# PhishDestroy domain threat record: themayerbrown.com Content language: English Canonical HTML report: https://phishdestroy.io/domain/themayerbrown.com/ Machine-readable companion: https://phishdestroy.io/domain/themayerbrown.com/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-10-26 07:30:08 UTC - Last availability or vendor check: 2026-10-26 07:31:34 UTC - Stored record updated: 2026-10-26 07:46:44 UTC - VirusTotal detections in the stored snapshot: 12/92 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: no stored flag ## Stored infrastructure - Observed IP address: 188.114.97.3 - Registrar in stored WHOIS data: TUCOWS.COM, CO. - Registrar country in stored WHOIS data: KN - Last stored HTTP status: 200 - Registration date in stored WHOIS data: 2026-09-01 04:56:27 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a1771e-1992-772b-a231-4487ef79e72c/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/themayerbrown.com - Certificate Transparency search: https://crt.sh/?q=%25.themayerbrown.com - Web Archive lookup: https://web.archive.org/web/*/https://themayerbrown.com/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview PhishDestroy has added themayerbrown.com to its internal blocklist as a suspicious domain. The recorded page title reads “Mayer Brown – Trade Forex and CFDs Using Our Award‑Winning Trading Platforms!”. PhishDestroy first saw the domain on 2026-10-26 and the HTTP response at that time was 200. How the scam works The site claims to offer a trading platform under the Mayer Brown name, a pattern commonly used in fake‑exchange or credential‑phishing schemes to lure users into entering login details or financial information. No malicious code or credential‑capture behavior was observed on the page itself, but the branding and offer match typical lures used to harvest credentials or convince victims to deposit funds. Evidence VirusTotal scanned the domain on 2026-10-25 and reported 12 detections out of 92 engines, with vendors such as alphaMountain.ai, CRDF, CyRadar, Forcepoint ThreatSeeker, Fortinet, Gridinsoft, LevelBlue and Lionic labeling it malicious or phishing. Google Safe Browsing checked on 2026-10-26 and did not flag the site. URLScan captured the page on 2026-10-14; its engine verdict gave a malicious score of 98 and tags for phishing, while the overall verdict was non‑malicious. Cloudflare Radar scanned on 2026-10-26 and returned a malicious phishing verdict. PhishDestroy’s internal blocklist marked the domain as malicious on 2026-10-26; external blocklists showed zero entries. OTX reported zero pulses on 2026-10-26. Infrastructure The domain was registered with Tucows Domains Inc. on 2026-09-01, making it 43 days old at the time of observation. It is hosted behind Cloudflare (network CloudFLARENET‑EU) with the recorded IPv4 address 188.114.97.1 and IPv6 address 2a06:98c1:3120::. The TLS certificate, issued by Google Trust Services, is valid from 2026-09-01 to 2026-11-30 and covers both themayerbrown.com and *.themayerbrown.com. Nameservers are grant.ns.cloudflare.com and penny.ns.cloudflare.com, and DNSSEC is not enabled. What to do Visitors should avoid entering any credentials, personal data, or financial information on the site; if they have already done so, they should change affected passwords and monitor accounts for unauthorized activity. Defenders should add the exact domain to web‑filter and DNS blocklists, review logs for connections to the recorded Cloudflare IPs, and consider blocking the domain at the firewall level. The multiple security detections justify heightened vigilance even though current site availability cannot be confirmed. