# PhishDestroy domain threat record: aktien-global.de

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/aktien-global.de/
Machine-readable companion: https://phishdestroy.io/domain/aktien-global.de/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-09-20 09:58:47 UTC
- Last availability or vendor check: 2026-10-22 10:25:58 UTC
- Stored record updated: 2026-10-22 16:07:29 UTC
- VirusTotal detections in the stored snapshot: 8/91
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: adobe

## Stored infrastructure

- Observed IP address: 159.69.104.203
- Registrar in stored WHOIS data: REGISTRAR_NOT_FOUND
- Last stored HTTP status: 301

## Evidence links

- URLScan report: https://urlscan.io/result/01a0be41-7d4f-74de-bb30-e690be7352ba/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/aktien-global.de
- Certificate Transparency search: https://crt.sh/?q=%25.aktien-global.de
- Web Archive lookup: https://web.archive.org/web/*/https://aktien-global.de/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
aktien-global.de presents itself as "Aktien-Global.de", a name built on the German word for shares, so it reads as a stock-trading or investment service for German-speaking investors. PhishDestroy classifies it as an impersonation phishing page and first flagged it on 2026-09-20. On 2026-10-19 the site was still online, and its content was reachable through a redirect.

How the scam works
Impersonation sites like this borrow the look and language of a legitimate brokerage so visitors trust them with account logins, personal details and payments. A typical flow is a registration or login form followed by a dashboard that shows invented gains to encourage larger deposits. Victims lose whatever credentials they type in, along with any money they transfer. Withdrawals are often blocked behind new "taxes" or "release fees" that only extract more cash.

Evidence
On 2026-09-29, 8 of 91 VirusTotal engines flagged the domain: alphaMountain.ai, Chong Lua Dao, ESET, Forcepoint ThreatSeeker, Gridinsoft, Lionic, Seclookup and SOCRadar. That is a minority of engines, but the group includes established vendors alongside dedicated phishing feeds, which points to independent confirmation rather than a single source. The domain also appears in 6 AlienVault OTX threat pulses and on the PhishDestroy blocklist.

Infrastructure
The site resolves to 159.69.104.203 on Hetzner Online GmbH in Germany. This keeps a German-language lure on German hosting, which can make it look more local and credible to its intended audience. Its certificate comes from Let's Encrypt (YR2). The padlock in the browser only means the connection is encrypted, not that the operator is a genuine broker.

What to do
Do not deposit anything further, and refuse any request for fees, taxes or verification payments to unlock a withdrawal. If you paid by card or bank transfer, contact your bank immediately to dispute or recall the payment, and report the case to the police and to BaFin. Change the password you used on this site anywhere else you reuse it, and turn on two-factor authentication for your email and banking. Security teams should block the domain and its IP at the DNS and proxy level and watch for lookalike variants of the name.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a0be41-7d4f-74de-bb30-e690be7352ba/
VirusTotal report: https://www.virustotal.com/gui/domain/aktien-global.de
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=aktien-global.de
Archived copy: https://web.archive.org/web/20260922140608/https://www.aktien-global.de/
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 09:38:30 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/3JRSQyS/7d792fc80227.png
  Captured: 2026-09-20 10:00:16 UTC
- URLScan capture 1: https://screenshots.phishdestroy.io/01a0be41-7d4f-74de-bb30-e690be7352ba.png
  Captured: 2026-09-20 10:00:16 UTC
  Source report: https://urlscan.io/result/01a0be41-7d4f-74de-bb30-e690be7352ba/
- URLScan capture 2: https://urlscan.io/screenshots/019d0f0d-0538-71fd-b0a6-58a082daa356.png
  Captured: 2026-09-20 09:58:47 UTC
  Source report: https://urlscan.io/result/01a0be41-7d4f-74de-bb30-e690be7352ba/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/ae8e0a9b-0afe-4d8f-8847-6bf8c0acf482.png
  Captured: 2026-09-20 10:01:10 UTC
  Source report: https://radar.cloudflare.com/scan/ae8e0a9b-0afe-4d8f-8847-6bf8c0acf482
  SHA-256: f5b1237d7c0b94c66752acdd3490f89cf1f0a3b5274f267a526cb95b49215b73
- URLScan · 2026-09-20: https://screenshots.phishdestroy.io/us/01a0be43-6f41-7285-9d43-47c82cff95dd.png
  Captured: 2026-09-20 10:01:32 UTC
  Source report: https://urlscan.io/result/01a0be43-6f41-7285-9d43-47c82cff95dd/
  SHA-256: 7fb1552550dddfdc857eba578fd3d9d267d10dd21d5bac2754dd47f4aae3c7c2

