domain
firstcryptoinvestment.ru
Connected scam domains
1Related entities
9First observed
May 9, 2026Last observed
May 22, 2026Connected Scam Domains (1)
Historical Timeline (26 snapshots)
May 22, 202603:35 AMcertificatevia openssl
May 22, 202603:35 AMwhoisvia whois
May 22, 202603:35 AMdnsvia dig
A Records
AAAA
NS
MX
May 20, 202603:37 AMcertificatevia openssl
May 20, 202603:36 AMwhoisvia whois
May 20, 202603:36 AMdnsvia dig
A Records
AAAA
NS
MX
May 18, 202603:36 AMcertificatevia openssl
May 18, 202603:36 AMwhoisvia whois
May 18, 202603:36 AMdnsvia dig
A Records
AAAA
NS
MX
May 16, 202603:36 AMcertificatevia openssl
May 16, 202603:36 AMwhoisvia whois
May 16, 202603:36 AMdnsvia dig
A Records
AAAA
NS
MX
May 14, 202603:37 AMcertificatevia openssl
Changes from previous
~ sans: *.firstcryptoinvestment.ru, firstcryptoinvestment.ru, firstcryptoinvestment.ru.firstcitycrownb.com, www.firstcryptoinvestment.ru.firstcitycrownb.com
~ issuer: R13 null
~ serial: 06678605BA46649CECA50479C0AB1D4D26A5 null
~ subject: CN = firstcryptoinvestment.ru null
~ not_after: Jun 17 12:10:17 2026 GMT null
~ not_before: Mar 19 12:10:18 2026 GMT null
May 14, 202603:37 AMwhoisvia whois
May 14, 202603:37 AMdnsvia dig
A Records
AAAA
NS
MX
Changes from previous
~ a: 208.91.198.220
~ mx: [object Object]
~ ns: ns2.bh-32.webhostbox.net, ns1.bh-32.webhostbox.net
~ soa: ns2.bh-32.webhostbox.net. root.bh-32.webhostbox.net. 2026031901 86400 7200 3600000 86400 null
~ txt: "v=spf1 ip4:208.91.198.220 a mx include:websitewelcome.com ~all"
May 12, 202603:39 AMcertificatevia openssl
issuerR13
serial06678605BA46649CECA50479C0AB1D4D26A5
subjectCN = firstcryptoinvestment.ru
May 12, 202603:39 AMwhoisvia whois
May 12, 202603:39 AMdnsvia dig
A Records208.91.198.220
AAAA
NSns2.bh-32.webhostbox.net,ns1.bh-32.webhostbox.net
MX[object Object]
May 10, 202603:39 AMcertificatevia openssl
issuerR13
serial06678605BA46649CECA50479C0AB1D4D26A5
subjectCN = firstcryptoinvestment.ru
May 10, 202603:39 AMwhoisvia whois
Changes from previous
~ status: 1
- raw_whois: --------------------------------------------------
Generator: x2.autowhois.com
Registry WHOIS: whois.tcinet.ru
Query Time: Sat, 09 May 2026 22:14:40 +0000
--------------------------------------------------
% TCI Whois Service. Terms of use:
% https://tcinet.ru/documents/whois_ru_rf.pdf (in Russian)
% https://tcinet.ru/documents/whois_su.pdf (in Russian)
domain: FIRSTCRYPTOINVESTMENT.RU
nserver: ns1.bh-32.webhostbox.net.
nserver: ns2.bh-32.webhostbox.net.
state: REGISTERED, DELEGATED, UNVERIFIED
person: Private Person
registrar: REGTIME-RU
admin-contact: https://whois.webnames.ru
created: 2025-09-16T17:20:53Z
paid-till: 2026-09-16T17:20:53Z
free-date: 2026-10-17
source: TCI
Last updated on 2026-05-09T22:13:02Z
- query_time: 2026-05-09 22:14:40
- create_date: 2025-09-16
- domain_name: firstcryptoinvestment.ru
~ expiry_date: 2026-09-16 null
- query_stats: {"user_ip_address":"132.145.18.25","api_credits_charged":1,"whois_retrieval_time":0.8}
~ name_servers: ns1.bh-32.webhostbox.net, ns2.bh-32.webhostbox.net
+10 more changesMay 10, 202603:39 AMdnsvia dig
A Records208.91.198.220
AAAA
NSns2.bh-32.webhostbox.net,ns1.bh-32.webhostbox.net
MX[object Object]
Changes from previous
~ soa: {"retry":7200,"expire":3600000,"minttl":86400,"nsname":"ns2.bh-32.webhostbox.net","serial":2026031901,"refresh":86400,"hostmaster":"root.bh-32.webhostbox.net"} ns2.bh-32.webhostbox.net. root.bh-32.webhostbox.net. 2026031901 86400 7200 3600000 86400
- srv:
~ txt: v=spf1 ip4:208.91.198.220 a mx include:websitewelcome.com ~all "v=spf1 ip4:208.91.198.220 a mx include:websitewelcome.com ~all"
- cname:
- naptr:
- domain: firstcryptoinvestment.ru
- errors: AAAA: Error: queryAaaa ENODATA firstcryptoinvestment.ru, CNAME: Error: queryCname ENODATA firstcryptoinvestment.ru, SRV: Error: querySrv ENODATA firstcryptoinvestment.ru, CAA: Error: queryCaa ENODATA firstcryptoinvestment.ru, NAPTR: Error: queryNaptr ENODATA firstcryptoinvestment.ru
- cloudflareNsPair: null
May 9, 202610:14 PMlinguisticvia linguistic_scan
total_words3923
pages_fetched2
sentence_hash_count124
May 9, 202610:14 PMlogin_ctavia login_cta_scan
cta_links3
frontend_ip208.91.198.220
frontend_servernginx/1.25.5
May 9, 202610:14 PMexifvia exif_scan
images_found2
has_attributionfalse
images_processed2
May 9, 202610:14 PMdnsvia dns_lookup
A Records208.91.198.220
AAAA
NSns1.bh-32.webhostbox.net,ns2.bh-32.webhostbox.net
MX[object Object]
May 9, 202610:14 PMwhoisvia whoxy
Have information about this infrastructure?
Your report helps us track and expose these operations.