Spamhaus DBL
phishing domain
Domain security and threat intelligence
symbiosisfinance.net
In short
symbiosisfinance.net is a 1inch impersonation page detected by PhishDestroy on 2026-10-27.
“Symbiosis — Cross-Chain Bridge, Swap & Liquidity Protocol for Seamless DeFi”
- Registrar
TUCOWS.COM, CO- Resolved IP
172.67.148.49Cloudflare, Inc. · CDN- Registered
- Oct 10, 2026
- First observed
- Oct 27, 2026
PhishDestroy assessment High 66/100 Evidence score
Availability Last known active Latest stored reachability observation Observed HTTP probe
Risk signals
Spamhaus DBL: phishing domain Stored blocklist matches: 2 Automated brand label: 1inch Scam type: AML Scam Young domain: 17 days old
Analysis
Domain summary
symbiosisfinance.net is a 1inch impersonation page detected by PhishDestroy on 2026-10-27. Risk: high (66/100). Registrar: TUCOWS.COM, CO. Status: Last known active. Hosting: Cloudflare, Inc. PhishDestroy sent 1 abuse report. Listed on Spamhaus DBL. Do not enter credentials or connect a wallet.
High
- Status
- Last known active
- VirusTotal
- 0 / 92
- Blocklist matches
- 2
- Scam type
- AML Scam
- Hosting
- 172.67.148.49Cloudflare, Inc. · CDN
- Registrar
- TUCOWS.COM, CO
- Registered
- Oct 10, 2026
- Page captures
- 10
PhishDestroy threat report
Overview
PhishDestroy’s intake AI marked the site as malicious because it pretends to be the official Symbiosis Finance cross‑chain liquidity protocol, using the same branding and service wording on a look‑alike domain. The page was first observed by PhishDestroy on 2026-10-27, seventeen days after the domain was registered on 2026-10-10.
How the scam works
Brand‑impersonation scams register domains that closely resemble a legitimate project’s name, replicate its visual identity and copy marketing copy to convince users that the site is authentic. Victims may be prompted to connect crypto wallets, approve token transfers, or invest in bogus offerings, allowing attackers to steal funds or harvest personal data.
Evidence
VirusTotal scanned the domain on 2026-10-27 with 92 engines and reported zero malicious or suspicious detections. Google Safe Browsing checked the same day and did not flag the URL. External blocklists MetaMask and SEAL listed the domain, and PhishDestroy’s internal blocklist also contains it. URLScan captured the site on 2026-10-24; its machine‑learning engine assigned a malicious score of 94, though the overall verdict was not malicious. OTX recorded no pulses for the domain.
Infrastructure
The domain was registered with Tucows Domains Inc. on 2026-10-10 and is hosted behind Cloudflare, resolving to IP 172.67.148.49 (also 104.21.55.133) in Canada. TLS is provided by Let’s Encrypt with a certificate valid for 90 days starting 2026-10-26. No additional infrastructure details indicate the operator’s identity.
What to do
Do not enter credentials or connect a crypto wallet to this site. Security teams should block symbiosisfinance.net at the DNS or proxy level, monitor for related traffic, and log any access attempts for further investigation.
Useful links
urlscan.io scan and screenshotCloudflare Radar reportStored capture screenshotURLScan screenshot (2026-10-15T10:05:26Z)URLScan capture reportURLScan screenshot (2026-10-15T17:15:32Z)URLScan capture reportURLScan screenshot (2026-10-15T21:07:11Z)URLScan capture reportURLScan screenshot (2026-10-16T01:02:18Z)URLScan capture reportURLScan screenshot (2026-10-16T05:06:03Z)URLScan capture reportURLScan screenshot (2026-10-20T07:45:04Z)URLScan capture reportVirusTotal reportGoogle Safe Browsing statusReport phishing to GoogleSite owner? Request a review
Source evidenceVirusTotal 0 / 92 9 sources
URLScan
Malicious · engine verdict · score 82
SHA-256 d28b770fade05f05a3de3de6b78fe3405f6d9f10bf085daa94dd24868663c817
URLScanOriginal source recordObserved: 24 fields
Observed: · Retrieved:
Report ID
01a17e9c-ac08-71b4-b2b7-440497e29c73Final URL
https://symbiosisfinance.net/HTTP response
200Redirect type
https-onlyRedirects
- To
- https://symbiosisfinance.net/
- From
- http://symbiosisfinance.net/
- Status
- 307
IP address
104.21.55.133Contacted domains
- framerusercontent.com
- api.web3modal.org
- pulse.walletconnect.org
- api.symbiosis.finance
Contacted IP addresses
- 104.18.19.237
- 104.20.34.30
- 104.26.0.178
- 143.204.181.93
- 104.21.55.133
Autonomous systems (ASN)
- 13335
- 16509
Server countries
- US
Linked domains
- symbiosis.finance
- twitter.com
- t.me
- discord.com
- docs.symbiosis.finance
- app.symbiosis.finance
- x.com
- snapshot.org
- immunefi.com
- github.com
Social media links
- https://twitter.com/intent/follow
- https://t.me/symbiosis_finance
- https://discord.com/invite/ymbRx6ADvR
- https://x.com/0xPolygon/status/2079938748301619573
- https://x.com/lifiprotocol/status/1777678446291763611
- https://x.com/trondao/status/2072790418907955606
- https://x.com/ton_blockchain/status/1805579246703722913
- https://x.com/BNBCHAIN/status/2072983739970269575
- https://github.com/symbiosis-finance/audits
Document hash
d28b770fade05f05a3de3de6b78fe3405f6d9f10bf085daa94dd24868663c817Script hashes
- 60e5002b458452adea53da56fe2e5b2b1e1bc700d1b7030d6a15803a74e868eb
- 044009228a24ac4561339144f7d9fdc03e28ae82aa3a30e33ceff83368bf8a19
- 8aec9ff75ffa86a03d51268b63126abadb3754aa5a6b6c5bb16e4e2446a63dee
- 159189f6ce9fdcbee1ad0006e6908747ababbfd5c9f17cd3625424b2bd546a33
- ba0a948f201a8cd20be8407c58241f8fa25860815136f1b915ee145bd5def32d
- ee23f479c6488f99335e18cc629fe0d572d72f411b3ab605a6de6f600228083b
- d628b5350945c1d5ae71a9027ea2ffd5501cd7400247be075e74e9dec794ad72
- 79a812ad92dd4dab033e46c2a3797b86f8d946744339813bfa3e935f62f8a096
- dcc469ce759355e13bd956a87cf294c83399f67b0b68b8bdbe421fe328e52785
- fb20cf709d09f452726e984e5a29609753024c184350ed6b148aa3b549642edb
JavaScript globals
- Buffer
- global
- __reactRouterVersion
- proto
- TronWebProto
- mmsdk
- _walletConnectCore_clientOne_count
- downloadLogsBlobInBrowser
- _walletConnectCore_clientOne