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a13ae1-a431-7550-82b5-97eba698981e/ Cloudflare Radar report: https://radar.cloudflare.com/scan/d1ebcffc-1087-4728-be6b-ee1c70d2bc04 Stored capture screenshot: https://urlscan.io/screenshots/01a13ae1-a431-7550-82b5-97eba698981e.png Cloudflare Radar screenshot (2026-10-26T07:30:33Z): https://screenshots.phishdestroy.io/cf/d1ebcffc-1087-4728-be6b-ee1c70d2bc04.png URLScan screenshot (2026-09-02T08:45:39Z): https://screenshots.phishdestroy.io/us/01a0614b-6f60-76fc-b617-173e21823336.png URLScan capture report: https://urlscan.io/result/01a0614b-6f60-76fc-b617-173e21823336/ URLScan screenshot (2026-09-26T01:47:09Z): https://screenshots.phishdestroy.io/us/01a0db64-f388-7451-9bd7-8b09a62f9e63.png URLScan capture report: https://urlscan.io/result/01a0db64-f388-7451-9bd7-8b09a62f9e63/ URLScan screenshot (2026-10-09T11:13:23Z): https://screenshots.phishdestroy.io/us/01a1205e-010e-7559-837d-859457887802.png URLScan capture report: https://urlscan.io/result/01a1205e-010e-7559-837d-859457887802/ URLScan screenshot (2026-10-13T10:07:16Z): https://screenshots.phishdestroy.io/us/01a134ba-e696-7451-ae95-67fa4cd73ae2.png URLScan capture report: https://urlscan.io/result/01a134ba-e696-7451-ae95-67fa4cd73ae2/ URLScan screenshot (2026-10-26T07:30:36Z): https://screenshots.phishdestroy.io/us/01a1771e-1992-772b-a231-4487ef79e72c.png URLScan capture report: https://urlscan.io/result/01a1771e-1992-772b-a231-4487ef79e72c/ VirusTotal report: https://www.virustotal.com/gui/domain/themayerbrown.com Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=themayerbrown.com Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-26 07:31:34 UTC ## Stored page captures - Primary capture: https://i.ibb.co/V0Mh0MYZ/06938e732f8a.png Captured: 2026-10-26 07:31:34 UTC - URLScan · 2026-10-26: https://screenshots.phishdestroy.io/us/01a1771e-1992-772b-a231-4487ef79e72c.png Captured: 2026-10-26 07:30:36 UTC Source report: https://urlscan.io/result/01a1771e-1992-772b-a231-4487ef79e72c/ SHA-256: 4f30a1ac9ce1ae5c12d38df55e0739feb8f06ff5a326245b2b7371e16e1be9c4 - URLScan capture 2: https://urlscan.io/screenshots/01a13ae1-a431-7550-82b5-97eba698981e.png Captured: 2026-10-26 07:30:08 UTC Source report: https://urlscan.io/result/01a1771e-1992-772b-a231-4487ef79e72c/ - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/d1ebcffc-1087-4728-be6b-ee1c70d2bc04.png Captured: 2026-10-26 07:30:33 UTC Source report: https://radar.cloudflare.com/scan/d1ebcffc-1087-4728-be6b-ee1c70d2bc04 SHA-256: 5ceba1390d20630cb46fc5c0c2b6eaa202f2eb79c5d88f1a5b21f8b1d618e9a3 - URLScan · 2026-09-02: https://screenshots.phishdestroy.io/us/01a0614b-6f60-76fc-b617-173e21823336.png Captured: 2026-09-02 08:45:39 UTC Source report: https://urlscan.io/result/01a0614b-6f60-76fc-b617-173e21823336/ SHA-256: 3172243cf5db709f8f9c77242b65812e6c16abbe3abe9cc5ae6fa70ecc2c7d71 - URLScan · 2026-09-26: https://screenshots.phishdestroy.io/us/01a0db64-f388-7451-9bd7-8b09a62f9e63.png Captured: 2026-09-26 01:47:09 UTC Source report: https://urlscan.io/result/01a0db64-f388-7451-9bd7-8b09a62f9e63/ SHA-256: cb4e3d1f0e978b21519b42971a4d64f27a20251dea6f9fba5bc5af736679b4eb - URLScan · 2026-10-09: https://screenshots.phishdestroy.io/us/01a1205e-010e-7559-837d-859457887802.png Captured: 2026-10-09 11:13:23 UTC Source report: https://urlscan.io/result/01a1205e-010e-7559-837d-859457887802/ SHA-256: 14e1f05b2f68ac2eb1bccdc6ea3016cecf5e62240031dfb669ecafd4532e9b63 - URLScan · 2026-10-13: https://screenshots.phishdestroy.io/us/01a134ba-e696-7451-ae95-67fa4cd73ae2.png Captured: 2026-10-13 10:07:16 UTC Source report: https://urlscan.io/result/01a134ba-e696-7451-ae95-67fa4cd73ae2/ SHA-256: 