# PhishDestroy domain threat record: probex.io

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/probex.io/
Machine-readable companion: https://phishdestroy.io/domain/probex.io/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-25 02:52:27 UTC
- Last availability or vendor check: 2026-10-25 23:01:10 UTC
- Stored record updated: 2026-10-25 23:23:59 UTC
- VirusTotal detections in the stored snapshot: 1/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: ethereum

## Stored infrastructure

- Observed IP address: 46.62.209.142
- Registrar in stored WHOIS data: Name.com, Inc.
- Last stored HTTP status: 200
- Registration date in stored WHOIS data: 2025-12-10 19:16:39 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a170f8-8427-76fb-bd39-446860b16e69/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/probex.io
- Certificate Transparency search: https://crt.sh/?q=%25.probex.io
- Web Archive lookup: https://web.archive.org/web/*/https://probex.io/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
PhishDestroy added probex.io to its internal blocklist on 2026-10-25 after an automated intake flagged the domain because VirusTotal reported one malicious detection. The recorded page title and excerpt advertise binary options and CFD trading on cryptocurrencies, forex, stocks and indices, which the intake AI identified as a hallmark of fraudulent investment platforms. An HTTP 200 response was observed on the same date, confirming the site was reachable at that time. Google Safe Browsing did not flag the domain, and OTX listed three related pulses.

How the scam works
Fake binary‑options and CFD sites lure victims by promising high, often guaranteed returns with simple “instant execution” trading. They typically require users to fund a demo or live account, then restrict withdrawals or disappear after deposits, exploiting the lack of regulation in such markets.

Evidence
VirusTotal scanned the domain on 2026-10-17 and returned one malicious verdict from the vendor Bfore.Ai PreCrime out of 92 engines; no other engines flagged it. Google Safe Browsing checked on 2026-10-25 and reported no warning. OTX recorded three pulses referencing the domain as of 2026-10-25. PhishDestroy’s own internal list marked the domain as malicious on 2026-10-25. urlscan.io captured the site on 2026-10-25, its machine‑learning engine assigned a malicious tag with a score of 75, though its overall community verdict was non‑malicious.

Infrastructure
The domain was registered with Name.com on 2025-12-10, 319 days before first detection, and uses Cloudflare DNS (laila.ns.cloudflare.com, damiete.ns.cloudflare.com). The recorded IP was 46.62.209.142, which belongs to the Hetzner network in Finland. TLS was provided by a Let’s Encrypt certificate valid from 2026-08-15 to 2026-11-13. No external blocklists reported the domain as malicious.

What to do
Users should avoid providing personal data, login credentials or funds to probex.io and monitor any accounts that may have been used there. Organizations should block the domain at network perimeters, log any DNS or HTTP requests, and add the domain to internal threat feeds. Since wallet interactions are not permitted, no wallet‑specific remediation is required, but standard credential‑change procedures apply if any were entered.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a170f8-8427-76fb-bd39-446860b16e69/
Cloudflare Radar report: https://radar.cloudflare.com/scan/b3c71c66-8bcd-4d08-bea7-904e8f8e982f
URLQuery report: https://urlquery.net/report/31236d3d-9141-4428-b857-642c10076a63
Stored capture screenshot: https://i.ibb.co/zHLJLwdH/5ea58c6d836f.png
Cloudflare Radar screenshot (2026-10-25T03:26:19Z): https://screenshots.phishdestroy.io/cf/b3c71c66-8bcd-4d08-bea7-904e8f8e982f.png
URLQuery screenshot: https://screenshots.phishdestroy.io/uq/31236d3d-9141-4428-b857-642c10076a63.png
URLScan screenshot (2026-10-25T02:56:59Z): https://screenshots.phishdestroy.io/us/01a170fd-57e0-76a7-8406-f7cef69ccbfe.png
URLScan capture report: https://urlscan.io/result/01a170fd-57e0-76a7-8406-f7cef69ccbfe/
VirusTotal report: https://www.virustotal.com/gui/domain/probex.io
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=probex.io
Archived copy: https://web.archive.org/web/20261025025412/https://probex.io/
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-25 03:27:42 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/zHLJLwdH/5ea58c6d836f.png
  Captured: 2026-10-25 02:52:27 UTC
- URLScan capture: https://screenshots.phishdestroy.io/01a170f8-8427-76fb-bd39-446860b16e69.png
  Captured: 2026-10-25 02:52:27 UTC
  Source report: https://urlscan.io/result/01a170f8-8427-76fb-bd39-446860b16e69/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/b3c71c66-8bcd-4d08-bea7-904e8f8e982f.png
  Captured: 2026-10-25 03:26:19 UTC
  Source report: https://radar.cloudflare.com/scan/b3c71c66-8bcd-4d08-bea7-904e8f8e982f
  SHA-256: 3f71eae1110c03a1c074739588ce4eead049e169d50d254f8bc4ff8bd5ad1832
- URLQuery: https://screenshots.phishdestroy.io/uq/31236d3d-9141-4428-b857-642c10076a63.png
  Source report: https://urlquery.net/report/31236d3d-9141-4428-b857-642c10076a63
  SHA-256: 79b159d19add9236a3cd69ab0a46021b2f8de14a70b563f59b2dc84895bb75a0
- URLScan · 2026-10-25: https://screenshots.phishdestroy.io/us/01a170fd-57e0-76a7-8406-f7cef69ccbfe.png
  Captured: 2026-10-25 02:56:59 UTC
  Source report: https://urlscan.io/result/01a170fd-57e0-76a7-8406-f7cef69ccbfe/
  SHA-256: 991272264e7d65d2ba2cf340edda07dc0d70a0aa65efb7ed2843c5ea7c31894a

