# PhishDestroy domain threat record: pelkruvilanz.es

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/pelkruvilanz.es/
Machine-readable companion: https://phishdestroy.io/domain/pelkruvilanz.es/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-09-28 05:26:39 UTC
- Last availability or vendor check: 2026-10-22 10:31:01 UTC
- Stored record updated: 2026-10-22 16:07:29 UTC
- VirusTotal detections in the stored snapshot: 5/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored infrastructure

- Observed IP address: 104.21.22.130
- Registrar in stored WHOIS data: REGISTRAR_NOT_FOUND
- Last stored HTTP status: 200

## Evidence links

- URLScan report: https://urlscan.io/result/01a0e67f-6b82-73ba-9858-688002abccc5/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/pelkruvilanz.es
- Certificate Transparency search: https://crt.sh/?q=%25.pelkruvilanz.es
- Web Archive lookup: https://web.archive.org/web/*/https://pelkruvilanz.es/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
pelkruvilanz.es presents itself as "Pelkruvilanz™", the self-proclaimed "El Sitio Oficial" of an AI-powered cryptocurrency trading platform for 2026. It is written in Spanish and sits on a Spain country-code domain, so its audience is Spanish-speaking retail investors. PhishDestroy first saw it on 2026-09-28 and classifies it as an impersonation phishing page. As of 2026-10-19 the site was still online and serving its content.

How the scam works
Pages like this are built to look like the one genuine home of a trading brand. A trademark symbol, the "official site" claim and the promise of AI-driven profits are there to win the visitor's trust. The usual goal is a sign-up form that collects a name, email and phone number. Those contacts are then passed to callers who push the victim to make a first deposit. Victims typically lose that deposit and any later top-ups, and they also hand over personal details that get reused for follow-up fraud.

Evidence
On 2026-10-10, five of 92 VirusTotal engines flagged the domain as malicious: CRDF, Forcepoint ThreatSeeker, Gridinsoft, SOCRadar and VIPRE. That is a low count, so most security tools would still let a visitor through without a warning. The domain appears in four AlienVault OTX threat pulses, which means other researchers have tied it to known malicious activity. Among blocklists, it is currently listed by PhishDestroy.

Infrastructure
The site sits behind Cloudflare, on an address in Canada. This hides the real origin server and makes it easy to swap backends if one is taken down. Its TLS certificate comes from Google Trust Services (WE1), which is issued automatically. The padlock in the browser therefore confirms only an encrypted connection, not that the operator is legitimate.

What to do
If you left your phone number or email, expect calls and messages from "account managers" and do not take them. Never install remote-access software at their request. If you deposited money, contact your bank or card issuer right away to dispute the payment, and keep any chat logs, transaction IDs and receipts. Be wary of anyone who later offers to recover your funds for a fee, as these "recovery" offers are a common second scam. Security teams should block the domain at DNS and proxy level and report it to Cloudflare's abuse channel and the .es registry.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a0e67f-6b82-73ba-9858-688002abccc5/
VirusTotal report: https://www.virustotal.com/gui/domain/pelkruvilanz.es
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=pelkruvilanz.es
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 09:33:15 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/1GhgJQyp/60dbc0570f01.png
  Captured: 2026-09-28 05:32:33 UTC
- URLScan capture 1: https://screenshots.phishdestroy.io/01a0e67f-6b82-73ba-9858-688002abccc5.png
  Captured: 2026-09-28 05:32:33 UTC
  Source report: https://urlscan.io/result/01a0e67f-6b82-73ba-9858-688002abccc5/
- URLScan capture 2: https://urlscan.io/screenshots/01a0dc1d-eb39-7395-8084-527660aad970.png
  Captured: 2026-09-28 05:26:39 UTC
  Source report: https://urlscan.io/result/01a0e67f-6b82-73ba-9858-688002abccc5/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/cc18295b-0e6a-4c7d-96f3-c58fd97cb053.png
  Captured: 2026-09-28 05:28:22 UTC
  Source report: https://radar.cloudflare.com/scan/cc18295b-0e6a-4c7d-96f3-c58fd97cb053
  SHA-256: 6a14ec7e175c846fd505dbae3414b816be7a9b03b2b1c2dace1d30d1004b0023
- URLScan · 2026-09-25: https://screenshots.phishdestroy.io/us/01a0d6f5-971d-76de-a652-976686eea659.png
  Captured: 2026-09-25 05:07:01 UTC
  Source report: https://urlscan.io/result/01a0d6f5-971d-76de-a652-976686eea659/
  SHA-256: bd0c390238cbae68243d0951e29788c1ba56ebe406448e500b0489df03975684
- URLScan · 2026-09-26: https://screenshots.phishdestroy.io/us/01a0dc1d-eb39-7395-8084-527660aad970.png
  Captured: 2026-09-26 05:09:10 UTC
  Source report: https://urlscan.io/result/01a0dc1d-eb39-7395-8084-527660aad970/
  SHA-256: fa5780c62196128dd2ab940e1d880c3bc2abca01be4a43141f6ac801bfac3dca
- URLScan · 2026-09-28: https://screenshots.phishdestroy.io/us/01a0e67c-9b74-7158-a550-53387b84f6b9.png
  Captured: 2026-09-28 05:28:50 UTC
  Source report: https://urlscan.io/result/01a0e67c-9b74-7158-a550-53387b84f6b9/
  SHA-256: def5a9cb32eb2ee82206641f8f8957e99cdead8284ce23b891513f303ea53e55
- URLScan · 2026-09-28: https://screenshots.phishdestroy.io/us/01a0e67c-d0be-7746-9aaf-f22edebfcd6c.png
  Captured: 2026-09-28 05:29:01 UTC
  Source report: https://urlscan.io/result/01a0e67c-d0be-7746-9aaf-f22edebfcd6c/
  SHA-256: 06dac7d46a2697463f05bb9d16e682e6057d7611a92b950fab8e09a349c9269d
- URLScan · 2026-10-04: https://screenshots.phishdestroy.io/us/01a10778-bae4-701f-a776-a538938dae21.png
  Captured: 2026-10-04 15:12:02 UTC
  Source report: https://urlscan.io/result/01a10778-bae4-701f-a776-a538938dae21/
  SHA-256: 6ac5cfb410617bc1b9c694daad2ad8639b358e61bb21cfd27366e82e0393845f