9d69028d1bb2c8d4d5f489ad99e3da7dfa77b9b7d38742eba106fffcda10d95f ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-26T07:36:32Z", "uuid": "01a1771e-1992-772b-a231-4487ef79e72c", "scanned_at": "2026-10-26T07:30:36Z", "final_url": "https://themayerbrown.com/", "status": 200, "redirected": "https-only", "redirects": [ { "to": "https://themayerbrown.com/", "from": "http://themayerbrown.com/", "status": 307 }, { "to": "http://themayerbrown.com/", "from": "https://themayerbrown.com/", "status": 307 }, { "to": "https://themayerbrown.com/", "from": "http://themayerbrown.com/", "status": 301 } ], "ip": "188.114.97.3", "domains": [ "fonts.gstatic.com", "fonts.googleapis.com", "cdnjs.cloudflare.com" ], "ips": [ "142.251.13.94", "104.17.24.14", "142.250.154.95", "188.114.97.3" ], "asns": [ "15169", "13335" ], "countries": [ "US" ], "doc_hash": "fb5f5355d7b9ffd599221c51364778b872e1498f02db6f6707b67751b941b618", "script_hashes": [ "20be9b3c63a01d921697a0ef1c1596f647678498eefe6dc508e2363be25277f8", "61ab0334f42f85686d5c13c1df97cc4dc31e2b9c7e78965f8cdfbab2aeaae512", "9820a6f9367b76eae4bd0ebf6066d729a8ad898b5c48f344a6a37e79c66b6b61", "2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8", "cb6f2d32c49d1c2b25e9ffc9aaafa3f83075346c01bcd4ae6eb187392a4292cf", "b0a45cd5aed66e27bd8ee861d0e3b782c8e79849bde32f90f078b9f2451a36f2", "51ceedb9f4e474019dfe680224da89dbfc54477c2168d62c3eef1bb14079d04c", "3b0e963107a1f4428d7140d30b9f1290e89de3e177216624e65d5cfe9da3694a", "063840b4b3f5869e0f0d078bab8bd29cfb3a59ee85e8e3edbbec35a8fe846fd3" ], "globals": [ "wpml_cookies", "_tpt", "SR7", "SmoothScroll", "$us", "gsapVersions", "tpGS", "punchgs", "jQuery", "pow", "_document", "_navigator", "_window", "$ush", "EvEmitter", "imagesLoaded", "USAnimate", "usGmapLoaded", "USHeader", "srCarousel", "WP_Statistics_Tracker_Object", "handleWpConsentApiIntegration", "handleRealCookieBannerIntegration", "WpStatisticsUserTracker", "WpStatisticsEventTracker", "_wpemojiSettings", "wp_statistics_event", "revapi1", "gM", "twemoji", "wp" ], "cookies": [ "wp-wpml_current_language" ], "storage_keys": [ "wpEmojiSettingsSupports" ], "tls": { "san": [ "themayerbrown.com", "*.themayerbrown.com" ], "cipher": "AES_128_GCM", "issuer": "WE1", "subject": "themayerbrown.com", "protocol": "TLS 1.3", "valid_to": "2026-11-30T06:59:45Z", "valid_from": "2026-09-01T06:02:06Z" }, "domain_age_days": 55, "apex_age_days": 55, "tls_age_days": 55, "tls_valid_days": 90, "requests": 70, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 95, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "cloudflare", "content-type": "text/html; charset=UTF-8" } }, "cf": { "v": 1, "fetched_at": "2026-10-26T07:30:47Z", "uuid": "d1ebcffc-1087-4728-be6b-ee1c70d2bc04", "scanned_at": "2026-10-26T07:30:33Z", "final_url": "https://themayerbrown.com/", "status": 403, "history": [ { "url": "https://themayerbrown.com/", "status": 403 } ], "dom_hash": "11a3897f82dd5c71e053fdd08f745dfed630a911694965172c89e6f17585f6c3", "doc_hash": "06b1b68789f08ddb44aa44ff28565cf3a0eaf4194d200b33c974b76e274d427c", "domain_risks": [ "Phishing", "Security threats", "CIPA Filter", "CIPA" ], "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "themayerbrown.com", "type": "A", "value": "188.114.97.0" }, { "name": "themayerbrown.com", "type": "A", "value": "188.114.96.0" }, { "name": "themayerbrown.com", "type": "AAAA", "value": "2a06:98c1:3121::" }, { "name": "themayerbrown.com", "type": "AAAA", "value": "2a06:98c1:3120::" } ], "dnssec_valid": false, "ip": "188.114.97.0", "verdict": { "tags": [ "phishing" ], "malicious": true, "categories": [ "phishing" ] }, "whois": { "registrar": "Tucows Domains