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-25T03:26:55Z",
        "uuid": "01a170f8-8427-76fb-bd39-446860b16e69",
        "scanned_at": "2026-10-25T02:51:50Z",
        "final_url": "https://probex.io/",
        "status": 200,
        "ip": "46.62.209.142",
        "ptr": "static.142.209.62.46.clients.your-server.de",
        "domains": [
            "assets.coincap.io",
            "flagcdn.com"
        ],
        "ips": [
            "104.20.46.184",
            "172.67.180.104",
            "46.62.209.142"
        ],
        "asns": [
            "13335",
            "24940"
        ],
        "countries": [
            "FI"
        ],
        "doc_hash": "92abd867a0f5e4fd3b47ac7dd7175b6d4515cda467b7eb985fb490fef0443465",
        "script_hashes": [
            "dc7c6d0b495ffade7984acc2f0862cef797d9d9f0f2d0cae5dadc34df729e951",
            "51a7146e32f6a18a96676813fd791cd1b0265c675292acb31196720ca9e79726",
            "e21be50b85d04ad36b43be5a422703844403ff99a574e0cfd4a7e1295a995b88",
            "87b9a732ab18663476fa44da250cbf5826a514ffe1218fcb02065557c6d259a7",
            "ef5555938370edfbd749a0090cb9484b73d7ae75b7b5007380a1b1ead16df37b",
            "44f4c0ddcc96375ee507d8fc66a78823f2fd2aff893869c91fe0d9f098b4d6b9",
            "2c8ac488005ee874d487860e7525419cce08b587973b3d848ce3c9be8773b1d4",
            "0e3061ab603be4155333efcb3ac752224afd9e8ce7ba07b7f165dcb453691d0a",
            "3059a1c7f99696b2917a089fbf03132d8c5cd6a3cc5928871a875ee851c65f4d"
        ],
        "globals": [
            "$RT",
            "$RB",
            "$RV",
            "$RC",
            "__next_f",
            "webpackChunk_N_E",
            "_N_E",
            "next",
            "_N_E_STYLE_LOAD"
        ],
        "cookies": [
            "pbx_did"
        ],
        "tls": {
            "san": [
                "probex.io",
                "www.probex.io"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "YE1",
            "subject": "probex.io",
            "protocol": "TLS 1.3",
            "valid_to": "2026-11-13T16:16:57Z",
            "valid_from": "2026-08-15T16:16:58Z"
        },
        "domain_age_days": 1358,
        "apex_age_days": 1358,
        "tls_age_days": 70,
        "tls_valid_days": 89,
        "requests": 40,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 75,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "nginx/1.31.5",
            "content-type": "text/html; charset=utf-8",
            "strict-transport-security": "max-age=63072000; includeSubDomains; preload",
            "content-security-policy": "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://challenges.cloudflare.com https://cdn.jsdelivr.net; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; img-src '",
            "x-frame-options": "DENY",
            "x-content-type-options": "nosniff",
            "referrer-policy": "strict-origin-when-cross-origin",
            "permissions-policy": "camera=(self), microphone=(), geolocation=(), payment=()"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-25T03:26:58Z",
        "uuid": "b3c71c66-8bcd-4d08-bea7-904e8f8e982f",
        "scanned_at": "2026-10-25T03:26:19Z",
        "final_url": "https://probex.io/",
        "status": 200,
        "history": [
            {
                "url": "https://probex.io/",
                "status": 200
            }
        ],
        "dom_hash": "c2d6275598a9a3698211a3a93843e6be1a3e79210df1fe8283679c3630b887e1",
        "doc_hash": "92abd867a0f5e4fd3b47ac7dd7175b6d4515cda467b7eb985fb490fef0443465",
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "probex.io",
                "type": "A",
                "value": "46.62.209.142"
            }
        ],
        "dnssec_valid": false,
        "ip": "46.62.209.142",
        "whois": {
            "registrar": "Name.com, Inc.",
            "created": "2025-12-10T20:16:39Z",
            "updated": "2026-08-12T09:25:48Z",
            "expires": "2026-12-10T20:16:39Z",
            "nameservers": [
                "laila.ns.cloudflare.com",
                "damiete.ns.cloudflare.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-25T03:26:11Z",
        "analysis_at": "2026-10-17T06:21:29Z",
        "stats": {
            "timeout": 0,
            "harmless": 55,
            "malicious": 1,
            "suspicious": 0,
            "undetected": 36
        },
        "detections": {
            "Bfore.Ai PreCrime": "malicious"
        },
        "reputation": 0,
        "created": "2025-12-10T00:00:00Z",
        "updated": "2025-12-15T00:00:00Z",
        "first_seen": "2024-03-05T05:08:05Z",
        "dns": [
            {
                "ttl": 300,
                "type": "CAA",
                "value": "digicert.com;"
            },
            {
                "ttl": 300,
                "type": "CAA",