- _walletConnectCore_clientTwo_count
- _walletConnectCore_clientTwo
- litPropertyMetadata
- reactiveElementVersions
- litHtmlVersions
- litElementVersions
Browser storage keys
- wagmi.store
- rk-version
- mm-sdk-anon-id
- @appkit/active_caip_network_id
- @appkit/active_namespace
- @appkit/connection_status
- base-acc-sdk.store
TLS session and certificate
- Subject alternative names
- *.symbiosisfinance.net
- symbiosisfinance.net
- Cipher
- AES_128_GCM
- Issuer
- YE1
- Subject
- symbiosisfinance.net
- Protocol
- QUIC
- Valid until
- Valid from
Domain age, days
733Registered domain age, days
733Certificate age, days
0Certificate validity, days
89Page requests
100Provider verdicts
- Engine verdict
- Tags
- urlscan-ml
- urlscan-ml-60c5e22
- Score
- 82
- Malicious
- Yes
- Overall verdict
- Score
- 0
- Malicious
- No
HTTP headers
- Server
- cloudflare
- Content-type
- text/html
Original source fields · JSON
| Uuid | 01a17e9c-ac08-71b4-b2b7-440497e29c73 |
|---|---|
| Final url | https://symbiosisfinance.net/ |
| Status | 200 |
| Redirected | https-only |
| Redirects | [
{
"to": "https://symbiosisfinance.net/",
"from": "http://symbiosisfinance.net/",
"status": 307
}
] |
| Ip | 104.21.55.133 |
| Contacted domains | [
"framerusercontent.com",
"api.web3modal.org",
"pulse.walletconnect.org",
"api.symbiosis.finance"
] |
| Contacted IP addresses | [
"104.18.19.237",
"104.20.34.30",
"104.26.0.178",
"143.204.181.93",
"104.21.55.133"
] |
| Asns | [
"13335",
"16509"
] |
| Countries | [
"US"
] |
| Linked domains | [
"symbiosis.finance",
"twitter.com",
"t.me",
"discord.com",
"docs.symbiosis.finance",
"app.symbiosis.finance",
"x.com",
"snapshot.org",
"immunefi.com",
"github.com"
] |
| Social | [
"https://twitter.com/intent/follow",
"https://t.me/symbiosis_finance",
"https://discord.com/invite/ymbRx6ADvR",
"https://x.com/0xPolygon/status/2079938748301619573",
"https://x.com/lifiprotocol/status/1777678446291763611",
"https://x.com/trondao/status/2072790418907955606",
"https://x.com/ton_blockchain/status/1805579246703722913",
"https://x.com/BNBCHAIN/status/2072983739970269575",
"https://github.com/symbiosis-finance/audits"
] |
| Document hash | d28b770fade05f05a3de3de6b78fe3405f6d9f10bf085daa94dd24868663c817 |
| Script hashes | [
"60e5002b458452adea53da56fe2e5b2b1e1bc700d1b7030d6a15803a74e868eb",
"044009228a24ac4561339144f7d9fdc03e28ae82aa3a30e33ceff83368bf8a19",
"8aec9ff75ffa86a03d51268b63126abadb3754aa5a6b6c5bb16e4e2446a63dee",
"159189f6ce9fdcbee1ad0006e6908747ababbfd5c9f17cd3625424b2bd546a33",
"ba0a948f201a8cd20be8407c58241f8fa25860815136f1b915ee145bd5def32d",
"ee23f479c6488f99335e18cc629fe0d572d72f411b3ab605a6de6f600228083b",
"d628b5350945c1d5ae71a9027ea2ffd5501cd7400247be075e74e9dec794ad72",
"79a812ad92dd4dab033e46c2a3797b86f8d946744339813bfa3e935f62f8a096",
"dcc469ce759355e13bd956a87cf294c83399f67b0b68b8bdbe421fe328e52785",
"fb20cf709d09f452726e984e5a29609753024c184350ed6b148aa3b549642edb"
] |
| Globals | [
"Buffer",
"global",
"__reactRouterVersion",
"proto",
"TronWebProto",
"mmsdk",
"_walletConnectCore_clientOne_count",
"downloadLogsBlobInBrowser",
"_walletConnectCore_clientOne",
"_walletConnectCore_clientTwo_count",
"_walletConnectCore_clientTwo",
"litPropertyMetadata",
"reactiveElementVersions",
"litHtmlVersions",
"litElementVersions"
] |
| Storage keys | [
"wagmi.store",
"rk-version",
"mm-sdk-anon-id",
"@appkit/active_caip_network_id",
"@appkit/active_namespace",
"@appkit/connection_status",
"base-acc-sdk.store"
] |
| Tls | {
"san": [
"*.symbiosisfinance.net",
"symbiosisfinance.net"
],
"cipher": "AES_128_GCM",
"issuer": "YE1",
"subject": "symbiosisfinance.net",
"protocol": "QUIC",
"valid_to": "2027-01-24T22:52:49Z",
"valid_from": "2026-10-26T22:52:50Z"
} |
| Domain age days | 733 |
| Apex age days | 733 |
| Tls age days | 0 |
| Tls valid days | 89 |
| Requests | 100 |
| Provider verdicts | {
"engines": {
"tags": [
"urlscan-ml",
"urlscan-ml-60c5e22"
],
"score": 82,
"malicious": true
},
"overall": {
"score": 0,
"malicious": false
}
} |
| HTTP headers | {
"server": "cloudflare",
"content-type": "text/html"
} |
Separate monitor record · date not recorded
Separate stored monitor snapshot; does not replace the primary report record or establish current availability.
- record_source
- domain_monitor.urlscan
- uuid
- 01a16cca-ccd4-756d-8076-7da7bf5f2232
- score
- null
- malicious
- null
- result_at
- null
- enriched_at
- null
- source_timestamps
- {"urlscan_result_at":null,"urlscan_enriched_at":null}
- timestamp_basis
- Europe/Berlin, as used by the existing report; source timestamps are retained verbatim
VirusTotal
0 / 92 engine detections · stored summary
Open reportVirusTotalOriginal source recordObserved: 13 fields
Observed: · Retrieved:
Vendor result counts
- Timeout
- 0
- Harmless
- 55
- Malicious
- 0
- Suspicious
- 0
- Undetected
- 37
Reputation score
0Registrar
TUCOWS.COM, CO.Created
Expires
Updated
First seen
DNS records
- TTL, seconds
- 300
- Type
- AAAA
- Value
- 2606:4700:3033::ac43:9431
- TTL, seconds
- 21600
- Type
- NS
- Value
- jermaine.ns.cloudflare.com
- TTL, seconds
- 300
- Type
- TXT
- Value
- google-site-verification=F3hftPHoWrZbgUgiQ1Q15YfBacLYVfSzavg4dxfob7Q
- TTL, seconds
- 21600
- Type
- NS
- Value
- suzanne.ns.cloudflare.com
- TTL, seconds
- 300
- Type
- A
- Value
- 172.67.148.49
- TTL, seconds
- 300
- Type
- AAAA
- Value
- 2606:4700:3036::6815:3785
- TTL, seconds
- 300
- Type
- A
- Value
- 104.21.55.133
- TTL, seconds
- 1800
- Type
- SOA
- Responsible mailbox
- dns.cloudflare.com
- Value
- jermaine.ns.cloudflare.com
DNS records observed
JARM fingerprint
27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525cCertificate
- Subject alternative names
- *.symbiosisfinance.net
- symbiosisfinance.net
- Issuer
- Let's Encrypt / YE1
- Serial
- 66c2234023b6da9a12cd7ca542e064cb5b9
- SHA-256
- 56305d9c429eec2ada62e1248b7eefcaa033a7c15b76586716d48d04accbdf97
- Subject
- symbiosisfinance.net
- Valid until
- Valid from
Registration record
- Registrar
- TUCOWS.COM, CO.