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-20T22:23:48Z",
        "uuid": "01a0be41-7d4f-74de-bb30-e690be7352ba",
        "scanned_at": "2026-09-20T09:59:26Z",
        "final_url": "https://www.aktien-global.de/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://www.aktien-global.de/",
                "from": "http://www.aktien-global.de/",
                "status": 307
            }
        ],
        "ip": "159.69.104.203",
        "ptr": "dedivirt1412.your-server.de",
        "domains": [
            "matomo.fiveco.de",
            "www.wallstreet-online.de"
        ],
        "ips": [
            "80.90.18.193",
            "159.69.104.203"
        ],
        "asns": [
            "20546",
            "24940"
        ],
        "countries": [
            "DE"
        ],
        "link_domains": [
            "www.value-stars.de",
            "anlegerbrief.com",
            "value-stars.de"
        ],
        "doc_hash": "97c31279f2439f938f21c05fcca8c57fea7747443df6086eb0ab9970323e6a41",
        "script_hashes": [
            "7cbd4f28940bc24c441f50be5d47d69991cd210b1ff4bc7f7ef28612a49fcc1a",
            "805253efa7de8ab74569c79a1df392aa9f06b01fb6ba1bf189b054eb23a4255e",
            "b294e973896f8f874e90a8eb1a8908ac790980d034c4c4bdf0fc3d37b8abf682",
            "5b59b8c2000bd5e45d97a55ee689e40b5d2317e5ea7c6d7dda972b7575126ae6",
            "935e59fb4c8b1c9e62f5cc4f1bf15a37c1930b5681449fa5f3617089bb307555",
            "56c7dfcfde564b3952b531523c7c490557d7f1876f09d81f3ccada57a6dd7a7b",
            "8c79e027191d8bbfc9637cec9a607908a43225a5f9b66048475d2caf86d583e8",
            "2cbcdd3959ad45a7cad63940d092d7c162cbc280f90669b101156463857c3933",
            "46bf982f0528b895b9e12f1cf16ed2506bac69d866740db1a1793cfcda9c7523",
            "8e5da2918be1cf7cf397cb105932e860cf666222defa44f86c1ba0f60925d67e"
        ],
        "globals": [
            "$",
            "jQuery",
            "trackOutboundLink",
            "borlabsCookieConfig",
            "f",
            "g",
            "BorlabsCookie",
            "BorlabsCookiePrioritizeHandle",
            "_paq",
            "jQuery1110011505640110727389",
            "__VUE_INSTANCE_SETTERS__",
            "__VUE_SSR_SETTERS__",
            "borlabsCookiePrioritized",
            "_wpemojiSettings",
            "twemoji",
            "wp",
            "Piwik",
            "Matomo",
            "AnalyticsTracker",
            "piwik_log"
        ],
        "storage_keys": [
            "wpEmojiSettingsSupports"
        ],
        "tls": {
            "san": [
                "aktien-global.de",
                "www.aktien-global.de"
            ],
            "cipher": "AES_256_GCM",
            "issuer": "YR2",
            "subject": "aktien-global.de",
            "protocol": "TLS 1.3",
            "valid_to": "2026-12-13T23:11:24Z",
            "valid_from": "2026-09-14T23:11:25Z"
        },
        "domain_age_days": 4926,
        "apex_age_days": 4926,
        "tls_age_days": 5,
        "tls_valid_days": 89,
        "requests": 44,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": -91,
                "malicious": false
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "Apache",
            "content-type": "text/html; charset=UTF-8"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-20T22:31:42Z",
        "uuid": "ae8e0a9b-0afe-4d8f-8847-6bf8c0acf482",
        "scanned_at": "2026-09-20T10:01:10Z",
        "final_url": "https://www.aktien-global.de/",
        "status": 200,
        "redirected": "subdomain",
        "history": [
            {
                "url": "https://aktien-global.de/",
                "status": 301
            },
            {
                "url": "https://www.aktien-global.de/",
                "status": 200
            }
        ],
        "dom_hash": "c5bad2181a9212e91da09099b2ddeb8357049f49ef3f033d1d15aea5fe19b00a",
        "doc_hash": "12c3d5019dc7a965efe5c700b8011a14f00cb37fc34e9940140d3cb2a0fd5b1b",
        "domain_risks": [
            "Brokerage & Investing",
            "Business & Economy",