                "value": "digicert.com;"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "46.62.209.142"
            },
            {
                "ttl": 1800,
                "type": "SOA",
                "rname": "dns.cloudflare.com",
                "value": "damiete.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "CAA",
                "value": "comodoca.com"
            },
            {
                "ttl": 300,
                "type": "CAA",
                "value": "comodoca.com"
            },
            {
                "ttl": 300,
                "type": "CAA",
                "value": "letsencrypt.org"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "laila.ns.cloudflare.com"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "damiete.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "CAA",
                "value": "pki.goog;"
            },
            {
                "ttl": 300,
                "type": "CAA",
                "value": "ssl.com"
            },
            {
                "ttl": 300,
                "type": "CAA",
                "value": "ssl.com"
            },
            {
                "ttl": 3600,
                "type": "TXT",
                "value": "google-site-verification=JKuoijdUrWK1mgpUZp1zTS1LhWMARMZmry3VLDZtkgI"
            },
            {
                "ttl": 300,
                "type": "CAA",
                "value": "letsencrypt.org"
            },
            {
                "ttl": 300,
                "type": "CAA",
                "value": "sectigo.com"
            },
            {
                "ttl": 300,
                "type": "CAA",
                "value": "pki.goog;"
            }
        ],
        "dns_at": "2026-10-17T06:27:02Z",
        "jarm": "1dd40d40d00040d00042d43d000000e1ea2a807a629b496b664cf07ad7c08d",
        "cert": {
            "san": [
                "probex.io",
                "www.probex.io"
            ],
            "issuer": "Let's Encrypt / YE1",
            "serial": "598ab40f5a62ad12bb29ce8c5bf41e18606",
            "sha256": "cd354e4ef0430618dd354dcd27fdb4464c82121b22e1c4b053bf4e0585ee991a",
            "subject": "probex.io",
            "valid_to": "2026-11-13T16:16:57Z",
            "valid_from": "2026-08-15T16:16:58Z"
        },
        "whois": [],
        "rdap": {
            "status": [
                "transfer prohibited"
            ],
            "events": {
                "expiration": "2026-12-10T20:16:39Z",
                "last changed": "2026-08-12T09:25:48Z",
                "registration": "2025-12-10T20:16:39Z",
                "registrar expiration": "2026-12-10T20:16:39Z",
                "last update of RDAP database": "2026-08-12T09:25:48Z"
            },
            "registrar": "Name.com, Inc",
            "registrar_iana_id": "625"
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-25T03:27:18Z",
        "mail_config": {
            "spf_lookups": 0
        },
        "caa_records": {
            "count": 11,
            "domain": "probex.io",
            "issuers": [
                "pki.goog; cansignhttpexchanges=yes",
                "ssl.com",
                "comodoca.com",
                "digicert.com; cansignhttpexchanges=yes",
                "letsencrypt.org",
                "sectigo.com"
            ]
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_count": 0
        },
        "archives": {
            "last": "2026-10-25T02:54:12Z",
            "first": "2021-12-17T10:19:42Z",
            "changes": 1,
            "days_archived": 3,
            "scans_per_day": 0,
            "avg_page_bytes": 17049
        },
        "robots_txt": {
            "present": true,
            "sitemaps": [
                "https://probex.io/sitemap.xml"
            ]
        },
        "sitemap": {
            "present": true,
            "url_count": 16
        },
        "social_tags": {
            "ogUrl": "https://probex.io",
            "ogType": "website",
            "robots": "index, follow",
            "ogImage": "https://probex.io/landing/hero-trader.jpg",
            "ogTitle": "Probex — CFD's e Opções Binárias: cripto, forex e índices 24/7",
            "keywords": "CFD,cfd trading,trading alavancado,opções binárias,como operar opções binárias,corretora de opções binárias,trading online,índices sintéticos,operar cripto,Probex,conta demo grátis,ganhar dinheiro online",
            "ogSiteName": "Probex",
            "description": "Opere CFD's e opções binárias na Probex: cripto, forex, ações e índices sintéticos 24 horas por dia, com alavancagem e pagamentos de até 88%. Conta demo grátis de 10.000 e saques em USDT.",
            "twitterCard": "summary_large_image",
            "canonicalUrl": "https://probex.io",
            "ogDescription": "Opere CFD's e opções binárias em cripto, forex e índices sintéticos, com alavancagem e pagamentos de até 88%. Conta demo grátis de 10.000 e saques em USDT."