Inc.", "created": "2026-09-01T06:56:27Z", "updated": "2026-09-01T06:58:34Z", "expires": "2027-09-01T06:56:27Z", "nameservers": [ "grant.ns.cloudflare.com", "penny.ns.cloudflare.com" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-26T07:30:22Z", "analysis_at": "2026-10-25T08:31:46Z", "stats": { "timeout": 0, "harmless": 45, "malicious": 10, "suspicious": 2, "undetected": 35 }, "detections": { "CRDF": "malicious", "Lionic": "phishing", "Sophos": "phishing", "CyRadar": "phishing", "Fortinet": "spam", "SOCRadar": "malware", "LevelBlue": "phishing", "Seclookup": "malicious", "Gridinsoft": "suspicious", "desenmascara.me": "malicious", "alphaMountain.ai": "phishing", "Forcepoint ThreatSeeker": "phishing" }, "reputation": 0, "registrar": "Tucows Domains Inc.", "created": "2026-09-01T06:56:27Z", "expires": "2027-09-01T06:56:27Z", "updated": "2026-09-01T06:58:34Z", "first_seen": "2026-09-01T08:15:42Z", "dns": [ { "ttl": 21600, "type": "NS", "value": "grant.ns.cloudflare.com" }, { "ttl": 1800, "type": "SOA", "rname": "dns.cloudflare.com", "value": "grant.ns.cloudflare.com" }, { "ttl": 3600, "type": "MX", "value": "alt4.aspmx.l.google.com", "priority": 10 }, { "ttl": 300, "type": "A", "value": "104.21.85.204" }, { "ttl": 300, "type": "TXT", "value": "google-site-verification=zQDIq9CRH0DnLb_cnWw6zNDuvUgoFto7wailQSdm7FI" }, { "ttl": 300, "type": "AAAA", "value": "2606:4700:3033::6815:55cc" }, { "ttl": 3600, "type": "MX", "value": "alt2.aspmx.l.google.com", "priority": 5 }, { "ttl": 300, "type": "A", "value": "172.67.210.56" }, { "ttl": 300, "type": "AAAA", "value": "2606:4700:3031::ac43:d238" }, { "ttl": 3600, "type": "MX", "value": "aspmx.l.google.com", "priority": 1 }, { "ttl": 21600, "type": "NS", "value": "penny.ns.cloudflare.com" }, { "ttl": 300, "type": "TXT", "value": "v=spf1 include:_spf.google.com ~all" }, { "ttl": 3600, "type": "MX", "value": "alt1.aspmx.l.google.com", "priority": 5 }, { "ttl": 3600, "type": "MX", "value": "alt3.aspmx.l.google.com", "priority": 10 } ], "dns_at": "2026-10-25T08:37:21Z", "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c", "cert": { "san": [ "themayerbrown.com", "*.themayerbrown.com" ], "issuer": "Google Trust Services / WE1", "serial": "412069f7abe2872013b93633282c22b4", "sha256": "08ab96df4de0c33d83b573db04f9bacfbd80a95f3a22904ac22d812eae9a2ffa", "subject": "themayerbrown.com", "valid_to": "2026-11-30T06:59:45Z", "valid_from": "2026-09-01T06:02:06Z" }, "whois": { "registrar": "Tucows Domains Inc.", "registrar_iana_id": "69", "registrar_url": "http://www.tucows.com", "created": "2026-09-01T06:56:27Z", "updated": "2026-09-01T06:58:34Z", "expires": "2027-09-01T06:56:27Z", "status": [ "clientTransferProhibited", "clientUpdateProhibited" ], "nameservers": [ "grant.ns.cloudflare.com", "penny.ns.cloudflare.com" ], "dnssec": "unsigned" }, "rdap": { "status": [ "client transfer prohibited", "client update prohibited" ], "events": { "last changed": "2026-09-01T07:02:44Z", "registration": "2026-09-01T06:56:27Z", "registrar expiration": "2027-09-01T06:56:27Z", "last update of RDAP database": "2026-09-01T07:02:44Z" } } }, "webcheck": { "v": 1, "fetched_at": "2026-10-26T07:31:03Z", "mail_config": { "mx": [ "alt4.aspmx.l.google.com", "alt1.aspmx.l.google.com", "alt2.aspmx.l.google.com", "aspmx.l.google.com", "alt3.aspmx.l.google.com" ], "spf": "v=spf1 include:_spf.google.com ~all", "dkim": [ "google" ], "dmarc": true, "dkim_bits": 1024, "providers": [ "Google Workspace" ], "spf_lookups": 1 }, "caa_records": { "domain": "themayerbrown.com" }, "block_lists": { "resolvers": 12, "blocked_by": [ "CloudFlare Family" ], "blocked_count": 1 }, "robots_txt": { "agents": [ "*" ], "present": true }, "social_tags": { "ogUrl": "https://themayerbrown.com/", "title": "Mayer