# renteloradvisors.net: French AI investment recommendation landing page | PhishDestroy Content language: English Canonical HTML report: https://phishdestroy.io/domain/renteloradvisors.net/ Machine-readable companion: https://phishdestroy.io/domain/renteloradvisors.net/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: Last known active - First observed by PhishDestroy: 2026-11-02 14:23:53 UTC - Selected availability observation: 2026-11-02T14:23:53Z - Stored record updated: 2026-11-02 18:38:46 UTC - VirusTotal detections in the stored snapshot: 2/92 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: checked_clean ## Stored infrastructure - Observed IP address: 172.67.180.187 - Registrar in stored WHOIS data: Dynadot Inc - Last stored HTTP status: 200 (observed: 2026-11-02T14:23:53Z) - Registration date in stored WHOIS data: 2026-09-27 13:02:52 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a19ca3-97cc-740c-9cbc-40d6c479d41b/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/renteloradvisors.net - Certificate Transparency search: https://crt.sh/?q=%25.renteloradvisors.net - Web Archive lookup: https://web.archive.org/web/*/https://renteloradvisors.net/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Public report package PhishDestroy records renteloradvisors.net as a French-language landing page presenting AI-driven investment recommendations and passive income claims. On 2026-11-02, renteloradvisors.net displayed a French-language landing page branded "Rentélor Advisors" with the heading "Intelligence artificielle appliquée à l'investissement." The hero section promises clear investment recommendations without required technical expertise, stating that the service continuously analyzes market data to propose passive income avenues adapted to the user's profile, with instant withdrawals and no lock-up period. Two calls to action offer free account creation and a features overview. The stored VirusTotal domain result reports 2 detections out of 92 engines. DNS8 reported "suspicious"; SOCRadar reported "phishing". Package revision: 7a13c807085481a6a3a05200f6774856a8b7175527ce3fb964bee3cd49b9635f Text generated (not scan time): 2026-11-02 15:56:34 Reviewed evidence snapshot: {"domain":"renteloradvisors.net","screenshot_available":true,"capture_contract":"verified-capture-20261102","plain_text_contract":1,"capture_context":{"submitted_host":"renteloradvisors.net","final_host":"renteloradvisors.net","redirects":[{"to":"https://renteloradvisors.net/","from":"http://renteloradvisors.net/","status":307}],"captured_at":"2026-11-02T14:22:15.282000Z","uuid":"01a19ca3-97cc-740c-9cbc-40d6c479d41b","report_url":"https://urlscan.io/result/01a19ca3-97cc-740c-9cbc-40d6c479d41b/","sha256":"651ef7c20358064d4fc28204cdff5da768a3701df58e65bbd3e445ed418d3220","relationship":"own_domain_page"},"redirect_text_policy":"explicit-redirect-v1","initial_ai_description":"The website presents itself as an AI platform for passive income, which is a common theme in fraudulent investment schemes. The domain name 'renteloradvisors.net' does not correspond to any known legitimate financial institution or AI platform, and the promise of 'accessible passive income' through an AI platform is a typical tactic used to lure victims into investment scams.","initial_ai_description_kind":"unverified previous AI opinion","virustotal":{"scope":"domain","detections":2,"engines":92,"malicious":1,"suspicious":1,"analysis_date":"2026-10-29","retrieved_date":"2026-11-02","vendor_labels":{"DNS8":"suspicious","SOCRadar":"phishing"},"flagging_vendors":["DNS8","SOCRadar"]},"virustotal_public_summary":"The stored VirusTotal domain result reports 2 detections out of 92 