# PhishDestroy domain threat record: trustvaullltx.com Content language: English Canonical HTML report: https://phishdestroy.io/domain/trustvaullltx.com/ Machine-readable companion: https://phishdestroy.io/domain/trustvaullltx.com/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: unknown - First observed by PhishDestroy: 2026-10-26 16:20:42 UTC - Stored record updated: 2026-10-26 19:35:24 UTC - VirusTotal detections in the stored snapshot: 12/92 - Independent public blocklist matches in the stored snapshot: 2 - Matching public blocklists: MetaMask, SEAL - Google Safe Browsing stored result: no stored flag ## Stored infrastructure - Observed IP address: 195.179.239.104 - Registrar in stored WHOIS data: Dynadot Inc - Last stored HTTP status: 200 - Registration date in stored WHOIS data: 2025-11-05 02:09:49 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a16553-55a8-76ba-953d-b98bcd5a4eee/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/trustvaullltx.com - Certificate Transparency search: https://crt.sh/?q=%25.trustvaullltx.com - Web Archive lookup: https://web.archive.org/web/*/https://trustvaullltx.com/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview PhishDestroy listed trustvaullltx.com as a suspicious domain based on several security detections. The site displayed a page titled “Trust Vaulltx” that claims to be a UK‑based investment and trading company. The domain was first seen by PhishDestroy on 2026-10-26 and returned HTTP 200 at that time. Google Safe Browsing did not flag the URL and no external blocklists reported it as malicious on the same date. How the scam works The detections label the site as a phishing page, a common technique where attackers mimic financial services to collect login credentials or personal data. No specific credential‑stealing form or wallet‑draining behavior was observed in the captured page. The risk is therefore inferred from the generic phishing classification rather than concrete evidence of a particular scheme. Evidence VirusTotal scanned the domain on 2026-10-26 and reported 12 detections across 92 engines – 11 malicious and 1 suspicious. urlscan captured the site on 2026-10-22 and returned a malicious phishing verdict with a score of 100. Google Safe Browsing checked on 2026-10-26 and reported no flag. PhishDestroy’s internal blocklist marked the domain as malicious on 2026-10-26. OTX listed two pulses referencing the domain as of 2026-10-26. External blocklist checks on that date returned zero hits. Infrastructure The domain was registered with Dynadot Inc on 2025-11-05, giving it an age of 351 days at the time of observation. The recorded DNS records showed an A record pointing to 195.179.239.104 and an AAAA record to 2a02:4780:1:1166:0:25e9:923a:2, with the authoritative nameservers ns1.dns-parking.com and ns2.dns-parking.com. The TLS certificate, issued by Google Trust Services (WR1), was valid from 2026-08-31 to 2026-11-29. The web server identified itself as LiteSpeed and responded with HTTP 200; open ports observed in the scan included 21, 80, 443, and 3306. What to do Visitors should avoid entering any credentials, personal information, or financial details on the site and, if they have already done so, change associated passwords and monitor accounts for unauthorized activity. Security teams should block the exact domain and add it to internal phishing blocklists, then review logs for any connections to the recorded infrastructure. No wallet‑related actions are required because wallet recommendations are disabled for this domain. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a16553-55a8-76ba-953d-b98bcd5a4eee/ Cloudflare Radar report: https://radar.cloudflare.com/scan/b8f8891d-7d9b-4d13-bd83-ac3dc1378a18 Stored capture screenshot: https://urlscan.io/screenshots/01a16553-55a8-76ba-953d-b98bcd5a4eee.png Cloudflare Radar screenshot (2026-10-26T16:29:50Z): https://screenshots.phishdestroy.io/cf/b8f8891d-7d9b-4d13-bd83-ac3dc1378a18.png VirusTotal report: https://www.virustotal.com/gui/domain/trustvaullltx.com Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=trustvaullltx.com Archived copy: https://web.archive.org/web/20261026163143/https://trustvaullltx.com/ Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-26 17:32:22 UTC ## Stored page captures - Primary capture: https://urlscan.io/screenshots/01a16553-55a8-76ba-953d-b98bcd5a4eee.png Captured: 2026-10-26 16:20:42 UTC - URLScan capture: https://screenshots.phishdestroy.io/01a16553-55a8-76ba-953d-b98bcd5a4eee.png Source report: https://urlscan.io/result/01a16553-55a8-76ba-953d-b98bcd5a4eee/ - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/b8f8891d-7d9b-4d13-bd83-ac3dc1378a18.png Captured: 2026-10-26 16:29:50 UTC Source report: https://radar.cloudflare.com/scan/b8f8891d-7d9b-4d13-bd83-ac3dc1378a18 SHA-256: 8ffb195ddd5b32937f07272cb2c474968e29183a8b54af3a18bf17c2b8c6b24e ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-26T16:32:55Z", "uuid": "01a16553-55a8-76ba-953d-b98bcd5a4eee", "scanned_at": "2026-10-22T20:35:32Z", "final_url": "https://trustvaullltx.com/", "status": 200, "ip": "195.179.239.104", "domains": [ "www.youtube.com", "coin-images.coingecko.com", "fonts.gstatic.com", "jnn-pa.googleapis.com", "googleads.g.doubleclick.net", "www.cryptocompare.com", "cdn.gtranslate.net", "use.fontawesome.com", "i.ytimg.com", "www.google.com", "static.doubleclick.net", "widgets.cryptocompare.com", "api.coingecko.com", "fonts.googleapis.com", "code.tidio.co", "widgets.coingecko.com", "translate.google.com" ], "ips": [ "2001:4860:4841:400::", "2a00:1450:4001:c25::77", "142.251.153.119", "142.251.151.4", "2a00:1450:4001:c17::94", "142.251.13.157", "104.18.31.136", "172.67.142.173", "2001:4860:4829:400::", "20.126.215.223", "172.66.172.219", "142.251.127.94", "2a00:1450:4001:c25::5f", "172.67.73.221", "104.18.5.118" ], "asns": [ "15169", "13335", "8075", "47583" ], "countries": [ "US", "DE", "NL" ], "link_domains": [ "www.blockchain.com", "www.cryptocompare.com" ], "doc_hash": "dc29d264ed2ce83382dc0238222048db40eb82e430d33dae87b511debd9f304a", "script_hashes": [ "160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef", "587c080125b135d29a931ed371e50ffc1a9641831c1087de2cd74532815f4560", "eb795deda8983fa5310627c9584cf3f3b95d272567113500059018b3941cb267", "23fc25133ed072cdf7dae575213067b1da3c6843b2a0e489c8b7fc984c60ce6b", "1fd8c0cfffd02e40cecbf9f313d1b86988a342d90bb7d16f1a67544f0064ea0b", "f2beb92898142c10e2661c03c9d7d6ac4931df2c95fe0ac6b06cda7a4a1b9e02", "96abf166b3cbb5f7df525d86fdeeeccea4af3c120b19bc26b0613530a94e8b44", "186e4c2c470e3c1c76997b7a4dfd0f618b38311582e0578db05ccada6fd43c6c", "f5118c2117300dcd406002417f201608dc046ee26b0680d4c1c93ecd01d7cc2d" ], "globals": [ "$", "jQuery", "Popper", "bootstrap", "moment", "EvEmitter", "imagesLoaded", "gtranslateSettings", "__core-js_shared__", "core", "nav", "functionConfirm", "scripts", "embedder", "baseUrl", "fabric", "saveAs", "XLSX", "XLS", "cccCurrentTheme", "cccCreateCSSSelector", "cccglobal_data", "cccupdating", "cccloading_counter", "cccfsym", "ccctsym", "cccscale", "ccclimit", "cccperiod", "cccaggregate", "cccminPeriod", "cccforceAll", "cccchart_type", "chartBTC", "colors", "validateCheckboxes", "cccUpdateChart", "cccRedrawChart", "loadData", "embedable" ], "cookies": [ "XSRF-TOKEN", "royal_trades_option_session", "__Secure-YNID", "YSC", "__Secure-ROLLOUT_TOKEN", "VISITOR_INFO1_LIVE", "VISITOR_PRIVACY_METADATA", "__cf_bm" ], "tls": { "san": [ "trustvaullltx.com", "www.trustvaullltx.com" ], "cipher": "AES_128_GCM", "issuer": "WR1", "subject": "trustvaullltx.com", "protocol": "TLS 1.3", "valid_to": "2026-11-29T23:01:08Z", "valid_from": "2026-08-31T23:01:09Z" }, "domain_age_days": 351, "apex_age_days": 351, "tls_age_days": 51, "tls_valid_days": 89, "requests": 84, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 100, "malicious": true }, "overall": { "tags": [ "phishing" ], "score": 100, "brands": [ "genericscam" ], "malicious": true, "categories": [ "phishing" ] }, "urlscan": { "tags": [ "phishing" ], "score": 100, "brands": [ "Generic Scam" ], "malicious": true, "categories": [ "phishing" ] } }, "headers": { "server": "LiteSpeed", "content-type": "text/html; charset=UTF-8", "x-powered-by": "PHP/8.2.34" } }, "cf": { "v": 1, "fetched_at": "2026-10-26T16:33:13Z", "uuid": "b8f8891d-7d9b-4d13-bd83-ac3dc1378a18", "scanned_at": "2026-10-26T16:29:50Z", "final_url": "https://trustvaullltx.com/", "status": 200, "history": [ { "url": "https://trustvaullltx.com/", "status": 200 } ], "dom_hash": "043def7dddc93b1a765ea63225992f34239bb52d52c9fc7b9a0742a7dc4f7e81", "doc_hash": "dc29d264ed2ce83382dc0238222048db40eb82e430d33dae87b511debd9f304a", "phishing_v2": [ "phishing" ], "url_risks": [ "Scam" ], "domain_risks": [ "Scam", "Security threats", "CIPA Filter", "CIPA" ], "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "trustvaullltx.com", "type": "A", "value": "195.179.239.104" }, { "name": "trustvaullltx.com", "type": "AAAA", "value": "2a02:4780:1:1166:0:25e9:923a:2" } ], "dnssec_valid": false, "ip": "195.179.239.104", "whois": { "registrar": "Dynadot Inc", "created": "2025-11-05T03:09:49Z", "updated": "2025-11-05T03:37:32Z", "expires": "2026-11-05T03:09:49Z", "nameservers": [ "ns1.dns-parking.com", "ns2.dns-parking.com" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-26T17:30:59Z", "analysis_at": "2026-10-26T17:08:44Z", "stats": { "timeout": 0, "harmless": 47, "malicious": 11, "suspicious": 1, "undetected": 33 }, "detections": { "G-Data": "phishing", "Lionic": "phishing", "Sophos": "phishing", "CyRadar": "phishing", "Fortinet": "phishing", "Netcraft": "malicious", "Kaspersky": "phishing", "Gridinsoft": "suspicious", "BitDefender": "phishing", "Chong Lua Dao": "malicious", "alphaMountain.ai": "phishing", "Forcepoint ThreatSeeker": "phishing" }, "reputation": 0, "tags": [ "dga" ], "created": "2025-11-05T00:00:00Z", "updated": "2025-11-05T00:00:00Z", "first_seen": "2025-11-05T04:01:59Z", "dns": [ { "ttl": 1800, "type": "A", "value": "195.179.239.104" }, { "ttl": 3600, "type": "TXT", "value": "v=spf1 include:_spf.mail.hostinger.com ~all" }, { "ttl": 3600, "type": "SOA", "rname": "dns.hostinger.com", "value": "ns1.dns-parking.com" }, { "ttl": 14400, "type": "MX", "value": "mx2.hostinger.com", "priority": 10 }, { "ttl": 21600, "type": "NS", "value": "ns1.dns-parking.com" }, { "ttl": 