "Google",
                    "country": "US",
                    "category": "Hosting",
                    "requests": 2
                },
                {
                    "name": "jsDelivr",
                    "company": "jsDelivr",
                    "category": "Hosting",
                    "requests": 3
                }
            ]
        },
        "mixed_content": {
            "no_sri": [
                "https://cdn.jsdelivr.net/npm/intl-tel-input@23/build/js/intlTelInput.min.js"
            ],
            "third_party_scripts": 1
        },
        "status": {
            "up": true,
            "code": 200,
            "timings": {
                "dns": 6,
                "tls": 23,
                "wait": 19,
                "connect": 16,
                "download": 52
            },
            "response_ms": 116
        },
        "tls_connection": {
            "alpn": "h2",
            "cipher": "TLS_AES_128_GCM_SHA256",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "ocsp_stapled": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                80,
                443
            ]
        },
        "carbon": {
            "bytes": 51643,
            "co2_grams": 0.0019,
            "cleaner_than": 36
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "108.162.194.82",
                    "host": "anita.ns.cloudflare.com"
                },
                {
                    "ip": "172.64.35.16",
                    "host": "piers.ns.cloudflare.com"
                }
            ],
            "zone": "optigain.pro"
        },
        "location": {
            "ip": "185.62.58.129",
            "asn": "62370",
            "org": "Snel.com B.V.",
            "city": "Schiedam",
            "country": "NL"
        },
        "ssl": {
            "issuer": "ZeroSSL GmbH / ZeroSSL ECC DV SSL CA 2",
            "subject": "optigain.pro"
        },
        "dns": {
            "A": [
                "185.62.58.129"
            ],
            "NS": [
                "piers.ns.cloudflare.com",
                "anita.ns.cloudflare.com"
            ],
            "SOA": "{\"nsname\": \"anita.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2417382038, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}"
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "hsts": {
            "message": "Site does not serve any HSTS headers."
        },
        "http_security": {
            "xFrameOptions": false,
            "referrerPolicy": "no-referrer-when-downgrade",
            "xXSSProtection": false,
            "permissionsPolicy": false,
            "xContentTypeOptions": false,
            "contentSecurityPolicy": false,
            "strictTransportPolicy": false,
            "crossOriginOpenerPolicy": false,
            "crossOriginEmbedderPolicy": false,
            "crossOriginResourcePolicy": false
        },
        "get_ip": {
            "ip": "185.62.58.129",
            "family": 4
        },
        "redirects": {
            "chain": [
                "https://optigain.pro"
            ]
        },
        "tech_stack": {
            "technologies": [
                "Cloudflare",
                "Cloudflare Turnstile",
                "ClientJS",
                "Priority Hints",
                "jsDelivr",
                "Google Font API",
                "Font Awesome",
                "cdnjs",
                "Open Graph",
                "HTTP/3"
            ]
        },
        "linked_pages": {
            "internal_count": 37
        },
        "headers": {
            "headers": {
                "content-type": "text/html; charset=utf-8",
                "referrer-policy": "no-referrer-when-downgrade"
            }
        }
    }
}
```