# PhishDestroy domain threat record: yieldflowfx.online Content language: English Canonical HTML report: https://phishdestroy.io/domain/yieldflowfx.online/ Machine-readable companion: https://phishdestroy.io/domain/yieldflowfx.online/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-10-23 01:36:09 UTC - Last availability or vendor check: 2026-10-23 23:14:19 UTC - Stored record updated: 2026-10-23 23:28:12 UTC - VirusTotal detections in the stored snapshot: 0/92 - Independent public blocklist matches in the stored snapshot: 2 - Matching public blocklists: MetaMask, SEAL - Google Safe Browsing stored result: no stored flag ## Stored infrastructure - Observed IP address: 64.29.17.65 - Registrar in stored WHOIS data: HOSTINGER operations, UAB - Registrar country in stored WHOIS data: LT - Last stored HTTP status: 307 - Registration date (registry RDAP, yieldflowfx.online): 2026-03-24 14:12:01 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a166c3-dd2e-74eb-a431-3cfb3ec45e41/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/yieldflowfx.online - Certificate Transparency search: https://crt.sh/?q=%25.yieldflowfx.online - Web Archive lookup: https://web.archive.org/web/*/https://yieldflowfx.online/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview PhishDestroy's intake AI classified the domain as malicious because it presents itself as a cryptocurrency investment platform promising AI‑driven returns, a pattern common to fraudulent schemes. The domain was first seen by PhishDestroy on 2026-10-23. The recorded page title reads “Yield Flow – The Future of Crypto Investment”. The HTTP response recorded on that date was a 307 redirect to the www subdomain. How the scam works Fake crypto‑investment pages lure visitors with promises of high, automated returns powered by artificial intelligence and then request deposits or wallet connections to claim those gains. Victims who send funds or grant wallet access typically lose the assets to the operators. Evidence VirusTotal scanned the domain on 2026-10-23 and reported 0 malicious detections out of 92 engines. Google Safe Browsing checked the same day and did not flag the URL. External blocklists MetaMask and SEAL listed the domain, and PhishDestroy’s internal blocklist also contains it, all checked on 2026-10-23. OTX recorded two pulses referencing the domain on 2026-10-23. URLScan captured the site on 2026-10-21 (overall verdict clean) and again on 2026-10-23, where its engine score was 94 with a malicious tag but the overall verdict remained clean. Infrastructure The domain was registered on 2026-03-24 through Hostinger operations, UAB, giving it an age of 212 days at first sighting. The recorded IP address is 64.29.17.65, associated with Cypress Communications, LLC in the United States. The site was served by Vercel. The TLS certificate, issued by Let’s Encrypt / YR1, is valid until 2026-12-24 and covers *.yieldflowfx.online. Nameservers are ns1.vercel-dns.com and ns2.vercel-dns.com. What to do Avoid entering any cryptocurrency wallet credentials, private keys, or payment information on this site. If you have already provided such data, treat it as compromised and create a new secure wallet. Defenders should block the exact domain, review access logs for connections to it, and follow standard phishing response procedures. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a166c3-dd2e-74eb-a431-3cfb3ec45e41/ Cloudflare Radar report: https://radar.cloudflare.com/scan/3e5d6020-e645-4740-9ad8-29e107a1e1e0 Stored capture screenshot: https://i.ibb.co/RTyCDRYj/e2f7c214659f.png Cloudflare Radar screenshot (2026-10-23T02:17:57Z): https://screenshots.phishdestroy.io/cf/3e5d6020-e645-4740-9ad8-29e107a1e1e0.png URLScan screenshot (2026-10-17T13:36:28Z): https://screenshots.phishdestroy.io/us/01a14a13-d168-7059-ae39-d4e2128c6e24.png URLScan capture report: https://urlscan.io/result/01a14a13-d168-7059-ae39-d4e2128c6e24/ URLScan screenshot (2026-10-17T17:10:50Z): https://screenshots.phishdestroy.io/us/01a14ad8-2dd4-70f5-a7ba-6a751335c95d.png URLScan capture report: https://urlscan.io/result/01a14ad8-2dd4-70f5-a7ba-6a751335c95d/ URLScan screenshot (2026-10-23T02:01:44Z): https://screenshots.phishdestroy.io/us/01a1667d-faf7-7671-a6f2-a0bbe6037bb2.png URLScan capture report: https://urlscan.io/result/01a1667d-faf7-7671-a6f2-a0bbe6037bb2/ VirusTotal report: https://www.virustotal.com/gui/domain/yieldflowfx.online Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=yieldflowfx.online Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-23 03:28:58 UTC ## Stored page captures - Primary capture: https://i.ibb.co/RTyCDRYj/e2f7c214659f.png Captured: 2026-10-23 03:19:54 UTC - URLScan capture 1: https://urlscan.io/screenshots/01a166c3-dd2e-74eb-a431-3cfb3ec45e41.png Captured: 2026-10-23 03:19:54 UTC Source report: https://urlscan.io/result/01a166c3-dd2e-74eb-a431-3cfb3ec45e41/ - URLScan capture 2: https://screenshots.phishdestroy.io/01a15d19-ad60-73cf-ac14-c564089afbb6.png Captured: 2026-10-23 01:36:09 UTC Source report: https://urlscan.io/result/01a166c3-dd2e-74eb-a431-3cfb3ec45e41/ - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/3e5d6020-e645-4740-9ad8-29e107a1e1e0.png Captured: 2026-10-23 02:17:57 UTC Source report: https://radar.cloudflare.com/scan/3e5d6020-e645-4740-9ad8-29e107a1e1e0 SHA-256: 4ab9aa9b54e0f0f5d4561dba0f49d6e74a7be19e762971cae7ce0b12dc941476 - URLScan · 2026-10-17: https://screenshots.phishdestroy.io/us/01a14a13-d168-7059-ae39-d4e2128c6e24.png Captured: 2026-10-17 13:36:28 UTC Source report: https://urlscan.io/result/01a14a13-d168-7059-ae39-d4e2128c6e24/ SHA-256: d0e04317665a771220ac4ddc0468a9ebd2723c390ad7499c5488013dce53bd83 - URLScan · 2026-10-17: https://screenshots.phishdestroy.io/us/01a14ad8-2dd4-70f5-a7ba-6a751335c95d.png Captured: 2026-10-17 17:10:50 UTC Source report: https://urlscan.io/result/01a14ad8-2dd4-70f5-a7ba-6a751335c95d/ SHA-256: 80d042e15e73d1a4c57a4b7597e20e54071bea2df3d80dd51a22e0dd965c7fb3 - URLScan · 2026-10-23: https://screenshots.phishdestroy.io/us/01a1667d-faf7-7671-a6f2-a0bbe6037bb2.png Captured: 2026-10-23 02:01:44 UTC Source report: https://urlscan.io/result/01a1667d-faf7-7671-a6f2-a0bbe6037bb2/ SHA-256: 67b379f5cbcb2b601b7f12b7266bede9509cb2ce0ee32300cd85f09341367895 ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-23T03:26:24Z", "uuid": "01a166c3-dd2e-74eb-a431-3cfb3ec45e41", "scanned_at": "2026-10-23T03:19:34Z", "final_url": "https://www.yieldflowfx.online/", "status": 200, "redirected": "parent-domain", "redirects": [ { "to": "https://yieldflowfx.online/", "from": "http://yieldflowfx.online/", "status": 307 }, { "to": "https://www.yieldflowfx.online/", "from": "https://yieldflowfx.online/", "status": 307 } ], "ip": "64.29.17.65", "domains": [ "www.tradingview-widget.com", "s3.tradingview.com", "api.coingecko.com", "www.tradingview.com", "s.tradingview.com", "pushstream.tradingview.com", "widgetdata.tradingview.com", "widget-sheriff.tradingview-widget.com", "s3-symbol-logo.tradingview.com", "bootstrap.smartsuppchat.com", "scanner-backend.tradingview.com", "www.smartsuppchat.com", "yieldflowfx.online" ], "ips": [ "18.67.93.115", "108.158.32.110", "63.186.120.101", "216.250.139.89", "108.158.32.129", "103.180.114.1", "172.66.172.219", "178.249.213.27", "64.29.17.65", "216.198.79.1" ], "asns": [ "16509", "13649", "200325", "13335", "60068" ], "countries": [ "US", "DE", "AU", "JP" ], "link_domains": [ "v0.app" ], "doc_hash": "94db7a31daa98ba4f4183b220268ceb487ddf4fe2aa58d50b163a4b674a3c35c", "script_hashes": [ "57c82415c0a042b82b5cb178f6108677c5ff00aaf04475456cc8ed00d9232d5a", "4e1ab5a3336ba1f2ee15cb166349643efbfbdc3ee2e3e4efca2d2a92ff80c591", "2afe1c11e3fa149b52cee186a4c83e80a403e07ee3d1e6ba98a74c23f6043f39", "768359153ee40038c1411f9d69fed7fb1e9c844a1559dc2a9e0ddde85ed29c29", "1ae9766d1d2b1256af56189f4bec11aff81bcb56f38105ed00c43ad6776b31ae", "ee6631b467300a850a1454dc5f166e571e8b8564e9b871d947127a17ddd5a50e", "81911804583f936a228be35ebce54424635b2509092cfc6f73475bb36071c8bd", "e9786b1305894e4119bb9811a816dac9cf576755596dd989ee15b455749fc35e", "b38a9d44fb5e6f56a009ae2a348b9c1c87c7253033d7b2a56c4ad86adbff1af2", "c1c0a0a3598f650e19ee1c46a21565a5d824d1814a731bd072e966418c02d767" ], "globals": [ "TradingView", "_smartsupp", "smartsupp", "__next_f", "TURBOPACK", "next", "__webpack_hash__", "_N_E_STYLE_LOAD", "MotionIsMounted", "vam", "va", "vaq", "vai", "SMARTSUPP_LOADED", "$smartsupp" ], "tls": { "san": [ "*.yieldflowfx.online", "yieldflowfx.online" ], "cipher": "AES_128_GCM", "issuer": "YR2", "subject": "*.yieldflowfx.online", "protocol": "TLS 1.3", "valid_to": "2026-12-24T10:27:29Z", "valid_from": "2026-09-25T10:27:30Z" }, "domain_age_days": 212, "apex_age_days": 212, "tls_age_days": 27, "tls_valid_days": 89, "requests": 200, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 94, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "Vercel", "content-type": "text/html; charset=utf-8", "strict-transport-security": "max-age=63072000" } }, "cf": { "v": 1, "fetched_at": "2026-10-23T02:25:04Z", "uuid": "3e5d6020-e645-4740-9ad8-29e107a1e1e0", "scanned_at": "2026-10-23T02:17:57Z", "final_url": "https://www.yieldflowfx.online/", "status": 200, "redirected": "subdomain", "history": [ { "url": "https://yieldflowfx.online/", "status": 307 }, { "url": "https://www.yieldflowfx.online/", "status": 200 } ], "dom_hash": "ec7aed99a7cad3f945cb901af41a5bf25e48e955393cc08c01f7acaf420230a3", "doc_hash": "94db7a31daa98ba4f4183b220268ceb487ddf4fe2aa58d50b163a4b674a3c35c", "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "www.yieldflowfx.online", "type": "A", "value": "64.29.17.1" }, { "name": "www.yieldflowfx.online", "type": "A", "value": "64.29.17.65" }, { "name": "yieldflowfx.online", "type": "A", "value": "64.29.17.1" }, { "name": "yieldflowfx.online", "type": "A", "value": "216.198.79.1" } ], "dnssec_valid": false, "ip": "64.29.17.1", "whois": { "registrar": "HOSTINGER operations, UAB", "created": "2026-03-24T14:12:01Z", "updated": "2026-03-29T14:13:12Z", "expires": "2027-03-24T14:12:01Z", "nameservers": [ "ns1.vercel-dns.com", "ns2.vercel-dns.com" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-23T03:23:25Z", "analysis_at": "2026-10-23T02:42:50Z", "stats": { "timeout": 0, "harmless": 55, "malicious": 0, "suspicious": 0, "undetected": 37 }, "reputation": 0, "created": "2026-03-24T00:00:00Z", "updated": "2026-03-24T00:00:00Z", "first_seen": "2026-03-24T15:00:52Z", "dns": [ { "ttl": 60, "type": "CAA", "value": "sectigo.com" }, { "ttl": 21600, "type": "NS", "value": "ns2.vercel-dns.com" }, { "ttl": 3600, "type": "SOA", "rname": "hostmaster.nsone.net", "value": "ns1.vercel-dns.com" }, { "ttl": 60, "type": "CAA", "value": "letsencrypt.org" }, { "ttl": 1800, "type": "A", "value": "64.29.17.65" }, { "ttl": 60, "type": "CAA", "value": "pki.goog" }, { "ttl": 21600, "type": "NS", "value": "ns1.vercel-dns.com" }, { "ttl": 1800, "type": "A", "value": "64.29.17.1" } ], "dns_at": "2026-10-23T02:48:12Z", "jarm": "3fd3fd00000000000043d43d00043dc3b2afa8a5ec09b510a8559aff7899fb", "cert": { "san": [ "yieldflowfx.online" ], "issuer": "Let's Encrypt / YR1", "serial": "64080a416138b9a4b377ef2d0cabb3d547", "sha256": "b9f28c54e58b62984b185c1df6cb1e1cf64783ca1547fd63acda1c34f64cf0a8", "subject": "yieldflowfx.online", "valid_to": "2026-12-25T09:35:53Z", "valid_from": "2026-09-26T09:35:54Z" }, "rdap": { "status": [ "client transfer prohibited", "add period" ], "events": { "registration": "2026-03-24T14:12:01Z", "registrar expiration": "2027-03-24T14:12:01Z", "last update of RDAP database": "2026-03-25T08:48:59Z" }, "registrar": "HOSTINGER