- Registrar IANA ID
- 69
- Registrar URL
- http://tucowsdomains.com
- Registered
- Updated
- Expires
- Status
- clientTransferProhibited
- clientUpdateProhibited
- Nameservers
- kiki.ns.cloudflare.com
- pablo.ns.cloudflare.com
- DNSSEC
- unsigned
Registry data (RDAP)
- Status
- client transfer prohibited
- client update prohibited
- Registry events
- Last changed
- Registration
- Registrar expiration
- Last RDAP database update
Original source fields · JSON
| Vendor result counts | {
"timeout": 0,
"harmless": 55,
"malicious": 0,
"suspicious": 0,
"undetected": 37
} |
|---|---|
| Reputation | 0 |
| Registrar | TUCOWS.COM, CO. |
| Created | 2026-10-10T02:01:31Z |
| Expires | 2027-10-10T02:01:31Z |
| Updated | 2026-10-10T23:52:17Z |
| First seen | 2024-10-24T18:13:46Z |
| DNS records | [
{
"ttl": 300,
"type": "AAAA",
"value": "2606:4700:3033::ac43:9431"
},
{
"ttl": 21600,
"type": "NS",
"value": "jermaine.ns.cloudflare.com"
},
{
"ttl": 300,
"type": "TXT",
"value": "google-site-verification=F3hftPHoWrZbgUgiQ1Q15YfBacLYVfSzavg4dxfob7Q"
},
{
"ttl": 21600,
"type": "NS",
"value": "suzanne.ns.cloudflare.com"
},
{
"ttl": 300,
"type": "A",
"value": "172.67.148.49"
},
{
"ttl": 300,
"type": "AAAA",
"value": "2606:4700:3036::6815:3785"
},
{
"ttl": 300,
"type": "A",
"value": "104.21.55.133"
},
{
"ttl": 1800,
"type": "SOA",
"rname": "dns.cloudflare.com",
"value": "jermaine.ns.cloudflare.com"
}
] |
| Dns at | 2026-10-27T16:23:10Z |
| Jarm | 27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c |
| Certificate | {
"san": [
"*.symbiosisfinance.net",
"symbiosisfinance.net"
],
"issuer": "Let's Encrypt / YE1",
"serial": "66c2234023b6da9a12cd7ca542e064cb5b9",
"sha256": "56305d9c429eec2ada62e1248b7eefcaa033a7c15b76586716d48d04accbdf97",
"subject": "symbiosisfinance.net",
"valid_to": "2027-01-24T22:52:49Z",
"valid_from": "2026-10-26T22:52:50Z"
} |
| Registration record | {
"registrar": "TUCOWS.COM, CO.",
"registrar_iana_id": "69",
"registrar_url": "http://tucowsdomains.com",
"created": "2026-10-10T02:01:31Z",
"updated": "2026-10-10T23:52:16Z",
"expires": "2027-10-10T02:01:31Z",
"status": [
"clientTransferProhibited",
"clientUpdateProhibited"
],
"nameservers": [
"kiki.ns.cloudflare.com",
"pablo.ns.cloudflare.com"
],
"dnssec": "unsigned"
} |
| Registry data | {
"status": [
"client transfer prohibited",
"client update prohibited"
],
"events": {
"last changed": "2026-10-10T23:52:16Z",
"registration": "2026-10-10T02:01:31Z",
"registrar expiration": "2027-10-10T02:01:31Z",
"last update of RDAP database": "2026-10-10T23:52:16Z"
}
} |
Separate source record · 0 malicious + 0 suspicious / 92 · 2026-10-27 16:21:56 UTC
The summary above and this provider record were collected at different times. Both remain available; malicious and suspicious classifications are shown separately.
- record_source
- collected_observations.vt
- analysis_at
- 2026-10-27T16:21:56Z
- fetched_at
- 2026-10-27T18:23:50Z
- stats
- {"timeout":0,"harmless":55,"malicious":0,"suspicious":0,"undetected":37}
URLQuery
Scan report
Open reportOTX
no community references
Open reportCloudflare Radar
provider verdict: clean
Open reportCloudflare RadarOriginal source recordObserved: 11 fields
Observed: · Retrieved:
Report ID
c9831bd6-e463-4c67-98c6-63f1c708fcedFinal URL
https://symbiosisfinance.net/HTTP response
200Navigation history
- URL
- https://symbiosisfinance.net/
- Status
- 200
DOM structure hash
2b682f1d80bc2b50f0813873e3f37657b1a92b80936f94b395a4d0098f1e4ff1Document hash
3b8e993fd5cc8eaa5524598fe0f1acd0fe280fc1f1872efd8e9ddb18bbebea59Cloudflare Radar rank
- Rank range
- >200000
DNS records
- Name
- symbiosisfinance.net
- Type
- A
- Value
- 172.67.148.49
- Name
- symbiosisfinance.net
- Type
- A
- Value
- 104.21.55.133
- Name
- symbiosisfinance.net
- Type
- AAAA
- Value
- 2606:4700:3036::6815:3785
- Name
- symbiosisfinance.net
- Type
- AAAA
- Value
- 2606:4700:3033::ac43:9431
DNSSEC valid
NoIP address
127.0.1.21Registration record
- Registrar
- Tucows Domains Inc.
- Registered
- Updated
- Expires
- Nameservers
- jermaine.ns.cloudflare.com
- suzanne.ns.cloudflare.com
Original source fields · JSON
| Uuid | c9831bd6-e463-4c67-98c6-63f1c708fced |
|---|---|
| Final url | https://symbiosisfinance.net/ |
| Status | 200 |
| History | [
{
"url": "https://symbiosisfinance.net/",
"status": 200
}
] |
| DOM structure hash | 2b682f1d80bc2b50f0813873e3f37657b1a92b80936f94b395a4d0098f1e4ff1 |
| Document hash | 3b8e993fd5cc8eaa5524598fe0f1acd0fe280fc1f1872efd8e9ddb18bbebea59 |
| Radar rank | {
"bucket": ">200000"
} |
| DNS records | [
{
"name": "symbiosisfinance.net",
"type": "A",
"value": "172.67.148.49"
},
{
"name": "symbiosisfinance.net",
"type": "A",
"value": "104.21.55.133"
},
{
"name": "symbiosisfinance.net",
"type": "AAAA",
"value": "2606:4700:3036::6815:3785"
},
{
"name": "symbiosisfinance.net",
"type": "AAAA",
"value": "2606:4700:3033::ac43:9431"
}
] |
| Dnssec valid | false |
| Ip | 127.0.1.21 |
| Registration record | {
"registrar": "Tucows Domains Inc.",
"created": "2026-10-10T02:01:31Z",
"updated": "2026-10-26T23:48:44Z",
"expires": "2027-10-10T02:01:31Z",
"nameservers": [
"jermaine.ns.cloudflare.com",
"suzanne.ns.cloudflare.com"
]
} |
Google Safe Browsing
No threat flag
Open reportPhishDestroy DOM
10 / 100 · heuristic score · 19 brand references · 1 classification
Open reportPhishDestroy narrative
Narrative generation metadata
Open reportTitle, description and generation record
The narrative generation date is separate from observation dates. These are the retained publication fields, not an additional independent detection.
