# PhishDestroy domain threat record: tradesphantom.com Content language: English Canonical HTML report: https://phishdestroy.io/domain/tradesphantom.com/ Machine-readable companion: https://phishdestroy.io/domain/tradesphantom.com/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-10-23 06:19:52 UTC - Last availability or vendor check: 2026-10-23 06:19:52 UTC - Stored record updated: 2026-10-23 08:00:07 UTC - VirusTotal detections in the stored snapshot: 0/92 - Independent public blocklist matches in the stored snapshot: 1 - Matching public blocklists: ScamSniffer - Google Safe Browsing stored result: no stored flag ## Stored classification - Targeted brand: Phantom ## Stored infrastructure - Observed IP address: 188.114.96.3 - Registrar in stored WHOIS data: NICENIC INTERNATIONAL GROUP CO., LIMITED - Last stored HTTP status: 200 - Registration date (registry RDAP, tradesphantom.com): 2026-10-15 08:44:21 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a16769-0b96-70fa-812e-38f0366765ae/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/tradesphantom.com - Certificate Transparency search: https://crt.sh/?q=%25.tradesphantom.com - Web Archive lookup: https://web.archive.org/web/*/https://tradesphantom.com/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview PhishDestroy’s automated assessment classified tradesphantom.com as a crypto wallet drainer because the recorded page displayed a trading‑style interface containing “Log in” and “Buy Sell” elements. The page title was recorded as “UP”. The domain was first seen by PhishDestroy on 2026-10-23, eight days after its registration, and returned an HTTP 200 response at that time. How the scam works A crypto wallet drainer typically mimics a legitimate exchange or investment portal and asks victims to connect a cryptocurrency wallet and approve transactions. Once permission is granted, the attacker can move funds from the connected wallet without further user interaction. Evidence VirusTotal scanned the domain on 2026-10-23 (analysis date 2026-10-17) with 92 engines and reported zero malicious or suspicious detections. Google Safe Browsing checked the same day and did not flag the site. The external blocklist ScamSniffer listed the domain and PhishDestroy’s internal blocklist also contains it, both checked on 2026-10-23. urlscan.io captured the page on 2026-10-23; its machine‑learning engines marked it malicious with a score of 82, while the overall verdict was non‑malicious. OTX recorded three pulses referencing the domain as of 2026-10-23. Infrastructure The domain was registered with NICENIC INTERNATIONAL GROUP CO., LIMITED on 2026-10-15. At the time of observation the DNS returned A records 188.114.96.3 and 188.114.97.3, which belong to CloudFlare, Inc. and were recorded as located in Canada. The TLS certificate issued by Let’s Encrypt on 2026-10-15 covered *.tradesphantom.com and tradesphantom.com and was valid until 2027-01-13. What to do Do not enter credentials or connect a cryptocurrency wallet to this site; if a wallet was already linked, revoke all approvals and consider moving funds to a new secure wallet. Users who may have submitted login details should change passwords on the affected services immediately. Defenders should block traffic to tradesphantom.com, monitor access logs for wallet‑connection attempts, and add the domain to relevant threat‑intel feeds. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a16769-0b96-70fa-812e-38f0366765ae/ Cloudflare Radar report: https://radar.cloudflare.com/scan/07a3e191-42da-492b-bcd5-28d11c0086c8 Stored capture screenshot: https://i.ibb.co/V0HfTSVn/259c98899387.png Cloudflare Radar screenshot (2026-10-23T06:53:16Z): https://screenshots.phishdestroy.io/cf/07a3e191-42da-492b-bcd5-28d11c0086c8.png VirusTotal report: https://www.virustotal.com/gui/domain/tradesphantom.com Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=tradesphantom.com Revoke token approvals: https://revoke.cash/ Report crypto fraud (Chainabuse): https://www.chainabuse.com/report Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-23 06:54:32 UTC ## Stored page captures - Primary capture: https://i.ibb.co/V0HfTSVn/259c98899387.png Captured: 2026-10-23 06:19:52 UTC - URLScan capture: https://urlscan.io/screenshots/01a16769-0b96-70fa-812e-38f0366765ae.png Captured: 2026-10-23 06:19:52 UTC Source report: https://urlscan.io/result/01a16769-0b96-70fa-812e-38f0366765ae/ - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/07a3e191-42da-492b-bcd5-28d11c0086c8.png Captured: 2026-10-23 06:53:16 UTC Source report: https://radar.cloudflare.com/scan/07a3e191-42da-492b-bcd5-28d11c0086c8 SHA-256: 9d66d9fe89d6f6f12f0dc4d79cc86f26f02b8454e67b0afc958b58562a42fce9 ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-23T06:53:35Z", "uuid": "01a16769-0b96-70fa-812e-38f0366765ae", "scanned_at": "2026-10-23T06:18:36Z", "final_url": "https://tradesphantom.com/", "status": 200, "redirected": "https-only", "redirects": [ { "to": "https://tradesphantom.com/", "from": "http://tradesphantom.com/", "status": 307 } ], "ip": "188.114.97.3", "domains": [ "cdn.dexscreener.com", "api.dexscreener.com", "fonts.gstatic.com", "fonts.googleapis.com" ], "ips": [ "142.251.127.94", "172.64.149.113", "142.251.13.95", "188.114.97.3" ], "asns": [ "15169", "13335" ], "countries": [ "US" ], "link_domains": [ "trade.phantom.com" ], "doc_hash": "d7ab8a4e35bb7f0f42c98f7087940594c030c0f389888d67a792b7c3582886d7", "script_hashes": [ "88c3a74f5a902c81018d652f2cfd907e19a4df6e88acfcde29cf0c873890ec56" ], "globals": [ "__kiwiProCloseBound", "__kiwiJupiterDiscoveryReady", "__kiwiWalletStandardRegistry", "kiwiPro", "buildModalOpen", "closeBuild", "ensureBuildContainer", "openBuild", "fmtNum", "fmtNumBare", "fmtPrice", "fmtPct", "shortAddr", "ageStr", "isAddr", "findAddr", "hueFrom", "showPlaceholder", "hidePlaceholder", "updateLink", "bestPair", "loadToken", "renderToken", "setFlag", "renderChart", "loadSidebar", "renderSidebar", "markActive", "priceStr", "renderPerps", "sideEmpty", "showSideTab", "chatTemplates", "buildChat", "addMsg", "agoStr", "tradeFish", "fmtSol", "loadTrades", "renderTrades" ], "cookies": [ "__cf_bm" ], "tls": { "san": [ "*.tradesphantom.com", "tradesphantom.com" ], "cipher": "AES_128_GCM", "issuer": "YE2", "subject": "tradesphantom.com", "protocol": "QUIC", "valid_to": "2027-01-13T08:07:10Z", "valid_from": "2026-10-15T08:07:11Z" }, "domain_age_days": 876, "apex_age_days": 876, "tls_age_days": 7, "tls_valid_days": 89, "requests": 26, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 82, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "cloudflare", "content-type": "text/html", "strict-transport-security": "max-age=63072000; includeSubDomains; preload", "content-security-policy": "frame-ancestors