        },
        "trackers": {
            "requests": 33
        },
        "mixed_content": {
            "upgrade_insecure": true,
            "third_party_scripts": 0
        },
        "status": {
            "up": true,
            "code": 200,
            "timings": {
                "dns": 10,
                "tls": 91,
                "wait": 229,
                "connect": 37,
                "download": 53
            },
            "response_ms": 420
        },
        "tls_connection": {
            "alpn": "h2",
            "cipher": "TLS_AES_256_GCM_SHA384",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                22,
                80,
                443
            ]
        },
        "carbon": {
            "bytes": 119880,
            "co2_grams": 0.0044,
            "cleaner_than": 18
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "108.162.195.32",
                    "host": "damiete.ns.cloudflare.com"
                },
                {
                    "ip": "172.64.34.122",
                    "host": "laila.ns.cloudflare.com"
                }
            ],
            "zone": "probex.io"
        },
        "cookies": {
            "cookies": [
                {
                    "name": "pbx_did",
                    "secure": true,
                    "http_only": true,
                    "same_site": "Lax"
                }
            ]
        },
        "location": {
            "ip": "46.62.209.142",
            "asn": "24940",
            "org": "Hetzner Online GmbH",
            "city": "Helsinki",
            "country": "FI"
        },
        "ssl": {
            "issuer": "Let's Encrypt / YE1",
            "subject": "probex.io"
        },
        "dns": {
            "A": [
                "46.62.209.142"
            ],
            "NS": [
                "damiete.ns.cloudflare.com",
                "laila.ns.cloudflare.com"
            ],
            "SOA": "{\"nsname\": \"damiete.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2415403287, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}",
            "TXT": [
                "google-site-verification=JKuoijdUrWK1mgpUZp1zTS1LhWMARMZmry3VLDZtkgI"
            ]
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "hsts": {
            "header": "max-age=63072000; includeSubDomains; preload",
            "message": "Site is compatible with the HSTS preload list!",
            "compatible": true
        },
        "http_security": {
            "xFrameOptions": "DENY",
            "referrerPolicy": "strict-origin-when-cross-origin",
            "xXSSProtection": false,
            "permissionsPolicy": "camera=(self), microphone=(), geolocation=(), payment=()",
            "xContentTypeOptions": "nosniff",
            "contentSecurityPolicy": "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://challenges.cloudflare.com https://cdn.jsdeli",
            "strictTransportPolicy": "max-age=63072000; includeSubDomains; preload",
            "crossOriginOpenerPolicy": false,
            "crossOriginEmbedderPolicy": false,
            "crossOriginResourcePolicy": false
        },
        "get_ip": {
            "ip": "46.62.209.142",
            "family": 4
        },
        "redirects": {
            "chain": [
                "https://probex.io"
            ]
        },
        "subdomains": {
            "count": 1,
            "subdomains": [
                "www.probex.io"
            ]
        },
        "linked_pages": {
            "internal_count": 9
        },
        "whois": {
            "registrar": "Name.com, Inc.",
            "created": "2025-12-10T20:16:39Z",
            "updated": "2026-08-12T09:25:48Z",
            "expires": "2026-12-10T20:16:39Z",
            "status": [
                "clientTransferProhibited https://icann.org/epp"
            ],
            "nameservers": [
                "laila.ns.cloudflare.com",
                "damiete.ns.cloudflare.com"
            ]
        },
        "headers": {
            "headers": {
                "server": "nginx/1.31.5",
                "content-type": "text/html; charset=utf-8",
                "strict-transport-security": "max-age=63072000; includeSubDomains; preload",
                "content-security-policy": "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://challenges.cloudflare.com https://cdn.jsdelivr.net; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; img-src 'self' data: blob: https:; font-src 'self' data: https://fonts.gstatic.com; connect-src 'self' https:",
                "x-frame-options": "DENY",
                "x-content-type-options": "nosniff",
                "referrer-policy": "strict-origin-when-cross-origin",
                "permissions-policy": "camera=(self), microphone=(), geolocation=(), payment=()"
            }
        }
    }
}
```