engines. DNS8 reported \"suspicious\"; SOCRadar reported \"phishing\".","page_paragraph_target_characters":545} Source facts (timestamps as stored): {"record_id":1747457,"first_recorded_at":"2026-11-02 15:23:53","virustotal":{"source":"VirusTotal","scope":"unknown","result_state":"complete","numerator":2,"denominator":92,"malicious":1,"suspicious":1,"vendors":{"DNS8":"suspicious","SOCRadar":"phishing"},"observed_at":"2026-10-29T12:28:28Z","checked_at":null,"fetched_at":"2026-11-02T14:55:01Z","time_basis":"UTC (provider ISO timestamps)","stored_summary":{"source":"VirusTotal","scope":"unknown","result_state":"observed","numerator":2,"denominator":92,"malicious":null,"suspicious":null,"vendors":["DNS8","SOCRadar"],"observed_at":"2026-10-29 12:28:28","checked_at":"2026-11-02 15:55:04","fetched_at":"2026-11-02 14:55:04","time_basis":"as stored; legacy timezone not established"},"record_source":"phishdestroy.technologies.vt","vendor_labels":{"DNS8":"suspicious","SOCRadar":"phishing"},"vendor_names":["DNS8","SOCRadar"],"stats":{"timeout":0,"harmless":55,"malicious":1,"suspicious":1,"undetected":35}},"google_safe_browsing":{"source":"Google Safe Browsing","state":"checked_clean","verdict":0,"checked_at":"2026-11-02 15:55:24"},"spamhaus":{"source":"Spamhaus","verdict":"DBL_SPAM","checked_at":"2026-11-02 16:30:09"},"availability":{"state":"alive","label_key":"availability.active","detail_key":"detail.latest_reachability","params":[],"source":"current_http_probe","record_id":1747457,"scope":"checked_url","observed_at":"2026-11-02T14:23:53Z","http_status":200,"http_observed_at":"2026-11-02T14:23:53Z","stored_http_code":200,"stored_http_observed_at":"2026-11-02T14:23:53Z","legacy_site_status":"alive","supports_outcome_badge":false,"content_classification":"unknown","content_classification_at":null,"registration_state":"unknown","policy":"20261102-dated-availability-v2"}} ## Stored page captures - Stored capture: https://i.ibb.co/FcyLrrk/d766cb6960d7.png - URLScan · 2026-11-02: https://screenshots.phishdestroy.io/us/01a19ca3-97cc-740c-9cbc-40d6c479d41b.png Captured: 2026-11-02 14:22:15 UTC Source report: https://urlscan.io/result/01a19ca3-97cc-740c-9cbc-40d6c479d41b/ SHA-256: 651ef7c20358064d4fc28204cdff5da768a3701df58e65bbd3e445ed418d3220 - URLScan · 2026-10-03: https://screenshots.phishdestroy.io/us/01a1041a-987d-702d-beec-a3d6b38e9071.png Captured: 2026-10-03 23:30:21 UTC Source report: https://urlscan.io/result/01a1041a-987d-702d-beec-a3d6b38e9071/ SHA-256: 045825fdaf3e16c58234142394e5b18aacb5b0e8a9d1ef9b5c2715ea07a65efe - URLScan · 2026-10-04: https://screenshots.phishdestroy.io/us/01a106c9-3df0-765d-9fb2-5b583e7d06e3.png Captured: 2026-10-04 12:00:21 UTC Source report: https://urlscan.io/result/01a106c9-3df0-765d-9fb2-5b583e7d06e3/ SHA-256: 651ef7c20358064d4fc28204cdff5da768a3701df58e65bbd3e445ed418d3220 - URLScan · 2026-10-28: https://screenshots.phishdestroy.io/us/01a18041-b2ad-7428-9689-06c4b6a57625.png Captured: 2026-10-28 02:06:26 UTC Source report: https://urlscan.io/result/01a18041-b2ad-7428-9689-06c4b6a57625/ SHA-256: e19974b0ad47d1c952e57e29ac8d211fcf641d1df3aaf9b84742a830fbc6ba7d - URLScan · 2026-10-28: https://screenshots.phishdestroy.io/us/01a18041-b760-70c8-8002-6be1c92426c4.png Captured: 2026-10-28 02:06:27 UTC Source report: https://urlscan.io/result/01a18041-b760-70c8-8002-6be1c92426c4/ SHA-256: 828bf0f72c1ca99b9eeffcf0c13e122d1c1c1f355d8a8f1dec618d844f8ff44f - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/aa9b3e8f-faf0-4026-8d82-b1ffa5d31fa8.png Captured: 2026-11-02 14:55:47 UTC Source report: https://radar.cloudflare.com/scan/aa9b3e8f-faf0-4026-8d82-b1ffa5d31fa8 SHA-256: 47730eff1b6ad9b9876b1be90075002affc1eaa24eae5b1fca36ef600faf6063 - URLQuery: https://screenshots.phishdestroy.io/uq/8e0c09bb-55ea-4ccc-9ccb-e5d7f4a7566c.png Source report: https://urlquery.net/report/8e0c09bb-55ea-4ccc-9ccb-e5d7f4a7566c SHA-256: 5b26fc427df08c1771c5fcadb3f27aca06a8b1e757d2e7f76094cea4914f8175 ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-11-02T14:24:30Z", "uuid": "01a19ca3-97cc-740c-9cbc-40d6c479d41b", "scanned_at": "2026-11-02T14:22:15Z", "final_url": "https://renteloradvisors.net/", "status": 200, "redirected": "https-only", "redirects": [ { "to": "https://renteloradvisors.net/", "from": "http://renteloradvisors.net/", "status": 307 } ], "ip": "172.67.180.187", "ips": [ "172.67.180.187" ], "asns": [ "13335" ], "doc_hash": "efb7590119b87531ed9be86d811f7c136d6cfdc798bca669a5ebc1a2963abc03", "script_hashes": [ "2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8", "8aa5f8f647356dcd4fc5dbbe0efd5bc0e8da74026bc61e24636e2e1f5749b0ce" ], "globals": [ "__dclq", "__dclOrig", "__dclFlush", "__smsCheckBeforeSubmit", "__isSmsEnabled", "__isSmsVerified", "intlTelInput" ], "cookies": [ "connect.sid" ], "tls": { "san": [ "*.renteloradvisors.net", "renteloradvisors.net" ], "cipher": "AES_128_GCM", "issuer": "YE1", "subject": "renteloradvisors.net", "protocol": "QUIC", "valid_to": "2027-01-26T01:49:55Z", "valid_from": "2026-10-28T01:49:56Z" }, "domain_age_days": 35, "apex_age_days": 35, "tls_age_days": 5, "tls_valid_days": 89, "requests": 8, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 86, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "cloudflare", "content-type": "text/html; charset=utf-8", "x-content-type-options": "nosniff", "referrer-policy": "same-origin", "priority": "u=0,i", "via": "1.1 Caddy" } }, "cf": { "v": 1, "fetched_at": "2026-11-02T14:56:04Z", "uuid": "aa9b3e8f-faf0-4026-8d82-b1ffa5d31fa8", "scanned_at": "2026-11-02T14:55:47Z", "final_url": "https://renteloradvisors.net/", "status": 200, "history": [ { "url": "https://renteloradvisors.net/", "status": 200 } ], "dom_hash": "da4f15edef0906e1a81cbf3a4def6655996849069216107d55bb0c1a27e94c88", "doc_hash": "0513a4d777d7cacc45986c197de053a712eac6fb8554e250f056a8a3adbb135c", "phishing_v2": [ "phishing" ], "domain_risks": [ "Malware", "Security threats", "CIPA Filter", "CIPA" ], "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "renteloradvisors.net", "type": "A", "value": "172.67.180.187" }, { "name": "renteloradvisors.net", "type": "A", "value": "104.21.31.230" }, { "name": "renteloradvisors.net", "type": "AAAA", "value": "2606:4700:3030::6815:1fe6" }, { "name": "renteloradvisors.net", "type": "AAAA", "value": "2606:4700:3032::ac43:b4bb" } ], "dnssec_valid": false, "ip": "127.0.1.21", "verdict": { "tags": [ "malware" ], "malicious": true, "categories": [ "malware" ] }, "whois": { "registrar": "Dynadot Inc", "created": "2026-09-27T15:02:52Z", "updated": "2026-09-27T15:07:29Z", "expires": "2027-09-27T15:02:52Z", "nameservers": [ "aaron.ns.cloudflare.com", "lucy.ns.cloudflare.com" ] } }, "vt": { "v": 1, "fetched_at": "2026-11-02T14:55:01Z", "analysis_at": "2026-10-29T12:28:28Z", "stats": { "timeout": 0, "harmless": 55, "malicious": 1, "suspicious": 1, "undetected": 35 }, "detections": { "DNS8": "suspicious", "SOCRadar": "phishing" }, "reputation": 0, "registrar": "Dynadot Inc", "created": "2026-09-27T15:02:52Z", "expires": "2027-09-27T15:02:52Z", "updated": "2026-10-28T02:46:54Z", "first_seen": "2026-09-27T15:33:58Z", "dns": [ { "ttl": 300, "type": "A", "value": "104.21.31.230" }, { "ttl": 21600, "type": "NS", "value": "phoenix.ns.cloudflare.com" }, { "ttl": 300, "type": "AAAA", "value": "2606:4700:3030::6815:1fe6" }, { "ttl": 3600, "type": "TXT", "value": "google-site-verification=oVRDEM6525MUcualEixV4RS9D-9b4cKdOHq7Zy4QV-8" }, { "ttl": 