            "Economy & Finance"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "aktien-global.de",
                "type": "A",
                "value": "159.69.104.203"
            },
            {
                "name": "aktien-global.de",
                "type": "AAAA",
                "value": "2a01:4f8:c0c:51d::2"
            },
            {
                "name": "www.aktien-global.de",
                "type": "CNAME",
                "value": "aktien-global.de"
            },
            {
                "name": "aktien-global.de",
                "type": "A",
                "value": "159.69.104.203"
            },
            {
                "name": "www.aktien-global.de",
                "type": "CNAME",
                "value": "aktien-global.de"
            },
            {
                "name": "aktien-global.de",
                "type": "AAAA",
                "value": "2a01:4f8:c0c:51d::2"
            }
        ],
        "dnssec_valid": false,
        "ip": "159.69.104.203",
        "whois": {
            "updated": "2024-10-18T11:05:21Z",
            "nameservers": [
                "helium.ns.hetzner.de",
                "hydrogen.ns.hetzner.com",
                "oxygen.ns.hetzner.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-22T01:56:14Z",
        "analysis_at": "2026-10-21T09:34:40Z",
        "stats": {
            "timeout": 0,
            "harmless": 53,
            "malicious": 6,
            "suspicious": 1,
            "undetected": 32
        },
        "detections": {
            "ESET": "suspicious",
            "Lionic": "phishing",
            "SOCRadar": "phishing",
            "Seclookup": "malicious",
            "Gridinsoft": "phishing",
            "alphaMountain.ai": "phishing",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "categories": {
            "BitDefender": "financial",
            "alphaMountain.ai": "Brokerage/Trading, Finance, Phishing (alphaMountain.ai)",
            "Forcepoint ThreatSeeker": "phishing and other frauds. financial data and services"
        },
        "popularity": {
            "Alexa": 214934,
            "Statvoo": 214934,
            "Cisco Umbrella": 921293,
            "Cloudflare Radar": 1000000
        },
        "first_seen": "2023-10-01T12:39:46Z",
        "dns": [
            {
                "ttl": 21600,
                "type": "MX",
                "value": "dedivirt1412.your-server.de",
                "priority": 10
            },
            {
                "ttl": 21600,
                "type": "AAAA",
                "value": "2a01:4f8:c0c:51d::2"
            },
            {
                "ttl": 21600,
                "type": "TXT",
                "value": "v=spf1 a mx ~all"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "helium.ns.hetzner.de"
            },
            {
                "ttl": 21600,
                "type": "A",
                "value": "159.69.104.203"
            },
            {
                "ttl": 21600,
                "type": "SOA",
                "rname": "dns.hetzner.com",
                "value": "hydrogen.ns.hetzner.com"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "oxygen.ns.hetzner.com"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "hydrogen.ns.hetzner.com"
            }
        ],
        "dns_at": "2026-10-21T09:35:05Z",
        "jarm": "2ad2ad16d2ad2ad00042d42d0000006a78f6757b72f02e234bb3f6d2d5740b",
        "cert": {
            "san": [
                "aktien-global.de",
                "www.aktien-global.de"
            ],
            "issuer": "Let's Encrypt / YR2",
            "serial": "671c6b4b28de85017f7306d432a8755dc5b",
            "sha256": "008d5fe08fbe674e5af386657529bf9257d8ecc4257506722913f68e1bcc2e20",
            "subject": "aktien-global.de",
            "valid_to": "2026-12-13T23:11:24Z",
            "valid_from": "2026-09-14T23:11:25Z"
        },
        "rdap": {
            "status": [
                "active"
            ],
            "events": {
                "last changed": "2024-10-18T11:05:21Z"
            }
        }
    }
}
```