- ai_title
- symbiosisfinance.net — Brand Impersonation of Symbiosis
- ai_description
- PhishDestroy flagged symbiosisfinance.net as a malicious brand‑impersonation of Symbiosis Finance on 2026-10-27, shortly after registration.
- ai_generated_at
- 2026-10-27T18:26:17Z
- ai_generated_by
- threat-v3-groq
- interpretation
- Narrative generation metadata, separate from provider observation dates.
Results reflect each source’s collection time. Zero detections do not guarantee safety. OTX references are community publications.
Collected source details
Stored page, network and scanner observations, grouped by source and observation time.
Every stored field, with its source and date
Website checksOriginal source recordRetrieved: 26 fields
Mail configuration
- SPF lookups
- 0
CAA records
- Domain
- symbiosisfinance.net
Protective DNS results
- Resolvers checked
- 12
- Blocking resolvers
- 0
Web archive observations
- Last observation
- First observation
- Recorded changes
- 1
- Archived days
- 2
- Snapshots per day
- 0.06
- Average page size, bytes
- 1985
Crawler rules
- User agents
- *
- OAI-SearchBot
- ChatGPT-User
- Claude-SearchBot
- Claude-User
- Present
- Yes
- llms.txt file
- Yes
- Sitemap URLs
- https://symbiosisfinance.net/sitemap.xml
Sitemap
- Present
- Yes
- URL count
- 34
Page title and metadata
- Open Graph URL
- https://symbiosisfinance.net/
- Page title
- Symbiosis — Cross-Chain Bridge, Swap & Liquidity Protocol for Seamless DeFi
- Open Graph type
- website
- Open Graph image
- https://symbiosisfinance.net/icons/icon-512.png
- Open Graph title
- Symbiosis — Cross-Chain Bridge, Swap & Liquidity Protocol for Seamless DeFi
- Keywords
- Symbiosis, Symbiosis Finance, Swap & Bridge, cross-chain swap, cross-chain bridge, liquidity protocol, cross-chain DEX, Bitcoin, Solana, Tron, 50+ networks, best rates, low fees, no KYC, non-custodial, SIS token, veSIS, Octopools, MCP server
- Theme color
- #8bf934
- Description
- Symbiosis is a cross-chain liquidity protocol: swap and bridge Bitcoin, Solana, Tron, and 50+ networks at the best rates, with low fees and no KYC.
- Twitter card
- summary_large_image
- Canonical URL
- https://symbiosisfinance.net/
- Open Graph description
- Symbiosis is a cross-chain liquidity protocol: swap and bridge Bitcoin, Solana, Tron, and 50+ networks at the best rates, with low fees and no KYC.
Trackers
- Requests
- 90
- Observed services
- Name
- Framer
- Company
- Framer
- Country
- NL
- Category
- Hosting
- Requests
- 56
Forms and mixed content
- Third-party scripts
- 0
HTTP response
- Reachable
- Yes
- HTTP status
- 200
- Request timings, ms
- DNS
- 1
- TLS
- 18
- Waiting
- 289
- Connection
- 9
- Download
- 0
- Response time, ms
- 317
TLS connection
- ALPN
- h2
- Cipher
- TLS_AES_256_GCM_SHA384
- Protocol
- TLSv1.3
- Supported versions
- TLSv1
- TLSv1.1
- TLSv1.2
- TLSv1.3
- Certificate authorized
- Yes
- Forward secrecy
- Yes
Ports
- Open ports
- 80
- 443
- 8080
Carbon estimate
- Bytes
- 5456
- CO₂, grams
- 0.0002
- Cleaner than, %
- 85
DNS servers
- Nameservers
- IP address
- 108.162.194.87
- Host
- suzanne.ns.cloudflare.com
- IP address
- 172.64.35.157
- Host
- jermaine.ns.cloudflare.com
- DNS zone
- symbiosisfinance.net
Location
- IP address
- 2606:4700:3036::6815:3785
- ASN
- 13335
- Organization
- Cloudflare, Inc.
- City
- Toronto
- Country
- CA
TLS certificate
- Issuer
- Let's Encrypt / YE1
- Subject
- symbiosisfinance.net
DNS records
- A
- 172.67.148.49
- 104.21.55.133
- NS
- suzanne.ns.cloudflare.com
- jermaine.ns.cloudflare.com
- SOA
- Primary nameserver
- jermaine.ns.cloudflare.com
- Hostmaster
- dns.cloudflare.com
- Serial
- 2418557694
- Refresh, seconds
- 10000
- Retry, seconds
- 2400
- Expiry, seconds
- 604800
- Minimum TTL, seconds
- 1800
- TXT
- google-site-verification=F3hftPHoWrZbgUgiQ1Q15YfBacLYVfSzavg4dxfob7Q
- AAAA
- 2606:4700:3036::6815:3785
- 2606:4700:3033::ac43:9431
DNSSEC
- DS record
- No
- RRSIG
- No
- DNSKEY
- No
HSTS
- Observation
- Site does not serve any HSTS headers.
HTTP security policies
- X-Frame-Options
- No
- Referrer-Policy
- No
- X-XSS-Protection
- No
- Permissions-Policy
- No
- X-Content-Type-Options
- No
- Content-Security-Policy
- No
- Strict-Transport-Security
- No
- Cross-Origin-Opener-Policy
- No
- Cross-Origin-Embedder-Policy
- No
- Cross-Origin-Resource-Policy
- No
Web application firewall
- WAF product
- Cloudflare
- WAF detected
- Yes
IP lookup
- IP address
- 2606:4700:3036::6815:3785
- IP version
- 6
Redirects
- Redirect chain
- https://symbiosisfinance.net
Subdomains
- Count
- 1
- Subdomains
- www.symbiosisfinance.net
Registration record
- Registrar
- Tucows Domains Inc.