21600, "type": "NS", "value": "viddy.ns.cloudflare.com" }, { "ttl": 1800, "type": "SOA", "rname": "dns.cloudflare.com", "value": "phoenix.ns.cloudflare.com" }, { "ttl": 300, "type": "A", "value": "172.67.180.187" }, { "ttl": 300, "type": "AAAA", "value": "2606:4700:3032::ac43:b4bb" } ], "dns_at": "2026-10-29T12:33:36Z", "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c", "cert": { "san": [ "*.renteloradvisors.net", "renteloradvisors.net" ], "issuer": "Let's Encrypt / YE1", "serial": "61c87c4496f9bf19b7958b654aeefb17649", "sha256": "2d794f81e99447112fb7762b8e98f61a7bb94877710fbfa66c467008d23e1ae0", "subject": "renteloradvisors.net", "valid_to": "2027-01-26T01:49:55Z", "valid_from": "2026-10-28T01:49:56Z" }, "whois": { "registrar": "Dynadot Inc", "registrar_iana_id": "472", "registrar_url": "http://www.dynadot.com", "created": "2026-09-27T15:02:52Z", "updated": "2026-10-28T02:46:54Z", "expires": "2027-09-27T15:02:52Z", "status": [ "clientTransferProhibited" ], "nameservers": [ "phoenix.ns.cloudflare.com", "viddy.ns.cloudflare.com" ], "dnssec": "unsigned" }, "rdap": { "status": [ "transfer prohibited" ], "events": { "expiration": "2027-09-27T15:02:52Z", "last changed": "2026-09-27T15:07:30Z", "registration": "2026-09-27T15:02:52Z", "registrar expiration": "2027-09-27T15:02:52Z", "last update of RDAP database": "2026-10-23T11:17:20Z" } } }, "webcheck": { "v": 1, "fetched_at": "2026-11-02T14:46:35Z", "mail_config": { "spf_lookups": 0 }, "caa_records": { "domain": "renteloradvisors.net" }, "block_lists": { "resolvers": 12, "blocked_by": [ "CloudFlare Family" ], "blocked_count": 1 }, "archives": { "last": "2026-11-02T14:24:18Z", "first": "2026-09-27T16:14:13Z", "changes": 2, "days_archived": 3, "scans_per_day": 0.06, "avg_page_bytes": 14899 }, "robots_txt": { "agents": [ "*" ], "present": true, "sitemaps": [ "https://renteloradvisors.net/sitemap.xml" ] }, "sitemap": { "present": true, "url_count": 5 }, "social_tags": { "title": "Rentélor Advisors — Plateforme IA pour revenus passifs accessibles", "robots": "index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1", "description": "Rentélor Advisors est votre plateforme d'analyse IA qui transforme les données de marché en recommandations claires, sans expertise requise. Découvrez une gestion flexible avec retraits instantanés.", "canonicalUrl": "https://renteloradvisors.net/" }, "trackers": { "requests": 45, "trackers": [ { "name": "Cloudflare", "company": "Cloudflare", "country": "US", "category": "Hosting", "requests": 1 }, { "name": "jsDelivr", "company": "jsDelivr", "category": "Hosting", "requests": 3 } ] }, "mixed_content": { "third_party_scripts": 0 }, "status": { "up": true, "code": 200, "timings": { "dns": 4, "tls": 16, "wait": 136, "connect": 9, "download": 11 }, "response_ms": 176 }, "tls_connection": { "alpn": "h2", "cipher": "TLS_AES_256_GCM_SHA384", "protocol": "TLSv1.3", "versions": [ "TLSv1", "TLSv1.1", "TLSv1.2", "TLSv1.3" ], "authorized": true, "forward_secrecy": true }, "ports": { "open": [ 80, 443, 8080 ] }, "carbon": { "bytes": 76442, "co2_grams": 0.0028, "cleaner_than": 28 }, "dns_server": { "ns": [ { "ip": "108.162.195.99", "host": "viddy.ns.cloudflare.com" }, { "ip": "172.64.34.201", "host": "phoenix.ns.cloudflare.com" } ], "zone": "renteloradvisors.net" }, "cookies": { "cookies": [ { "name": "cf-c", "http_only": true, "same_site": "Lax" }, { "name": "__cf_clicked" } ] }, "location": { "ip": "2606:4700:3030::6815:1fe6", "asn": "13335", "org": "Cloudflare, Inc.", "city": "Toronto", "country": "CA" }, "ssl": { "issuer": "Let's Encrypt / YE1", "subject": "renteloradvisors.net" }, "dns": { "A": [ "172.67.180.187", "104.21.31.230" ], "NS": [ "phoenix.ns.cloudflare.com", "viddy.ns.cloudflare.com" ], "SOA": "{\"nsname\": \"phoenix.