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-20T20:55:31Z",
        "uuid": "01a0e67f-6b82-73ba-9858-688002abccc5",
        "scanned_at": "2026-09-28T05:31:57Z",
        "final_url": "https://pelkruvilanz.es/",
        "status": 200,
        "ip": "104.21.22.130",
        "domains": [
            "static.cloudflareinsights.com",
            "fonts.googleapis.com"
        ],
        "ips": [
            "104.16.80.73",
            "142.250.195.170",
            "104.21.22.130"
        ],
        "asns": [
            "13335",
            "15169"
        ],
        "countries": [
            "US"
        ],
        "doc_hash": "d75858c2790e1cfb3196e795fe0b36841a86f974f2cac90e71f6e824df91c4e1",
        "script_hashes": [
            "6cf43a9e24320556e605c40cc1d8db7180e39d9caa87d0e8e28ecb6dc362a6eb",
            "f6cee3c4ccff54b05e515034e0ee05540579af11f0b7efcefd6cb88ad5868468",
            "ac968c9d8e1fce7caf5eae1cc17e92fd6bede1300f0d9a587d15623521b2593d",
            "5d07bb8448fcb39a44f5ba41dc735998e0b5b4129ad4a19ecbb8af6f3c951100",
            "9bd8e8004a068455e46beb74b7eee75e9e7b14674aee0b9d55ba3374ac9be556",
            "9c3fca5582d05a60e55d7e1da43f160ac475d7f0d5d661b6e2a840035a76022b",
            "c572ee187fd3ba2b4da1fca30d40629f932e471107ddb972946f80268cdf3f95",
            "a7e8712405eaf09f22e0ad4c1ae8c3b2a2946095ad97a66f088b6e464b3cbe33",
            "377cea58a0e8fe6a6dd9d72b3f2e7e300025d7c15d75d4b1774296d410e5f639",
            "529eb46dc5235da595efd0ec816d9ac9a0327f58475b0a2bd751028d2c4a4f07"
        ],
        "globals": [
            "requestResize",
            "__dl",
            "__al",
            "__rl",
            "__rd",
            "__dd",
            "__eu",
            "__th",
            "__cm",
            "__dm",
            "__ap",
            "__ce",
            "__up",
            "__lc",
            "__se",
            "markAsHydrated",
            "__an",
            "__f26daa",
            "__Q_META__",
            "__ssrT",
            "__VUE_INSTANCE_SETTERS__",
            "__VUE_SSR_SETTERS__",
            "__VUE__",
            "__cfBeacon"
        ],
        "cookies": [
            "cf_clearance",
            "_sicjx",
            "_ubpad"
        ],
        "storage_keys": [
            "activity_chart_base_balance",
            "settings",
            "locales"
        ],
        "tls": {
            "san": [
                "pelkruvilanz.es",
                "*.pelkruvilanz.es"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "WE1",
            "subject": "pelkruvilanz.es",
            "protocol": "QUIC",
            "valid_to": "2026-11-25T21:50:01Z",
            "valid_from": "2026-08-27T20:51:13Z"
        },
        "domain_age_days": 90,
        "apex_age_days": 90,
        "tls_age_days": 31,
        "tls_valid_days": 90,
        "requests": 49,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 64,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "cloudflare",
            "content-type": "text/html; charset=utf-8",
            "content-security-policy": "default-src 'self' http: https: ws: wss: data: blob: 'unsafe-inline'; script-src 'self' 'unsafe-inline' 'unsafe-eval' http: https:; connect-src 'self' ws: wss: http: https:; img-src 'self' data: blob:",
            "x-frame-options": "DENY\nSAMEORIGIN",
            "x-content-type-options": "nosniff\nnosniff",
            "referrer-policy": "strict-origin-when-cross-origin\nno-referrer-when-downgrade",