- Registered
- Updated
- Expires
- Status
- clientTransferProhibited https://icann.org/epp
- clientUpdateProhibited https://icann.org/epp
- Nameservers
- jermaine.ns.cloudflare.com
- suzanne.ns.cloudflare.com
HTTP headers
- Response headers
- Server
- cloudflare
- Content-type
- text/html
Original source fields · JSON
| Mail configuration | {
"spf_lookups": 0
} |
|---|---|
| Caa records | {
"domain": "symbiosisfinance.net"
} |
| Protective DNS results | {
"resolvers": 12,
"blocked_count": 0
} |
| Web archive observations | {
"last": "2026-10-27T18:23:37Z",
"first": "2026-10-11T21:24:32Z",
"changes": 1,
"days_archived": 2,
"scans_per_day": 0.06,
"avg_page_bytes": 1985
} |
| Crawler rules | {
"agents": [
"*",
"OAI-SearchBot",
"ChatGPT-User",
"Claude-SearchBot",
"Claude-User"
],
"present": true,
"llms_txt": true,
"sitemaps": [
"https://symbiosisfinance.net/sitemap.xml"
]
} |
| Sitemap | {
"present": true,
"url_count": 34
} |
| Page title and metadata | {
"ogUrl": "https://symbiosisfinance.net/",
"title": "Symbiosis — Cross-Chain Bridge, Swap & Liquidity Protocol for Seamless DeFi",
"ogType": "website",
"ogImage": "https://symbiosisfinance.net/icons/icon-512.png",
"ogTitle": "Symbiosis — Cross-Chain Bridge, Swap & Liquidity Protocol for Seamless DeFi",
"keywords": "Symbiosis, Symbiosis Finance, Swap & Bridge, cross-chain swap, cross-chain bridge, liquidity protocol, cross-chain DEX, Bitcoin, Solana, Tron, 50+ networks, best rates, low fees, no KYC, non-custodial, SIS token, veSIS, Octopools, MCP server",
"themeColor": "#8bf934",
"description": "Symbiosis is a cross-chain liquidity protocol: swap and bridge Bitcoin, Solana, Tron, and 50+ networks at the best rates, with low fees and no KYC.",
"twitterCard": "summary_large_image",
"canonicalUrl": "https://symbiosisfinance.net/",
"ogDescription": "Symbiosis is a cross-chain liquidity protocol: swap and bridge Bitcoin, Solana, Tron, and 50+ networks at the best rates, with low fees and no KYC."
} |
| Trackers | {
"requests": 90,
"trackers": [
{
"name": "Framer",
"company": "Framer",
"country": "NL",
"category": "Hosting",
"requests": 56
}
]
} |
| Forms and mixed content | {
"third_party_scripts": 0
} |
| Status | {
"up": true,
"code": 200,
"timings": {
"dns": 1,
"tls": 18,
"wait": 289,
"connect": 9,
"download": 0
},
"response_ms": 317
} |
| TLS connection | {
"alpn": "h2",
"cipher": "TLS_AES_256_GCM_SHA384",
"protocol": "TLSv1.3",
"versions": [
"TLSv1",
"TLSv1.1",
"TLSv1.2",
"TLSv1.3"
],
"authorized": true,
"forward_secrecy": true
} |
| Ports | {
"open": [
80,
443,
8080
]
} |
| Carbon | {
"bytes": 5456,
"co2_grams": 0.0002,
"cleaner_than": 85
} |
| Dns server | {
"ns": [
{
"ip": "108.162.194.87",
"host": "suzanne.ns.cloudflare.com"
},
{
"ip": "172.64.35.157",
"host": "jermaine.ns.cloudflare.com"
}
],
"zone": "symbiosisfinance.net"
} |
| Location | {
"ip": "2606:4700:3036::6815:3785",
"asn": "13335",
"org": "Cloudflare, Inc.",
"city": "Toronto",
"country": "CA"
} |
| Ssl | {
"issuer": "Let's Encrypt / YE1",
"subject": "symbiosisfinance.net"
} |
| DNS records | {
"A": [
"172.67.148.49",
"104.21.55.133"
],
"NS": [
"suzanne.ns.cloudflare.com",
"jermaine.ns.cloudflare.com"
],
"SOA": "{\"nsname\": \"jermaine.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2418557694, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}",
"TXT": [
"google-site-verification=F3hftPHoWrZbgUgiQ1Q15YfBacLYVfSzavg4dxfob7Q"
],
"AAAA": [
"2606:4700:3036::6815:3785",
"2606:4700:3033::ac43:9431"
]
} |
| Dnssec | {
"ds": false,
"rrsig": false,
"dnskey": false
} |
| Hsts | {
"message": "Site does not serve any HSTS headers."
} |
| HTTP security policies | {
"xFrameOptions": false,
"referrerPolicy": false,
"xXSSProtection": false,
"permissionsPolicy": false,
"xContentTypeOptions": false,
"contentSecurityPolicy": false,
"strictTransportPolicy": false,
"crossOriginOpenerPolicy": false,
"crossOriginEmbedderPolicy": false,
"crossOriginResourcePolicy": false
} |
| Firewall | {
"waf": "Cloudflare",
"has_waf": true
} |
| Get ip | {
"ip": "2606:4700:3036::6815:3785",
"family": 6
} |
| Redirects | {
"chain": [
"https://symbiosisfinance.net"
]
} |
| Subdomains | {
"count": 1,
"subdomains": [
"www.symbiosisfinance.net"
]
} |
| Registration record | {
"registrar": "Tucows Domains Inc.",
"created": "2026-10-10T02:01:31Z",
"updated": "2026-10-26T23:48:44Z",
"expires": "2027-10-10T02:01:31Z",
"status": [
"clientTransferProhibited https://icann.org/epp",
"clientUpdateProhibited https://icann.org/epp"
],
"nameservers": [
"jermaine.ns.cloudflare.com",
"suzanne.ns.cloudflare.com"
]
} |
| HTTP headers | {
"headers": {
"server": "cloudflare",
"content-type": "text/html"
}
} |
Questions about symbiosisfinance.net
Is symbiosisfinance.net legit?
No. PhishDestroy classifies symbiosisfinance.net as a 1inch impersonation page (risk: high, 66/100); it was first detected on 2026-10-27. Listed on Spamhaus DBL. Treat the site as unsafe.
Is symbiosisfinance.net safe to connect a wallet?
No. Do not connect a wallet, sign messages or approve tokens on symbiosisfinance.net. Phishing sites ask for approvals (approve, setApprovalForAll, Permit2) that let the operator move your assets, and a confirmed transaction cannot be reversed.
What should I do if I used symbiosisfinance.net?
Change every password you entered there and turn on two-factor authentication. If you connected a wallet or signed something, revoke the approvals and move the remaining funds to a new wallet; never share your seed phrase. Step-by-step help: emergency guide.
Explore
Blocklist matchesMetaMask · PhishDestroy · SEAL · no match in the other 9 3
Checked, no match
Last checked
Stored Capture · 10 captures
All capture links and hashes (10)
- Primary capture · 2026-10-27 18:28 UTC
- URLScan capture 1 · 2026-10-27 18:28 UTC · Source report
- URLScan · 2026-10-24 · 2026-10-24 07:23 UTC · Source report
SHA-256:1f47e89ca11b840458d9a2030db86807027a6a38616b08c1e29897640a4e4a49· 374682 bytes - URLScan · 2026-10-15 · 2026-10-15 10:05 UTC · Source report
SHA-256:9e77a0b8ebbd7c3e3ebf96658cce914ff3b36e64a0395a07a8b2d1fadfd91781· 307810 bytes - URLScan · 2026-10-15 · 2026-10-15 17:15 UTC · Source report
SHA-256:9e77a0b8ebbd7c3e3ebf96658cce914ff3b36e64a0395a07a8b2d1fadfd91781· 307810 bytes - URLScan · 2026-10-15 · 2026-10-15 21:07 UTC · Source report
SHA-256:9e77a0b8ebbd7c3e3ebf96658cce914ff3b36e64a0395a07a8b2d1fadfd91781· 307810 bytes - URLScan · 2026-10-16 · 2026-10-16 05:06 UTC · Source report
SHA-256:9e77a0b8ebbd7c3e3ebf96658cce914ff3b36e64a0395a07a8b2d1fadfd91781· 307810 bytes - URLScan · 2026-10-20 · 2026-10-20 07:45 UTC · Source report
SHA-256:1f47e89ca11b840458d9a2030db86807027a6a38616b08c1e29897640a4e4a49· 374682 bytes - Cloudflare Radar · 2026-10-27 18:23 UTC · Source report
SHA-256:549b29ea644a3c8518154e97aed6db67a305622db216c28080865d16c7aaee1b· 705464 bytes - URLQuery · Capture time unavailable · Source report
SHA-256:c168bfd25d7a3a7c1c9e62477767f81c2a2795430c85fdd0db96a02b45d3caed· 662758 bytes
Domain details
Domain
IP Context 172.67.148.49 Cloudflare shared edge origin IP hidden Edge-IP reputation is not attributed to this domain.