operations, UAB", "registrar_iana_id": "1636" } }, "webcheck": { "v": 1, "fetched_at": "2026-10-23T02:25:27Z", "mail_config": { "spf_lookups": 0 }, "caa_records": { "count": 3, "domain": "yieldflowfx.online", "issuers": [ "pki.goog", "sectigo.com", "letsencrypt.org" ] }, "block_lists": { "resolvers": 12, "blocked_count": 0 }, "archives": { "last": "2026-10-23T01:41:12Z", "first": "2026-10-23T01:41:12Z", "changes": 0, "days_archived": 1, "avg_page_bytes": 15386 }, "social_tags": { "ogUrl": "https://yieldflow.online", "title": "Yield Flow - The Future of Crypto Investment", "ogType": "website", "ogImage": "https://www.yieldflowfx.online/logo-og.png", "ogTitle": "Yield Flow - The Future of Crypto Investment", "keywords": "crypto,cryptocurrency,investment,trading,bitcoin,ethereum,portfolio", "generator": "v0.app", "ogSiteName": "Yield Flow", "themeColor": "#6366f1", "description": "Secure, intelligent, and automated cryptocurrency investment platform. Grow your portfolio with advanced AI-driven strategies and real-time market insights.", "twitterCard": "summary_large_image", "ogDescription": "Secure, intelligent, and automated cryptocurrency investment platform. Grow your portfolio with advanced AI-driven strategies and real-time market insights." }, "trackers": { "requests": 38, "trackers": [ { "name": "Smartsupp Chat", "company": "Smartsuppp", "country": "CZ", "category": "Customer Interaction", "requests": 2 } ] }, "mixed_content": { "third_party_scripts": 0 }, "status": { "up": true, "code": 307, "timings": { "dns": 14, "tls": 33, "wait": 16, "connect": 46, "download": 0 }, "response_ms": 109 }, "tls_connection": { "alpn": "h2", "cipher": "TLS_AES_128_GCM_SHA256", "protocol": "TLSv1.3", "versions": [ "TLSv1.2", "TLSv1.3" ], "authorized": true, "forward_secrecy": true }, "ports": { "open": [ 80, 443 ] }, "carbon": { "bytes": 86423, "co2_grams": 0.0032, "cleaner_than": 25 }, "dns_server": { "ns": [ { "ip": "198.51.45.13", "host": "ns2.vercel-dns.com" }, { "ip": "198.51.44.13", "host": "ns1.vercel-dns.com" } ], "zone": "yieldflowfx.online" }, "location": { "ip": "64.29.17.1", "asn": "16509", "org": "Amazon.com, Inc.", "city": "Walnut", "country": "US" }, "ssl": { "issuer": "Let's Encrypt / YR1", "subject": "yieldflowfx.online" }, "dns": { "A": [ "64.29.17.65", "216.198.79.1" ], "NS": [ "ns1.vercel-dns.com", "ns2.vercel-dns.com" ], "SOA": "{\"nsname\": \"ns1.vercel-dns.com\", \"hostmaster\": \"hostmaster.nsone.net\", \"serial\": 1774374018, \"refresh\": 43200, \"retry\": 7200, \"expire\": 1209600, \"minttl\": 600}" }, "dnssec": { "ds": false, "rrsig": false, "dnskey": false }, "hsts": { "header": "max-age=63072000", "message": "HSTS header does not include all subdomains." }, "http_security": { "xFrameOptions": false, "referrerPolicy": false, "xXSSProtection": false, "permissionsPolicy": false, "xContentTypeOptions": false, "contentSecurityPolicy": false, "strictTransportPolicy": "max-age=63072000", "crossOriginOpenerPolicy": false, "crossOriginEmbedderPolicy": false, "crossOriginResourcePolicy": false }, "get_ip": { "ip": "64.29.17.65", "family": 4 }, "redirects": { "chain": [ "https://yieldflowfx.online", "https://www.yieldflowfx.online/" ], "count": 1 }, "subdomains": { "count": 1, "subdomains": [ "www.yieldflowfx.online" ] }, "linked_pages": { "external": [ "https://v0.app/chat/api/open/built-with-v0/b_ABQXwFilRGR" ], "external_count": 1, "internal_count": 11 }, "whois": { "registrar": "HOSTINGER operations, UAB", "created": "2026-03-24T14:12:01Z", "updated": "2026-03-29T14:13:12Z", "expires": "2027-03-24T14:12:01Z", "status": [ "clientTransferProhibited https://icann.org/epp" ], "nameservers": [ "ns1.vercel-dns.com", "ns2.vercel-dns.com" ] }, "headers": { "headers": { "server": "Vercel", "content-type": "text/html; charset=utf-8", "strict-transport-security": "max-age=63072000" } } } } ```