# PhishDestroy domain threat record: sylvexortrade.de

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/sylvexortrade.de/
Machine-readable companion: https://phishdestroy.io/domain/sylvexortrade.de/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-09 03:48:50 UTC
- Last availability or vendor check: 2026-10-22 10:38:06 UTC
- Stored record updated: 2026-10-22 16:07:29 UTC
- VirusTotal detections in the stored snapshot: 19/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored infrastructure

- Observed IP address: 158.94.210.119
- Registrar in stored WHOIS data: REGISTRAR_NOT_FOUND
- Last stored HTTP status: 200

## Evidence links

- URLScan report: https://urlscan.io/result/01a11ec5-c163-756c-92fa-e83f786021d9/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/sylvexortrade.de
- Certificate Transparency search: https://crt.sh/?q=%25.sylvexortrade.de
- Web Archive lookup: https://web.archive.org/web/*/https://sylvexortrade.de/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
sylvexortrade.de presents itself under the name "Sylvexor", and the "trade" in the domain points to a trading or investment platform. PhishDestroy first saw it on 2026-10-09 and added it to our blocklist, though we have not yet assigned it a specific scheme type. The site was still online with live content when we last checked on 2026-10-19.

How the scam works
The page title shows only a brand name, Sylvexor, so we cannot say which scheme runs behind it. The risk follows from the combination of a trading-style name, unfamiliar branding and broad vendor flagging. Sites like this can ask visitors to register, upload identity documents or move money onto the platform, and that money is hard to recover once sent. Treat any request for deposits, personal data or wallet access here as high risk.

Evidence
On 2026-10-09, 19 of 92 VirusTotal engines flagged the domain, including BitDefender, ESET, Forcepoint ThreatSeeker, alphaMountain.ai, CRDF, CyRadar, DNS8 and the Vietnamese anti-scam group Chong Lua Dao. Detections from that many unrelated vendors make a false positive unlikely. Spamhaus lists the domain in its DBL as a spam domain. It also appears in five AlienVault OTX threat pulses, which means other researchers have tied it to tracked malicious activity. PhishDestroy is the only blocklist listing it so far.

Infrastructure
The site resolves to 158.94.210.119 on the Omegatech LTD network (registered in the Seychelles), with servers located in the Netherlands. The certificate comes from Let's Encrypt, so the padlock in the browser only confirms an encrypted connection. It says nothing about who runs the site or whether it is legitimate.

What to do
Do not register, deposit funds or share documents on sylvexortrade.de. If you already sent money, stop further payments and refuse any later "fee", "tax" or "unlock" charge presented as the price of getting it back. Contact your bank or payment provider right away, and keep screenshots and transaction references for a police report. If you reused a password there, change it everywhere you used it and turn on two-factor authentication. Security teams should block the domain and its IP at the DNS or proxy level and check logs for earlier visits from their users.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a11ec5-c163-756c-92fa-e83f786021d9/
VirusTotal report: https://www.virustotal.com/gui/domain/sylvexortrade.de
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=sylvexortrade.de
Archived copy: https://web.archive.org/web/20261011203737/https://sylvexortrade.de/
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 10:40:19 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/Kc4HfYwv/cfcf67d5079d.png
  Captured: 2026-10-09 03:48:50 UTC
- URLScan capture: https://screenshots.phishdestroy.io/01a11ec5-c163-756c-92fa-e83f786021d9.png
  Captured: 2026-10-09 03:48:50 UTC
  Source report: https://urlscan.io/result/01a11ec5-c163-756c-92fa-e83f786021d9/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/252cd382-dc26-40ef-89a1-4e1118002b2e.png
  Captured: 2026-10-09 04:23:02 UTC
  Source report: https://radar.cloudflare.com/scan/252cd382-dc26-40ef-89a1-4e1118002b2e
  SHA-256: 7eb4fe368129d56580583d5257ebc8920bd25163c7e62f470fe6dc1d5377326c
- URLQuery: https://screenshots.phishdestroy.io/uq/08102c52-4c62-4462-b71c-741903bf7173.png
  Source report: https://urlquery.net/report/08102c52-4c62-4462-b71c-741903bf7173
  SHA-256: c181caf48f555ce40a0e996ad24da3c166bd47d8a07f55a1ce5c65d0196685c4
- URLScan · 2026-08-01: https://screenshots.phishdestroy.io/us/019fbd65-22bf-738b-a8ce-8bb441841b41.png
  Captured: 2026-08-01 12:55:56 UTC
  Source report: https://urlscan.io/result/019fbd65-22bf-738b-a8ce-8bb441841b41/
  SHA-256: af21a08edb9ae70b07b71478dd55df95ea72c3afe4be7b0901c02d2938874e2f
- URLScan · 2026-10-09: https://screenshots.phishdestroy.io/us/01a11eae-229c-76b2-a959-c5feec8d5dfd.png
  Captured: 2026-10-09 03:21:39 UTC
  Source report: https://urlscan.io/result/01a11eae-229c-76b2-a959-c5feec8d5dfd/
  SHA-256: e99b58c84775e11d158ee6427bbecdabbed5fbf09ead47f7016725ab0db1cb61