172.67.148.49 Cloudflare shared edge origin IP hidden Edge-IP reputation is not attributed to this domain. Registrar TUCOWS.COM, CO (KN)
(KN) RegistrationCreated Oct 10, 2026 (17d · Very New!) — Expires Oct 10, 2027
Registrant countrySt. Kitts & Nevis VirusTotal WHOIS
Registrant1f8f4166599d23eeacf433f097f57c8cs@ VirusTotal WHOIS
WHOIS statusclientTransferProhibitedclientUpdateProhibited
HTTP Status200
Technical detailsProvenance & timestamps
First DetectedOct 27, 2026
DOM Analysis
Submitted URLhttp://symbiosisfinance.net/
Favicon Hash
Case ID
Network & certificates
Stored technical evidenceNetwork & DNS
Shared CDN edge- Resolved IP
- 172.67.148.49
- Network ASN
- AS13335
- Organization
- Cloudflare, Inc.
- Observed location
- Toronto, CA
- Server header
- cloudflare
Edge-IP reputation is not attributed to this domain.
Nameservers 2
jermaine.ns.cloudflare.comsuzanne.ns.cloudflare.com
SOA
nsname: jermaine.ns.cloudflare.comhostmaster: dns.cloudflare.comserial: 2418557694refresh: 10000retry: 2400expire: 604800minttl: 1800
Registrar abuse contact VirusTotal WHOIS
Location describes the IP network.
TLS certificate
- Issuer
- Let's Encrypt / YE1
- Valid from
- 2026-10-26 22:52:50
- Valid until
- 2027-01-24 22:52:49
- Hostname coverage
- Stored certificate dates valid
- Validity
- Within stored validity dates
- Collection source
- PhishDestroy collector
Certificate fingerprint
56305d9c429eec2ada62e1248b7eefcaa033a7c15b76586716d48d04accbdf97Certificate names · 2 SANs
*.symbiosisfinance.netsymbiosisfinance.net
Saved certificate metadata. Certificate dates without a timezone are shown as stored. Transport encryption does not establish that the site is trustworthy.
Recorded subdomains1
Hostnames retained in the domain record or Certificate Transparency cache. A hostname alone does not establish current availability or malicious activity.
www.symbiosisfinance.netDomain record
Technologies · 3 identified
Cloudflare Browser Insights
Analytics RUM
Cloudflare
Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.
CDN
H
HTTP/3
Miscellaneous
Detected via Cloudflare Radar · Wappalyzer engine
Report This Domain Submit evidence & help protect others
Archived Evidence
Wayback Machine Snapshot
Site Performance Analysis
Google PageSpeed Insights — mobile performance audit of symbiosisfinance.net · checked Oct 27, 2026
34
Poor
Performance
FCP
22.58 s
First Contentful Paint
LCP
23.97 s
Largest Contentful Paint
CLS
0
Cumulative Layout Shift
TBT
946 ms
Total Blocking Time
SI
22.58 s
Speed Index
Powered by Google PageSpeed Insights · Mobile strategy · Scores: 90-100 Good 50-89 Needs Work 0-49 Poor
Stored Capture Evidence 1 snapshot
Timestamped response metadata retained by the local collection pipeline. Each value below belongs to the displayed archive time.
Archived HTTP response HTTP 200
Requested URL:
http://symbiosisfinance.net/Final URL:
https://symbiosisfinance.net/Symbiosis — Cross-Chain Bridge, Swap & Liquidity Protocol for Seamless DeFi
Symbiosis is a cross-chain liquidity protocol: swap and bridge Bitcoin, Solana, Tron, and 50+ networks at the best rates, with low fees and no KYC.
Response
HTTP 200
HTTP 200
HTML body
5.3 KB
5.3 KB
Compressed
1.4 KB
1.4 KB
Links
0 internal · 0 external
0 internal · 0 external
Detected technologies
cloudflare
Selected response headers
Content-Type: text/htmlServer: cloudflareCF-Cache-Status: DYNAMICContent-Encoding: gzip HSTS: not observed DNSSEC: not observed WAF / firewall: observed Cloaking flag: not observed
Open Graph title: Symbiosis — Cross-Chain Bridge, Swap & Liquidity Protocol for Seamless DeFi
Open Graph description: Symbiosis is a cross-chain liquidity protocol: swap and bridge Bitcoin, Solana, Tron, and 50+ networks at the best rates, with low fees and no KYC.
Twitter card:
summary_large_imageSaved response-header values · 13
- alt-svc
h3=":443"; ma=86400- cf-cache-status
DYNAMIC- CF-RAY
a513bbf8d87cd34e-FRA- Connection
keep-alive- Content-Encoding
gzip- Content-Type
text/html- Date
Tue, 27 Oct 2026 18:23:51 GMT- Last-Modified
Mon, 26 Oct 2026 23:41:03 GMT- Nel
{"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}- Report-To
{"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=cx44bWO9vHXIn9wnUwR400F4BbWac15J4nxP%2F5jBdbzjst5rNoWO8fpwujSjIRYRR1T%2BOfDM7e6GdGOdV1vKNu5gGdAAyYHNoTFTAxkkF8HAzxGzp1NdrNuPZYWSGPaanAonxDzGuQ%- Server
cloudflare- Transfer-Encoding
chunked- Vary
accept-encoding
Values retained by the collector; long values may be shortened during collection.
All retained availability observations4
Source: availability monitor. Every retained observation remains separate, including records with the same date or evidence hash but different sources or DNS states. An unknown state is not proof that the site is offline.