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2418655800, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}", "TXT": [ "google-site-verification=oVRDEM6525MUcualEixV4RS9D-9b4cKdOHq7Zy4QV-8" ], "AAAA": [ "2606:4700:3032::ac43:b4bb", "2606:4700:3030::6815:1fe6" ] }, "dnssec": { "ds": false, "rrsig": false, "dnskey": false }, "hsts": { "message": "Site does not serve any HSTS headers." }, "http_security": { "xFrameOptions": false, "referrerPolicy": "same-origin", "xXSSProtection": false, "permissionsPolicy": false, "xContentTypeOptions": "nosniff", "contentSecurityPolicy": false, "strictTransportPolicy": false, "crossOriginOpenerPolicy": false, "crossOriginEmbedderPolicy": false, "crossOriginResourcePolicy": false }, "firewall": { "waf": "Cloudflare", "has_waf": true }, "get_ip": { "ip": "2606:4700:3032::ac43:b4bb", "family": 6 }, "redirects": { "chain": [ "https://renteloradvisors.net" ] }, "linked_pages": { "internal_count": 9 }, "whois": { "registrar": "Dynadot Inc", "created": "2026-09-27T15:02:52Z", "updated": "2026-10-28T02:46:54Z", "expires": "2027-09-27T15:02:52Z", "status": [ "clientTransferProhibited https://icann.org/epp" ], "nameservers": [ "phoenix.ns.cloudflare.com", "viddy.ns.cloudflare.com" ] }, "headers": { "headers": { "server": "cloudflare", "content-type": "text/html; charset=utf-8", "x-content-type-options": "nosniff", "referrer-policy": "same-origin", "via": "1.1 Caddy" } } } } ``` Capture recorded with this analysis (source URL, capture time and stored hash): {"url":"https://screenshots.phishdestroy.io/us/01a19ca3-97cc-740c-9cbc-40d6c479d41b.png","source":"URLScan","report_url":"https://urlscan.io/result/01a19ca3-97cc-740c-9cbc-40d6c479d41b/","captured_at":"2026-11-02T14:22:15Z","sha256":"651ef7c20358064d4fc28204cdff5da768a3701df58e65bbd3e445ed418d3220","model_image_sha256":"fdeb8c79b8948bda63cb9aea03671f0c2fe3ae8abd95527d6e2aabb540600a1e","available":true,"content_status":null} ## Complete dated records Availability observations: https://phishdestroy.io/domain/renteloradvisors.net/records.json?source=availability&format=json Source observation history: https://phishdestroy.io/domain/renteloradvisors.net/records.json?source=detections&format=json PhishStats records: https://phishdestroy.io/domain/renteloradvisors.net/records.json?source=phishstats&format=json Sent report records: https://phishdestroy.io/domain/renteloradvisors.net/records.json?source=sent_reports&format=json Report history: https://phishdestroy.io/domain/renteloradvisors.net/records.json?source=report_history&format=json Repeat report records: https://phishdestroy.io/domain/renteloradvisors.net/records.json?source=rereports&format=json Follow-up records: https://phishdestroy.io/domain/renteloradvisors.net/records.json?source=followups&format=json Content observations: https://phishdestroy.io/domain/renteloradvisors.net/records.json?source=content&format=json ## Dated availability observation Latest stored reachability observation ```json { "state": "alive", "label_key": "availability.active", "detail_key": "detail.latest_reachability", "params": [], "source": "current_http_probe", "record_id": 1747457, "scope": "checked_url", "observed_at": "2026-11-02T14:23:53Z", "http_status": 200, "http_observed_at": "2026-11-02T14:23:53Z", "stored_http_code": 200, "stored_http_observed_at": "2026-11-02T14:23:53Z", "legacy_site_status": "alive", "supports_outcome_badge": false, "content_classification": "unknown", "content_classification_at": null, "registration_state": "unknown", "policy": "20261102-dated-availability-v2" } ```