# PhishDestroy domain threat record: zuhatradex.shop

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/zuhatradex.shop/
Machine-readable companion: https://phishdestroy.io/domain/zuhatradex.shop/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-09-19 21:54:47 UTC
- Last availability or vendor check: 2026-10-21 22:36:37 UTC
- Stored record updated: 2026-10-22 06:23:47 UTC
- VirusTotal detections in the stored snapshot: 14/91
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored infrastructure

- Observed IP address: 185.62.57.28
- Registrar in stored WHOIS data: NETIM
- Last stored HTTP status: 200
- Registration date in stored WHOIS data: 2026-04-13 08:29:42 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/019f7ecf-4e00-7714-ba9a-6c0397b54259/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/zuhatradex.shop
- Certificate Transparency search: https://crt.sh/?q=%25.zuhatradex.shop
- Web Archive lookup: https://web.archive.org/web/*/https://zuhatradex.shop/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
zuhatradex.shop operates as a fraudulent cryptocurrency exchange under the name Zuha Tradex, targeting retail investors who are drawn to AI-assisted trading services. The site presents itself as an official, professional trading platform to build false confidence. PhishDestroy first flagged it on 2026-09-19, and it remained fully live with active content as of 2026-10-19.

How the scam works
Posing as a legitimate exchange under the title "Zuha tradex | AI Trading Platform | Official Website", the site lures users into creating accounts and depositing cryptocurrency. The platform typically displays fabricated balances or trading gains to encourage victims to commit larger sums. When users attempt to withdraw, the platform stalls, demands fees, or goes silent entirely. Every deposit made is effectively stolen.

Evidence
Fourteen of 91 engines on VirusTotal flagged this domain as malicious as of 2026-09-29, with confirmed detections from BitDefender, ESET, Fortinet, G-Data, Gridinsoft, CRDF, Forcepoint ThreatSeeker, and alphaMountain.ai. Three OTX threat intelligence pulses independently corroborate the classification. The domain appears on the PhishDestroy blocklist.

Infrastructure
The domain was registered on 2026-04-13 through NETIM and is hosted on the Snel.com B.V. network in the Netherlands. TLS is issued by ZeroSSL GmbH via ZeroSSL ECC DV SSL CA 2, a free domain-validated certificate that provides encryption but no verification of the operator's identity or legitimacy.

What to do
If you only visited the site without registering or depositing, avoid any further contact with it. If you transferred funds to this platform, treat them as lost and do not send additional money in response to withdrawal fees or identity verification demands. Report the fraud to your national financial regulator and to any exchange or payment provider you used to send the funds. Security teams should block zuhatradex.shop at the DNS and proxy layer and monitor the hosting IP 185.62.57.28 for related infrastructure.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/019f7ecf-4e00-7714-ba9a-6c0397b54259/
VirusTotal report: https://www.virustotal.com/gui/domain/zuhatradex.shop
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=zuhatradex.shop
Archived copy: https://web.archive.org/web/20260922194521/https://zuhatradex.shop/
Revoke token approvals: https://revoke.cash/
Report crypto fraud (Chainabuse): https://www.chainabuse.com/report
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 08:20:33 UTC

## Stored page captures

- Primary capture: https://urlscan.io/screenshots/019f7ecf-4e00-7714-ba9a-6c0397b54259.png
  Captured: 2026-09-19 21:54:47 UTC
- URLScan capture: https://screenshots.phishdestroy.io/019f7ecf-4e00-7714-ba9a-6c0397b54259.png
  Captured: 2026-09-22 03:32:33 UTC
  Source report: https://urlscan.io/result/019f7ecf-4e00-7714-ba9a-6c0397b54259/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/385f4610-d21f-4e1f-8cdd-f12acdfec59f.png
  Captured: 2026-09-19 21:58:20 UTC
  Source report: https://radar.cloudflare.com/scan/385f4610-d21f-4e1f-8cdd-f12acdfec59f
  SHA-256: 54d310af345ffc70b03298928b33c09404e021a627437fabfea46f89f7da7b00