1800, "type": "AAAA", "value": "2a02:4780:1:1166:0:25e9:923a:2" }, { "ttl": 21600, "type": "NS", "value": "ns2.dns-parking.com" }, { "ttl": 14400, "type": "MX", "value": "mx1.hostinger.com", "priority": 5 } ], "dns_at": "2026-10-26T17:14:10Z", "jarm": "27d27d27d00027d00042d43d00041dba951fb796b4b956c9799ba19149e94a", "cert": { "san": [ "trustvaullltx.com", "www.trustvaullltx.com" ], "issuer": "Google Trust Services / WR1", "serial": "52fe05fa482f6d4219e7d01aeff6d24f", "sha256": "62147c5fe6dbac58b2faee56814b6a8a9a0f63aa647a950320e34b451f864ada", "subject": "trustvaullltx.com", "valid_to": "2026-11-29T23:01:08Z", "valid_from": "2026-08-31T23:01:09Z" }, "whois": [], "rdap": { "status": [ "transfer prohibited" ], "events": { "expiration": "2026-11-05T03:09:49Z", "last changed": "2026-10-18T23:31:54Z", "registration": "2025-11-05T03:09:49Z", "registrar expiration": "2026-11-05T03:09:49Z", "last update of RDAP database": "2026-10-23T10:04:18Z" }, "registrar": "DYNADOT LLC", "registrar_iana_id": "472" } }, "webcheck": { "v": 1, "fetched_at": "2026-10-26T16:34:35Z", "mail_config": { "mx": [ "mx2.hostinger.com", "mx1.hostinger.com" ], "spf": "v=spf1 include:_spf.mail.hostinger.com ~all", "dkim": [ "hostingermail-a" ], "dmarc": true, "dkim_bits": 2048, "spf_lookups": 3 }, "caa_records": { "domain": "trustvaullltx.com" }, "block_lists": { "resolvers": 12, "blocked_count": 0 }, "archives": { "last": "2026-10-26T16:31:43Z", "first": "2026-10-26T16:31:43Z", "changes": 0, "days_archived": 1, "avg_page_bytes": 10716 }, "robots_txt": { "agents": [ "*" ], "present": true }, "social_tags": { "title": "Trust Vaulltx", "ogType": "website", "ogImage": "https://trustvaullltx.com/storage/app/public/photos/6MWbb7wiOPFK1vHx72MRvVrrqdJBGmtl8tiVGWvX.png", "ogTitle": "Trading With Trust Vaulltx", "keywords": "Trust Vaulltx", "ogSiteName": "Trust Vaulltx", "themeColor": "#4D7DE6", "description": "Trust Vaulltx LIMITED???\nINVEST IN A LEADING\nTRADE AND INVESTMENT\nCOMPANY, OPERATING IN\nTHE UK. \nSERVICES INCLUDE: FOREX TRADING\nCRYPTOCURRENCIES, STOCKS & COMMODITIES INVESTMENTS. OIL & GAS, REAL ESTATE INVESTMENTS, MARKET\nRESEARCH AND ANALYSIS:\nASSISTING BOTH INDIVIDUALS & COMPANIES INVEST IN THE", "ogDescription": "Trust Vaulltx LIMITED???\nINVEST IN A LEADING\nTRADE AND INVESTMENT\nCOMPANY, OPERATING IN\nTHE UK. \nSERVICES INCLUDE: FOREX TRADING\nCRYPTOCURRENCIES, STOCKS & COMMODITIES INVESTMENTS. OIL & GAS, REAL ESTATE INVESTMENTS, MARKET\nRESEARCH AND ANALYSIS:\nASSISTING BOTH INDIVIDUALS & COMPANIES INVEST IN THE" }, "trackers": { "requests": 69, "trackers": [ { "name": "Google", "company": "Google", "country": "US", "category": "Advertising", "requests": 1 }, { "name": "Google Marketing Platform", "company": "Google", "country": "US", "category": "Advertising", "requests": 3 }, { "name": "YouTube", "company": "Google", "country": "US", "category": "Audio/Video Player", "requests": 7 }, { "name": "Google Translate", "company": "Google", "country": "US", "category": "Customer Interaction", "requests": 1 }, { "name": "Tidio", "company": "Tidio Chat", "country": "US", "category": "Customer Interaction", "requests": 1 }, { "name": "fontawesome.com", "company": "fontawesome.com", "category": "Hosting", "requests": 1 }, { "name": "Google Fonts", "company": "Google", "country": "US", "category": "Hosting", "requests": 1 }, { "name": "Google Static", "company": "Google", "country": "US", "category": "Hosting", "requests": 