            "permissions-policy": "geolocation=(), microphone=(), camera=()"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-20T21:04:04Z",
        "uuid": "cc18295b-0e6a-4c7d-96f3-c58fd97cb053",
        "scanned_at": "2026-09-28T05:28:22Z",
        "final_url": "https://pelkruvilanz.es/",
        "status": 200,
        "history": [
            {
                "url": "https://pelkruvilanz.es/",
                "status": 200
            }
        ],
        "dom_hash": "22bf26c246bc108dbbd79a1ba22b023fe993086e843d906cb847b9ced4380808",
        "doc_hash": "fb4e15380b1f7c49cd8882ef542566773de55e54df79ff8d98ecfd93bb9f6439",
        "domain_risks": [
            "Brokerage & Investing",
            "Business & Economy"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "pelkruvilanz.es",
                "type": "A",
                "value": "172.67.205.19"
            },
            {
                "name": "pelkruvilanz.es",
                "type": "A",
                "value": "104.21.22.130"
            },
            {
                "name": "pelkruvilanz.es",
                "type": "AAAA",
                "value": "2606:4700:3033::ac43:cd13"
            },
            {
                "name": "pelkruvilanz.es",
                "type": "AAAA",
                "value": "2606:4700:3032::6815:1682"
            }
        ],
        "dnssec_valid": false,
        "ip": "172.67.205.19"
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-21T16:44:42Z",
        "analysis_at": "2026-10-11T20:49:24Z",
        "stats": {
            "timeout": 0,
            "harmless": 52,
            "malicious": 4,
            "suspicious": 2,
            "undetected": 34
        },
        "detections": {
            "CRDF": "malicious",
            "VIPRE": "malware",
            "SOCRadar": "suspicious",
            "Gridinsoft": "suspicious",
            "alphaMountain.ai": "phishing",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "categories": {
            "alphaMountain.ai": "Phishing (alphaMountain.ai)"
        },
        "first_seen": "2026-06-29T21:22:13Z",
        "dns": [
            {
                "ttl": 300,
                "type": "A",
                "value": "172.67.205.19"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3032::6815:1682"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3033::ac43:cd13"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "amalia.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "TXT",
                "value": "google-site-verification=QF_Lf5K-1m8bBBdnq6ZiBSwHZp2ldmzqKTxPuWVYFV8"
            },
            {
                "ttl": 1800,
                "type": "SOA",
                "rname": "dns.cloudflare.com",
                "value": "aaden.ns.cloudflare.com"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "aaden.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "104.21.22.130"
            }
        ],
        "dns_at": "2026-10-11T20:54:50Z",
        "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c",
        "cert": {
            "san": [
                "pelkruvilanz.es",
                "*.pelkruvilanz.es"
            ],
            "issuer": "Google Trust Services / WE1",
            "serial": "c97e44069d3c85d8130f06acc7e26c29",
            "sha256": "b98aeb8a0e4614bb0c631f9c26c7af0360cc68991e86698cf4886233b05771ec",
            "subject": "pelkruvilanz.es",
            "valid_to": "2026-11-25T21:50:01Z",
            "valid_from": "2026-08-27T20:51:13Z"
        }
    }
}
```