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-20T18:37:11Z",
        "uuid": "01a11ec5-c163-756c-92fa-e83f786021d9",
        "scanned_at": "2026-10-09T03:47:27Z",
        "final_url": "https://sylvexortrade.de/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://sylvexortrade.de/",
                "from": "http://sylvexortrade.de/",
                "status": 307
            }
        ],
        "ip": "158.94.210.119",
        "ips": [
            "158.94.210.119"
        ],
        "asns": [
            "202412"
        ],
        "countries": [
            "NL"
        ],
        "doc_hash": "8fcd02718014c36852908ed909dc250f13604720cae53ce4314c06dd318c728e",
        "script_hashes": [
            "8aa5f8f647356dcd4fc5dbbe0efd5bc0e8da74026bc61e24636e2e1f5749b0ce"
        ],
        "globals": [
            "__dclq",
            "__dclOrig",
            "__dclFlush",
            "__smsCheckBeforeSubmit",
            "__isSmsEnabled",
            "__isSmsVerified",
            "intlTelInput"
        ],
        "tls": {
            "san": [
                "sylvexortrade.de"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "YE2",
            "subject": "sylvexortrade.de",
            "protocol": "TLS 1.3",
            "valid_to": "2026-11-27T03:14:58Z",
            "valid_from": "2026-08-29T03:14:59Z"
        },
        "domain_age_days": 104,
        "apex_age_days": 104,
        "tls_age_days": 41,
        "tls_valid_days": 89,
        "requests": 5,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 83,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "content-type": "text/html; charset=utf-8",
            "x-content-type-options": "nosniff"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-20T18:47:07Z",
        "uuid": "252cd382-dc26-40ef-89a1-4e1118002b2e",
        "scanned_at": "2026-10-09T04:23:02Z",
        "final_url": "https://sylvexortrade.de/",
        "status": 200,
        "history": [
            {
                "url": "https://sylvexortrade.de/",
                "status": 200
            }
        ],
        "dom_hash": "bab8b2ecc852c395f42a9f863fbb3da413bdb89790cd073821afb78f6bc6fcd6",
        "doc_hash": "8ecf95a3d5941ffec89f28750215cb0f82934e33b62b8eea459d839a17ec58ff",
        "phishing_v2": [
            "phishing"
        ],
        "url_risks": [
            "Scam"
        ],
        "domain_risks": [
            "Malware",
            "Security threats",
            "Scam",
            "CIPA Filter",
            "CIPA"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "sylvexortrade.de",
                "type": "A",
                "value": "158.94.210.119"
            }
        ],
        "dnssec_valid": false,
        "ip": "158.94.210.119",
        "verdict": {
            "tags": [
                "malware"
            ],
            "malicious": true,
            "categories": [
                "malware"
            ]
        },
        "whois": {
            "updated": "2026-08-28T08:46:10Z",
            "nameservers": [
                "ns1.dyna-ns.net",
                "ns2.dyna-ns.net"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-21T04:40:48Z",
        "analysis_at": "2026-10-19T03:45:43Z",
        "stats": {
            "timeout": 0,
            "harmless": 41,
            "malicious": 15,
            "suspicious": 4,
            "undetected": 32
        },
        "detections": {
            "CRDF": "malicious",
            "ESET": "suspicious",
            "VIPRE": "phishing",
            "G-Data": "phishing",
            "Lionic": "phishing",
            "Sophos": "phishing",
            "CyRadar": "phishing",
            "Webroot": "malicious",
            "Fortinet": "spam",
            "Netcraft": "malicious",
            "SOCRadar": "phishing",
            "URLQuery": "suspicious",
            "Kaspersky": "phishing",
            "Seclookup": "malicious",
            "Gridinsoft": "suspicious",
            "BitDefender": "phishing",
            "Chong Lua Dao": "malicious",
            "alphaMountain.ai": "phishing",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "first_seen": "2026-06-26T13:34:41Z",
        "dns": [
            {
                "ttl": 300,
                "type": "NS",
                "value": "ns1.dyna-ns.net"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "158.94.210.119"
            },
            {
                "ttl": 300,
                "type": "SOA",
                "rname": "hostmaster.sylvexortrade.de",
                "value": "ns1.dyna-ns.net"
            },
            {
                "ttl": 300,
                "type": "NS",
                "value": "ns2.dyna-ns.net"
            }
        ],
        "dns_at": "2026-10-19T03:51:00Z",
        "jarm": "40d40d40d00000000043d43d00043d6aff5ab0f4fc31897186312c9e639319",
        "cert": {
            "san": [
                "sylvexortrade.de"
            ],
            "issuer": "Let's Encrypt / YE2",
            "serial": "62d423ce83749eed2c6d8e513fb189797d6",
            "sha256": "21c15c5e2f50a370e6d9c912454304a7ac40d66cbe5cf5c121721bae263d23ae",
            "subject": "sylvexortrade.de",
            "valid_to": "2026-11-27T03:14:58Z",
            "valid_from": "2026-08-29T03:14:59Z"
        },
        "rdap": {
            "status": [
                "active"
            ],
            "events": {
                "last changed": "2026-08-28T08:46:10Z"
            }
        }
    }
}
```