3 } ] }, "mixed_content": { "no_sri": [ "https://cdn.gtranslate.net/widgets/latest/popup.js", "https://widgets.coingecko.com/coingecko-coin-price-marquee-widget.js", "https://translate.google.com/translate_a/elementa0d8.js", "https://code.tidio.co/ggsggsgggg" ], "third_party_scripts": 4 }, "status": { "up": true, "code": 200, "timings": { "dns": 2, "tls": 121, "wait": 565, "connect": 119, "download": 170 }, "response_ms": 977 }, "tls_connection": { "alpn": "h2", "cipher": "TLS_AES_256_GCM_SHA384", "protocol": "TLSv1.3", "versions": [ "TLSv1.2", "TLSv1.3" ], "authorized": true, "forward_secrecy": true }, "ports": { "open": [ 21, 80, 443, 3306 ] }, "carbon": { "bytes": 37356, "co2_grams": 0.0014, "cleaner_than": 43 }, "dns_server": { "ns": [ { "ip": "162.159.24.201", "host": "ns1.dns-parking.com" }, { "ip": "162.159.25.42", "host": "ns2.dns-parking.com" } ], "zone": "trustvaullltx.com" }, "cookies": { "cookies": [ { "name": "XSRF-TOKEN", "secure": true, "same_site": "Lax" }, { "name": "royal_trades_option_session", "secure": true, "http_only": true, "same_site": "Lax" }, { "name": "__Secure-YNID", "secure": true, "http_only": true, "same_site": "None" }, { "name": "YSC", "secure": true, "session": true, "http_only": true, "same_site": "None" }, { "name": "VISITOR_INFO1_LIVE", "secure": true, "http_only": true, "same_site": "None" }, { "name": "VISITOR_PRIVACY_METADATA", "secure": true, "http_only": true, "same_site": "None" }, { "name": "__Secure-ROLLOUT_TOKEN", "secure": true, "http_only": true, "same_site": "None" }, { "name": "__cf_bm", "secure": true, "http_only": true, "same_site": "None" } ] }, "location": { "ip": "2a02:4780:1:1166:0:25e9:923a:2", "asn": "47583", "org": "HOSTINGER US", "city": "Asheville", "country": "US" }, "ssl": { "issuer": "Google Trust Services / WR1", "subject": "trustvaullltx.com" }, "dns": { "A": [ "195.179.239.104" ], "MX": [ "{\"exchange\": \"mx2.hostinger.com\", \"priority\": 10}", "{\"exchange\": \"mx1.hostinger.com\", \"priority\": 5}" ], "NS": [ "ns1.dns-parking.com", "ns2.dns-parking.com" ], "SOA": "{\"nsname\": \"ns1.dns-parking.com\", \"hostmaster\": \"dns.hostinger.com\", \"serial\": 2026102201, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 600}", "TXT": [ "v=spf1 include:_spf.mail.hostinger.com ~all" ], "AAAA": [ "2a02:4780:1:1166:0:25e9:923a:2" ] }, "dnssec": { "ds": false, "rrsig": false, "dnskey": false }, "hsts": { "message": "Site does not serve any HSTS headers." }, "http_security": { "xFrameOptions": false, "referrerPolicy": false, "xXSSProtection": false, "permissionsPolicy": false, "xContentTypeOptions": false, "contentSecurityPolicy": false, "strictTransportPolicy": false, "crossOriginOpenerPolicy": false, "crossOriginEmbedderPolicy": false, "crossOriginResourcePolicy": false }, "get_ip": { "ip": "2a02:4780:1:1166:0:25e9:923a:2", "family": 6 }, "redirects": { "chain": [ "https://trustvaullltx.com" ] }, "linked_pages": { "external": [ "https://www.blockchain.com/" ], "external_count": 1, "internal_count": 13 }, "whois": { "registrar": "Dynadot Inc", "created": "2025-11-05T03:09:49Z", "updated": "2025-11-05T03:37:32Z", "expires": "2026-11-05T03:09:49Z", "status": [ "clientTransferProhibited https://icann.org/epp" ], "nameservers": [ "ns1.dns-parking.com", "ns2.dns-parking.com" ] }, "headers": { "headers": { "server": "LiteSpeed", "content-type": "text/html; charset=UTF-8", "x-powered-by": "PHP/8.2.35" } } } } ```