-
current_state_backfillunknown
- Observation source
- current_state_backfill
- Cause
- http_2xx_unclassified
- Availability state
- unknown
- Content state
- unknown
- DNS state
- resolved
- DNS response code
- NOERROR
- Recorded HTTP status
- 200
- Registration state
- unknown
- RDAP statuses
- []
- Recorded actor type
- unknown
- Monitor confidence
- 40
- Provider action verified
- false
- Registrar mechanism verified
- false
- Linked to a report
- false
- Original source timestamp
- 2026-10-27 19:28:06.000000
- Evidence SHA-256
- ce9a542665cf791e87377625ccd37e64435dccadb46fd21bd2aac1c304b0e299
- HTTP probe value as recorded
- 200
- Evidence timestamp as recorded
- 2026-10-27 19:28:06
- Evidence reason
-
http_observationunknown
- Observation source
- http_observation
- Cause
- http_2xx_unclassified
- Availability state
- unknown
- Content state
- unknown
- DNS state
- unknown
- Recorded HTTP status
- 200
- Registration state
- unknown
- RDAP statuses
- []
- Recorded actor type
- unknown
- Monitor confidence
- 40
- Provider action verified
- false
- Registrar mechanism verified
- false
- Linked to a report
- false
- Original source timestamp
- 2026-10-27 19:28:06.000000
- Evidence SHA-256
- ce9a542665cf791e87377625ccd37e64435dccadb46fd21bd2aac1c304b0e299
- HTTP probe value as recorded
- 200
- Evidence timestamp as recorded
- 2026-10-27 19:28:06
- Evidence reason
-
current_state_backfillunknown
- Observation source
- current_state_backfill
- Cause
- stale_current_evidence
- Availability state
- unknown
- Content state
- unknown
- DNS state
- resolved
- DNS response code
- NOERROR
- Registration state
- unknown
- RDAP statuses
- []
- Recorded actor type
- unknown
- Monitor confidence
- 0
- Provider action verified
- false
- Registrar mechanism verified
- false
- Linked to a report
- false
- Original source timestamp
- 2026-10-27 19:24:16.084650
- Evidence SHA-256
- 95dedd1e4016ea57e34bdbce51e0ec491a6e3d89d4fb09684d0437765fe8625c
- DNS evidence marked stale
- false
- HTTP evidence marked stale
- true
-
dns_observationunknown
- Observation source
- dns_observation
- Cause
- probe_inconclusive
- Availability state
- unreachable
- Content state
- unknown
- DNS state
- resolved
- DNS response code
- NOERROR
- Registration state
- unknown
- RDAP statuses
- []
- Recorded actor type
- unknown
- Monitor confidence
- 20
- Provider action verified
- false
- Registrar mechanism verified
- false
- Linked to a report
- false
- Original source timestamp
- 2026-10-26 21:55:25.115664
- Evidence SHA-256
- 33967275c5aca65ff8759ac33f7fc38457f8a476387a2c5fe76e3a7af6bc5b16
- HTTP probe value as recorded
- 0 · no HTTP response code recorded
- Evidence timestamp as recorded
- 2026-10-26 21:55:25.115664
- Evidence reason
Threat Response Pipeline
- Discovery · recorded
- Analysis · recorded
- Notifications · recorded
- Monitoring · in progress
Recorded events: 12. These records describe collected evidence, outgoing notifications and publication; they do not confirm a complete investigation or a takedown.
Pre-emptive Discovery & IngestionThreat Ingested Recorded: 1 of 1
- Threat Ingestedsymbiosisfinance.net detected and queued for full analysis
Threat Intelligence ChecksSpamhaus DBL · URLScan.io Capture · URLScan Verdict · Cloudflare Radar Report · Web Archive · Blocklist Detection · Brand Impersonation · Forensic Evidence Collected · Technical Analysis Recorded Recorded: 9 of 9
- Spamhaus DBLSpamhaus DBL recorded: phishing domain
- URLScan.io CaptureStored URLScan report with capture artifacts
- URLScan VerdictURLScan machine-learning engines classified the page as malicious · Score: 82
- Cloudflare Radar ReportA stored Cloudflare Radar report is available. The report link alone does not mean that the domain was classified as malicious, and it does not prove that every network field was captured.
- Web ArchivePreserved in the Wayback Machine: historical evidence archived
- Blocklist DetectionFound in blocklists: MetaMask, SEAL
- Brand ImpersonationAutomated brand label: 1inch
- Forensic Evidence CollectedStored evidence from URLScan.io, URLQuery, stored screenshot
- Technical Analysis RecordedThe report contains stored results of technology detection or forensic analysis.
Notification RecordsSent Report Recorded Recorded: 1 of 1
- Sent Report RecordedStored record of an abuse report about this domain; registrar at the time: TUCOWS.COM, CO.. Abuse contacts: 1.
- domainabuse@tucows.com
Publication & AvailabilityDestroyList Published · Monitoring Continues Recorded: 1 of 2
- DestroyList PublishedListed in the public repository PhishDestroy/DestroyList
- Monitoring ContinuesThe domain remains reachable or access-restricted; future checks may update this observation.
Recorded activity
5 entries- Abuse report sent
PD-20261027-676ECD · Receipt 83922
domainabuse@tucows.com - URLScan
Page captured
View source - VirusTotal
0/92 engine detections
View source - Wayback Machine
Page archived
View source - Added to PhishDestroy
symbiosisfinance.net
View source
How we investigate & report
Public scans, evidence and abuse channels
We scan suspicious URLs, inspect public results and send evidence through the appropriate abuse-reporting channels. The dated events above show what is recorded for this domain. The directory below explains the wider workflow.
01Public scans & evidence collection10 sources and tool groups
urlscan.io Screenshot · DOM · HTTP
Capture the rendered page, requests and visible infrastructure.
VirusTotal Multi-engine verdicts
Compare the available engine results and retain the analysis timestamp.
Google Safe Browsing Transparency Report
Check whether Google currently lists the URL as unsafe.
Cloudflare Radar DNS · certificates · categories
Inspect a public scan and its recorded network and classification data.
AlienVault OTX Threat-intelligence pulses
Look for indicator references and related community intelligence.
Wayback Machine Historical evidence
Compare archived captures and preserve historical context.
abuse.ch ThreatFox IOC correlation
Look for matching indicators and associated threat records.
crt.sh Certificate Transparency
Inspect certificate records and related hostnames.
DNS Security Filters Quad9 · AdGuard · CleanBrowsing
Compare security resolver responses and record observed blocking.
Web-Check Surface inspection
Inspect the public DNS, TLS, HTTP and technology surface.
02Abuse reports & follow-upRegistrar, hosting and security channels
- Identify the responsible provider. Match registration and hosting records to the relevant abuse contact.
- Prepare an evidence package. Include the URL, public scan references, captures and the recorded observations.
- Send the report. Keep outgoing report records and recipient information when available.
- Recheck and publish updates. Track later scanner verdicts, provider responses and site availability.
Security services used for scanning, reputation checks and reporting are listed below. A service being listed is not evidence that it received, accepted or acted on this particular domain. Recorded submissions appear in the notification history above.
GoogleSafe Browsing↗ GoogleWeb Risk↗ 
MicrosoftSmartScreen↗ 
VirusTotalURL analysis↗ 
CloudflareRadar / abuse reporting↗ 
YandexSafe Browsing↗ 
URLScan.ioPublic scan↗ 
ESETSample / URL submission↗ 
BitdefenderURL submission↗ 
NortonSafe Web↗ 
SymantecSiteReview↗ 
AviraURL reporting↗ 
Avast / AVGURL reporting↗ 
KasperskyOpenTIP↗ 
Dr.WebOnline scanner↗ 
NetcraftAbuse reporting↗ 
PhishTankCommunity reporting↗ 
APWG eCXPhishing intelligence↗ 
PhishStatsPublic feed↗ 
Phish.ReportHosting abuse↗ 
SpamhausDomain reputation↗ 
PolySwarmMulti-engine analysis↗ 
CheckPhishURL scan↗ 
QutteraMalware scan↗ 
URLqueryBrowser analysis↗ 
Criminal IPAsset intelligence↗ 
CRDFThreat Center↗ 
ScamadviserReputation check↗ 
MyWOTCommunity reputation↗ Related Infrastructure & Reports
-
Brand label: 1inch Supporting signal 8
-
Registrar: TUCOWS.COM, CO Discovery only 6
- Supporting signal — Shares infrastructure or a target brand; not proof of one operator.