http: https:", "x-content-type-options": "nosniff" } }, "cf": { "v": 1, "fetched_at": "2026-10-23T06:53:36Z", "uuid": "07a3e191-42da-492b-bcd5-28d11c0086c8", "scanned_at": "2026-10-23T06:53:16Z", "final_url": "https://tradesphantom.com/", "status": 200, "history": [ { "url": "https://tradesphantom.com/", "status": 200 } ], "dom_hash": "650d1f651d93ed1250e6002c4f3efedf4a82a675a145524928f5c12f618a4de5", "doc_hash": "393c4da30cd54ee7cd5e75c8c7dc41173309836323f4cb27fd9cbf12fbfb1fa3", "phishing_v2": [ "phishing" ], "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "tradesphantom.com", "type": "A", "value": "188.114.97.0" }, { "name": "tradesphantom.com", "type": "A", "value": "188.114.96.0" }, { "name": "tradesphantom.com", "type": "AAAA", "value": "2a06:98c1:3121::" }, { "name": "tradesphantom.com", "type": "AAAA", "value": "2a06:98c1:3120::" } ], "dnssec_valid": false, "ip": "188.114.97.0", "whois": { "registrar": "NICENIC INTERNATIONAL GROUP CO., LIMITED", "created": "2026-10-15T08:44:21Z", "updated": "2026-10-15T08:44:55Z", "expires": "2027-10-15T08:44:21Z", "nameservers": [ "ara.ns.cloudflare.com", "christian.ns.cloudflare.com" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-23T06:53:07Z", "analysis_at": "2026-10-17T10:55:05Z", "stats": { "timeout": 0, "harmless": 55, "malicious": 0, "suspicious": 0, "undetected": 37 }, "reputation": 0, "registrar": "NICENIC INTERNATIONAL GROUP CO., LIMITED", "created": "2026-10-15T08:44:21Z", "expires": "2027-10-15T08:44:21Z", "updated": "2026-10-15T08:44:55Z", "first_seen": "2024-05-29T11:46:04Z", "dns": [ { "ttl": 21600, "type": "NS", "value": "ara.ns.cloudflare.com" }, { "ttl": 300, "type": "A", "value": "104.21.23.228" }, { "ttl": 300, "type": "A", "value": "172.67.214.30" }, { "ttl": 21600, "type": "NS", "value": "christian.ns.cloudflare.com" }, { "ttl": 300, "type": "AAAA", "value": "2606:4700:3035::6815:17e4" }, { "ttl": 1800, "type": "SOA", "rname": "dns.cloudflare.com", "value": "ara.ns.cloudflare.com" }, { "ttl": 300, "type": "AAAA", "value": "2606:4700:3031::ac43:d61e" } ], "dns_at": "2026-10-17T11:00:50Z", "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c", "cert": { "san": [ "*.tradesphantom.com", "tradesphantom.com" ], "issuer": "Let's Encrypt / YE2", "serial": "6277e92374b564d4030790635a7486cfad4", "sha256": "6aadbee3bbcb874aeae53138fd828f18019c6db7db06781c2d6228029576aca9", "subject": "tradesphantom.com", "valid_to": "2027-01-13T08:07:10Z", "valid_from": "2026-10-15T08:07:11Z" }, "whois": { "registrar": "NICENIC INTERNATIONAL GROUP CO., LIMITED", "registrar_iana_id": "3765", "registrar_url": "https://nicenic.com", "created": "2026-10-15T08:44:21Z", "updated": "2026-10-15T08:44:21Z", "expires": "2027-10-15T08:44:21Z", "status": [ "clientDeleteProhibited", "clientTransferProhibited" ], "nameservers": [ "ara.ns.cloudflare.com", "christian.ns.cloudflare.com" ], "dnssec": "unsigned" }, "rdap": { "status": [ "client delete prohibited", "client transfer prohibited" ], "events": { "expiration": "2027-10-15T08:44:21Z", "registration": "2026-10-15T08:44:21Z", "registrar expiration": "2027-10-15T08:44:21Z", "last update of RDAP database": "2026-10-15T08:44:21Z" } } }, "webcheck": { "v": 1, "fetched_at": "2026-10-23T06:53:49Z", "mail_config": { "spf_lookups": 0 }, "caa_records": { "domain": "tradesphantom.com" }, "block_lists": { "resolvers": 12, "blocked_count": 0 }, "archives": { "last": "2026-10-23T06:21:19Z", "first": "2024-05-29T12:03:16Z", "changes": 9, "days_archived": 14, "scans_per_day": 0.01, "avg_page_bytes": 6781 }, "social_tags": { "title": "UP" }, "trackers": { "requests": 8, "trackers": [ { "name": "Google Fonts", "company": "Google", "country": "US", "category": "Hosting", "requests": 1 }, { "name": "Google Static", "company": "Google", "country": "US", "category": "Hosting", "requests": 2 } ] }, "mixed_content": { "third_party_scripts": 0 }, "status": { "up": true, "code": 200, "timings": { "dns": 109, "tls": 125, "wait": 135, "connect": 6, "download": 1 }, "response_ms": 376 }, "tls_connection": { "alpn": "h2", "cipher": "TLS_AES_256_GCM_SHA384", "protocol": "TLSv1.3", "versions": [ "TLSv1", "TLSv1.1", "TLSv1.2", "TLSv1.3" ], "authorized": true, "forward_secrecy": true }, "ports": { "open": [ 80, 443, 8080 ] }, "carbon": { "bytes": 69361, "co2_grams": 0.0025, "cleaner_than": 30 }, "dns_server": { "ns": [ { "ip": "173.245.58.67", "host": "ara.ns.cloudflare.com" }, { "ip": "162.159.44.247", "host": "christian.ns.cloudflare.com" } ], "zone": "tradesphantom.com" }, "cookies": { "cookies": [ { "name": "__cf_bm", "secure": true, "http_only": true, "same_site": "None" } ] }, "location": { "ip": "2a06:98c1:3120::3", "asn": "13335", "org": "CloudFLARENET-EU", "city": "London", "country": "GB" }, "ssl": { "issuer": "Let's Encrypt / YE2", "subject": "tradesphantom.com" }, "dns": { "A": [ "188.114.97.3", "188.114.96.3" ], "NS": [ "ara.ns.cloudflare.com", "christian.ns.cloudflare.com" ], "SOA": "{\"nsname\": \"ara.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2417586606, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}", "AAAA": [ "2a06:98c1:3121::3", "2a06:98c1:3120::3" ] }, "dnssec": { "ds": false, "rrsig": false, "dnskey": false }, "hsts": { "header": "max-age=63072000; includeSubDomains; preload", "message": "Site is compatible with the HSTS preload list!", "compatible": true }, "http_security": { "xFrameOptions": false, "referrerPolicy": false, "xXSSProtection": "1; mode=block", "permissionsPolicy": false, "xContentTypeOptions": "nosniff", "contentSecurityPolicy": "frame-ancestors http: https:", "strictTransportPolicy": "max-age=63072000; includeSubDomains; preload", "crossOriginOpenerPolicy": false, "crossOriginEmbedderPolicy": false, "crossOriginResourcePolicy": false }, "firewall": { "waf": "Cloudflare", "has_waf": true }, "get_ip": { "ip": "2a06:98c1:3120::3", "family": 6 }, "redirects": { "chain": [ "https://tradesphantom.com" ] }, "linked_pages": { "external": [ "https://trade.phantom.com/", "https://trade.phantom.com/track", "https://trade.phantom.com/perps/BTC", "https://trade.phantom.com/portfolio" ], "external_count": 4, "internal_count": 1 }, "whois": { "registrar": "NICENIC INTERNATIONAL GROUP CO., LIMITED", "created": "2026-10-15T08:44:21Z", "updated": "2026-10-15T08:44:55Z", "expires": "2027-10-15T08:44:21Z", "status": [ "clientDeleteProhibited https://icann.org/epp", "clientTransferProhibited https://icann.org/epp" ], "nameservers": [ "ara.ns.cloudflare.com", "christian.ns.cloudflare.com" ] }, "headers": { "headers": { "server": "cloudflare", "content-type": "text/html", "strict-transport-security": "max-age=63072000; includeSubDomains; preload", "content-security-policy": "frame-ancestors http: https:", "x-content-type-options": "nosniff" } } } } ```