tynavo-grows[.]de

tynavo-grows.de entered the PhishDestroy evidence set on Dec 17, 2025. Stored content metadata identifies Genericcloudflare as the apparent target. The stored content classification is impersonation. The assembled evidence scores 97/100 (critical).

Two independent sources are positive: VirusTotal and URLScan. VirusTotal recorded 14 detections among 95 engines: ADMINUSLabs, alphaMountain.ai, BitDefender, CRDF, CyRadar, Forcepoint ThreatSeeker, Fortinet, G-Data, Google Safebrowsing, Lionic, SOCRadar, Sophos, VIPRE, Webroot on Jul 18, 2026 at 18:45 UTC. URLScan returned a malicious verdict with score 100 on Feb 26, 2026 at 01:11 UTC. The evidence is not unanimous. The external blocklist snapshot contained no matches on Aug 7, 2026 at 18:20 UTC. URLQuery recorded no positive detection. Google Safe Browsing returned no flag on Mar 3, 2026 at 04:14 UTC.

An access-restricted HTTP 403 response was recorded on Aug 7, 2026 at 02:14 UTC. At collection time, the hostname resolved to 104.21.18.68 on AS13335 (CLOUDFLARENET, US). The associated network metadata labels the endpoint as AS13335 Cloudflare, Inc. in San Francisco, US. The stored server header is cloudflare. DOM analysis completed on Apr 23, 2026 at 11:20 UTC; stored DOM score 88/100. The evidence archive retains 2 visual captures from PhishDestroy and URLScan. IoC extraction completed on Aug 2, 2026 at 04:02 UTC; stored 0 format-validated wallet addresses and 0 Telegram indicators. TLS metadata lists WE1 as the certificate issuer with validity through May 9, 2026; checked Mar 12, 2026 at 01:31 UTC.

No page title was retained; the visual captures, not a title string, preserve the landing-page appearance. Taken together, the page content and independent findings support classifying this hostname as Genericcloudflare-themed impersonation.