Brown – Trade Forex and CFDs Using Our Award-Winning Trading Platforms!", "ogType": "website", "robots": "noindex, nofollow", "ogImage": "https://themayerbrown.com/wp-content/uploads/2024/08/slider-1-1024x575.jpg", "ogTitle": "Mayer Brown – Trade Forex and CFDs Using Our Award-Winning Trading Platforms!", "generator": "WordPress 7.1", "ogSiteName": "Mayer Brown", "themeColor": "#f2f4f7", "canonicalUrl": "https://themayerbrown.com/" }, "trackers": { "requests": 49, "trackers": [ { "name": "Cloudflare", "company": "Cloudflare", "country": "US", "category": "Hosting", "requests": 1 }, { "name": "Google Fonts", "company": "Google", "country": "US", "category": "Hosting", "requests": 2 }, { "name": "Google Static", "company": "Google", "country": "US", "category": "Hosting", "requests": 2 } ] }, "mixed_content": { "third_party_scripts": 1 }, "status": { "up": true, "code": 200, "timings": { "dns": 1, "tls": 16, "wait": 2310, "connect": 7, "download": 12 }, "response_ms": 2346 }, "tls_connection": { "alpn": "h2", "cipher": "TLS_AES_256_GCM_SHA384", "protocol": "TLSv1.3", "versions": [ "TLSv1", "TLSv1.1", "TLSv1.2", "TLSv1.3" ], "authorized": true, "forward_secrecy": true }, "ports": { "open": [ 80, 443, 8080 ] }, "carbon": { "bytes": 195381, "co2_grams": 0.0071, "cleaner_than": 7 }, "dns_server": { "ns": [ { "ip": "108.162.195.130", "host": "grant.ns.cloudflare.com" }, { "ip": "172.64.34.124", "host": "penny.ns.cloudflare.com" } ], "zone": "themayerbrown.com" }, "cookies": { "cookies": [ { "name": "wp-wpml_current_language", "session": true } ] }, "location": { "ip": "2a06:98c1:3121::3", "asn": "13335", "org": "CloudFLARENET-EU", "city": "London", "country": "GB" }, "ssl": { "issuer": "Google Trust Services / WE1", "subject": "themayerbrown.com" }, "dns": { "A": [ "188.114.96.3", "188.114.97.3" ], "MX": [ "{\"exchange\": \"alt1.aspmx.l.google.com\", \"priority\": 5}", "{\"exchange\": \"alt3.aspmx.l.google.com\", \"priority\": 10}", "{\"exchange\": \"alt2.aspmx.l.google.com\", \"priority\": 5}", "{\"exchange\": \"alt4.aspmx.l.google.com\", \"priority\": 10}", "{\"exchange\": \"aspmx.l.google.com\", \"priority\": 1}" ], "NS": [ "grant.ns.cloudflare.com", "penny.ns.cloudflare.com" ], "SOA": "{\"nsname\": \"grant.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2414451130, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}", "TXT": [ "v=spf1 include:_spf.google.com ~all", "google-site-verification=zQDIq9CRH0DnLb_cnWw6zNDuvUgoFto7wailQSdm7FI" ], "AAAA": [ "2a06:98c1:3120::3", "2a06:98c1:3121::3" ] }, "dnssec": { "ds": false, "rrsig": false, "dnskey": false }, "hsts": { "message": "Site does not serve any HSTS headers." }, "http_security": { "xFrameOptions": false, "referrerPolicy": false, "xXSSProtection": false, "permissionsPolicy": false, "xContentTypeOptions": false, "contentSecurityPolicy": false, "strictTransportPolicy": false, "crossOriginOpenerPolicy": false, "crossOriginEmbedderPolicy": false, "crossOriginResourcePolicy": false }, "firewall": { "waf": "Cloudflare", "has_waf": true }, "get_ip": { "ip": "2a06:98c1:3120::3", "family": 6 }, "redirects": { "chain": [ "https://themayerbrown.com" ] }, "linked_pages": { "internal_count": 22 }, "whois": { "registrar": "Tucows Domains Inc.", "created": "2026-09-01T06:56:27Z", "updated": "2026-09-01T06:58:34Z", "expires": "2027-09-01T06:56:27Z", "status": [ "clientTransferProhibited https://icann.org/epp", "clientUpdateProhibited https://icann.org/epp" ], "nameservers": [ "grant.ns.cloudflare.com", "penny.ns.cloudflare.com" ] }, "headers": { "headers": { "server": "cloudflare", "content-type": "text/html; charset=UTF-8" } } } } ```