- Discovery only — Same registrar or CDN edge: listed for navigation, not evidence of a link.
Each spoke is one reason a domain is linked to this report. Node size marks VirusTotal detections, dashed nodes are already offline, and the full lists follow below. Full list of related reports
Same automated brand label: 1inch 8
Reports with the same collector label. A shared label does not establish impersonation or common ownership. View matching reports →
Same registrar: TUCOWS.COM, CO 6
Registered through the same registrar. A registrar serves millions of unrelated customers, so this groups reports rather than proving a link.
Recent threat reports 6
Recently added threat reports.
Check for cloaking
Compare what a browser and a crawler receive, and check for Keitaro traffic routing.
symbiosisfinance.net Evidence & External Reports
Security Analysis
Submitted Evidence Snapshot
Sent: Ledger records: 1 Case ID:
PD-20261027-676ECD Recipient: domainabuse@tucows.com Blocklist hits included with submission: MetaMask, SEAL
PDF notice generated
OSINT & Intelligence
DNS & Network
SEO & Domain
Deep Analysis
Help & reporting
Were You Affected by This Site?
4 evidence signal groups linked 1 stored notification records Last known active
You are not alone and there is nothing to be ashamed of. Scammers are sophisticated criminals who exploit trust. Reporting your experience is the most powerful weapon against fraud — your report can prevent others from becoming victims and help law enforcement take action. Silence is the scammer’s greatest advantage. Break it.
If credentials were compromised, report immediately. Do not engage with recovery scammers.
If credentials, payment data, or files were exposed, report the incident immediately. Change affected passwords, revoke active sessions, and scan the device.
Official reporting routes
FBI IC3
Report online Report internet-enabled crime in the United States
IC3 does not accept attachments. Keep original evidence for investigators. IC3 guidance
Federal tips line1-800-CALL-FBI
Action Fraud
Report online Report fraud and cybercrime in England, Wales and Northern Ireland
Current service: Report Fraud. England, Wales and Northern Ireland. Scotland: 101.
Contact centre0300 123 2040
Chainabuse
Report a crypto wallet, transaction, or phishing URL
SEAL-ISAC
Security Alliance crypto threat intelligence
More official reporting routes
FTC ReportFraud United States
Report scams and fraud to the US Federal Trade Commission. Reports go into a database used by law enforcement.
CISA United States
Report cyber incidents and phishing to the US Cybersecurity and Infrastructure Security Agency.
NCSC United Kingdom
Forward scam emails and text messages to the National Cyber Security Centre, which takes down the malicious sites it finds.
Emailreport@phishing.gov.uk Text messages7726
CSIRTs Network European Union
Directory of national incident response teams (CSIRTs) in the EU. Find the team for your country.
APWG Worldwide
Forward phishing emails to the Anti-Phishing Working Group.
Emailreportphishing@apwg.org
cybercrime.gov.in India
National Cyber Crime Reporting Portal. For financial fraud, also call the 1930 helpline straight away.
Helpline1930
PhishDestroy listing review Not a law-enforcement report
Domain Appeal
Request a review if you own this domain and believe the listing is incorrect
Report to Your Local Authorities
Select your country to get official cybercrime contacts, or create a complaint draft →.
Even if funds were frozen, they cannot be recovered without an official police report or court order. Submitting a complaint is the only path to potential recovery.
Scammers are criminals. Filing a report creates a legal record and helps protect others.
97-country directory
Template-based draft • optional AI wording assistance requires separate consent
Review and submit it yourself
Recommendations & Advice for Victims
Choose the steps that match what you shared. Keep a copy of this report alongside your own records.
What should I do immediately?
Urgent
Stop using the suspicious site. Open the real service through its official app or an address you already trust.
- Change all passwords — email, exchange accounts, anything that shares the same password
- Enable 2FA using an authenticator app (not SMS). Disable SMS-based recovery
- Freeze cards if you entered banking details on the phishing site
What information should I collect for my report?
FBI guidelines
Keep original emails, receipts, messages and screenshots in a secure place. A factual timeline helps the receiving authority understand what happened. IC3 evidence guidance ↗
- Payment records — if you paid, save the receipt, amount, date, payment provider and recipient details.
- Exact dates & times — of each transaction and first contact with scammer
- Screenshots — scam website, chat messages, emails, wallet transactions, social media
- All URLs & domains used by the scammer (including
symbiosisfinance.net) - Communications — emails, texts, phone numbers, usernames the scammer used
Even if you don't have all details — file a report anyway. Partial information still helps investigations.
Where should I report the scam?
- FBI IC3 — Internet Crime Complaint Center (US federal reporting)
- Europol — European cybercrime reporting (EU)
- Your bank or payment provider — contact its fraud team promptly through official contact details if money or card information was exposed.
- Local police — creates an official record, even if they can't act immediately
A report is not a guarantee of recovery or investigation, but prompt, accurate transaction data can help authorities and service providers trace the incident.
How do phishing scams typically work?
- Fake websites — pixel-perfect clones of legitimate sites with slightly altered domains
- Pig butchering — trust built over weeks via Telegram/WhatsApp/dating apps, then money stolen
- Recovery scams — fraudsters pose as recovery agents and demand upfront fees. Never share a seed phrase or pay before independently verifying the provider
- AI-powered scams — deepfakes, automated phishing, and AI-generated sites making fraud harder to detect
How can I protect myself in the future?
- Bookmark official sites — never click links from emails, DMs, or ads
- Verify domains — check on PhishDestroy before interacting. Check HTTPS, spelling, domain age
- "Too good to be true" = scam — guaranteed returns, celebrity endorsements, urgent deadlines
Further guidance: NIST · phishing responseFBI IC3 · reports & evidenceFTC · recovery scams
Check Any Domain
Threat analysis using stored blocklist, WHOIS, DNS, and public scan evidence
Scan NowReport Phishing
Submit suspicious domains to our threat database — protect the community
ReportLive Threat Feed
Recent phishing reports and observed availability changes
MonitorStay Informed, Stay Safe
Monitor live threats or contest this listing if you believe it's a false positive
Beware of recovery scammers! Recovery scammers may pose as investigators, lawyers, or tracing services. Do not pay upfront fees or disclose credentials. Learn more about recovery fraud →
About this reportSources, observation dates and corrections
This report combines saved page captures, registration and network records, scanner results and PhishDestroy reporting history. Each source keeps its own observation date. Open a source report to inspect the original result.
The AI-assisted analysis was written on . It describes the evidence available at that time; later source checks can change.
A capture documents what was shown. A scanner result records that provider’s assessment at the time of its check. Neither a valid certificate nor a zero-detection result is a guarantee of safety.