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-20T22:24:36Z",
        "uuid": "019f7ecf-4e00-7714-ba9a-6c0397b54259",
        "scanned_at": "2026-07-20T09:15:50Z",
        "final_url": "https://zuhatradex.shop/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://zuhatradex.shop/",
                "from": "http://zuhatradex.shop/",
                "status": 307
            }
        ],
        "ip": "2606:4700:3036::ac43:b6cd",
        "domains": [
            "cdnjs.cloudflare.com",
            "cdn.jsdelivr.net",
            "fonts.googleapis.com",
            "static.cloudflareinsights.com",
            "static.cloudflare.com"
        ],
        "ips": [
            "2a04:4e42::485",
            "2607:f8b0:4004:c17::5f",
            "2606:4700::6811:190e",
            "2606:4700:3036::ac43:b6cd"
        ],
        "asns": [
            "54113",
            "15169",
            "13335"
        ],
        "countries": [
            "US"
        ],
        "doc_hash": "458eb8592bdacfa274fcf453be02e2aa6c8efec8e78ed60d39b451db91b8a11c",
        "script_hashes": [
            "ccf00d1923b0131a10e0c6d26f95e5dee6ebf8621a27e83c5a2f68a2e0093142"
        ],
        "globals": [
            "LANG_MSGS",
            "ClientJS",
            "_llrmby",
            "toggleTermsPopup",
            "__cfQR",
            "__cfRLUnblockHandlers"
        ],
        "cookies": [
            "entry_url"
        ],
        "tls": {
            "san": [
                "zuhatradex.shop"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "WE1",
            "subject": "zuhatradex.shop",
            "protocol": "QUIC",
            "valid_to": "2026-09-10T15:31:28Z",
            "valid_from": "2026-06-12T14:31:37Z"
        },
        "domain_age_days": 97,
        "apex_age_days": 97,
        "tls_age_days": 37,
        "tls_valid_days": 90,
        "requests": 18,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 99,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "cloudflare",
            "content-type": "text/html; charset=utf-8",
            "strict-transport-security": "max-age=31536000; includeSubDomains; preload",
            "content-security-policy": "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://static.cloudflare.com https://cdn.jsdelivr.net; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://cdnjs.",
            "x-frame-options": "SAMEORIGIN",
            "x-content-type-options": "nosniff",
            "referrer-policy": "strict-origin-when-cross-origin",
            "permissions-policy": "camera=(), microphone=(), geolocation=()",
            "cross-origin-opener-policy": "same-origin"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-20T22:32:03Z",
        "uuid": "385f4610-d21f-4e1f-8cdd-f12acdfec59f",
        "scanned_at": "2026-09-19T21:58:20Z",
        "final_url": "https://zuhatradex.shop/",
        "history": [
            {
                "url": "https://zuhatradex.shop/",
                "status": 0
            }
        ],
        "dom_hash": "222edc6576ce4f900a55dd02c5523f77c5fa64ee8b4e540f3ff8452026c169a8",
        "domain_risks": [
            "Malware",
            "Security threats",
            "CIPA Filter",
            "CIPA"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "zuhatradex.shop",
                "type": "A",
                "value": "185.62.57.28"
            }
        ],
        "dnssec_valid": false,
        "verdict": {
            "tags": [
                "malware"
            ],
            "malicious": true,
            "categories": [
                "malware"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-22T03:22:44Z",
        "analysis_at": "2026-10-19T11:08:51Z",
        "stats": {
            "timeout": 0,
            "harmless": 45,
            "malicious": 12,
            "suspicious": 3,
            "undetected": 32
        },
        "detections": {
            "CRDF": "malicious",
            "DNS8": "suspicious",
            "ESET": "suspicious",
            "VIPRE": "phishing",
            "G-Data": "phishing",
            "Lionic": "phishing",
            "Sophos": "phishing",
            "Webroot": "malicious",
            "Fortinet": "phishing",
            "SOCRadar": "phishing",
            "Seclookup": "malicious",
            "Gridinsoft": "suspicious",
            "BitDefender": "phishing",
            "alphaMountain.ai": "phishing",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "categories": {
            "alphaMountain.ai": "Phishing (alphaMountain.ai)"
        },
        "created": "2026-04-13T00:00:00Z",
        "updated": "2026-04-13T00:00:00Z",
        "first_seen": "2026-04-13T14:27:27Z",
        "dns": [
            {
                "ttl": 21600,
                "type": "NS",
                "value": "leif.ns.cloudflare.com"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "aria.ns.cloudflare.com"
            },
            {
                "ttl": 1800,
                "type": "SOA",
                "rname": "dns.cloudflare.com",
                "value": "aria.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "185.62.57.28"
            }
        ],
        "dns_at": "2026-10-19T11:18:23Z",
        "jarm": "40d40d40d00000000043d43d00043d6aff5ab0f4fc31897186312c9e639319",
        "cert": {
            "san": [
                "zuhatradex.shop"
            ],
            "issuer": "ZeroSSL GmbH / ZeroSSL ECC DV SSL CA 2",
            "serial": "d30f80ad6122a039f01dbe59d61b7dad",
            "sha256": "cecf41b13e6fe6d84018ee5a94e36baaee5dfa38530cda5c19644926d722a805",
            "subject": "zuhatradex.shop",
            "valid_to": "2026-12-17T23:59:59Z",
            "valid_from": "2026-09-18T00:00:00Z"
        },
        "whois": []
    }
}
```