# PhishDestroy domain threat record: alphadomus.co.nz

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/alphadomus.co.nz/
Machine-readable companion: https://phishdestroy.io/domain/alphadomus.co.nz/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-10 21:47:39 UTC
- Last availability or vendor check: 2026-10-22 10:26:02 UTC
- Stored record updated: 2026-10-22 16:07:29 UTC
- VirusTotal detections in the stored snapshot: 4/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: facebook

## Stored infrastructure

- Observed IP address: 104.21.60.19
- Registrar in stored WHOIS data: Dreamscape Networks International Pte Ltd t/a Crazy Domains
- Last stored HTTP status: 200
- Registration date in stored WHOIS data: 1997-09-07 10:00:00 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a127c7-5385-72cd-ab9b-f95e0e15ffff/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/alphadomus.co.nz
- Certificate Transparency search: https://crt.sh/?q=%25.alphadomus.co.nz
- Web Archive lookup: https://web.archive.org/web/*/https://alphadomus.co.nz/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
alphadomus.co.nz presents itself as Alpha Domus Winery & Cellar Door in Hawke's Bay, New Zealand. PhishDestroy classifies it as an impersonation phishing page aimed at people who want to buy wine, book tastings or contact the winery. We first flagged it on 2026-10-10, and it was still online and reachable behind protection on 2026-10-19. The page title shows the winery's own name and branding, but we classified the site as impersonation.

How the scam works
Impersonation pages copy a real business's name, look and wording so visitors believe they are dealing with the genuine company. On a winery-styled site, the typical goal is to get visitors to place orders, pay for tastings or club memberships, or create an account. Those steps collect card details, billing addresses and login credentials. The victim may lose money on orders that never arrive and may have their payment card or reused passwords misused later.

Evidence
Independent detection is limited. On 2026-10-16, 4 of 92 VirusTotal engines flagged the domain: alphaMountain.ai, Forcepoint ThreatSeeker, Gridinsoft and Seclookup. The domain appears in 34 AlienVault OTX threat pulses, so other researchers have also tracked it. PhishDestroy is the only blocklist in this set listing it, so many browsers and filters may not warn visitors yet.

Infrastructure
The domain was registered on 1997-09-07 through Crazy Domains (Dreamscape Networks International Pte Ltd), almost three decades before we detected it. That makes it very different from the throwaway domains common in phishing. The site is served through Cloudflare (AS13335) on a US-based address, which hides the origin server from visitors. Its certificate comes from Google Trust Services, so the padlock in the browser says nothing about whether the site is legitimate.

What to do
If you paid for wine, tastings or a membership on this site, contact your card issuer right away. Dispute the charge and ask for a replacement card. If you created an account or signed in, change that password and any other account where you reused it, and turn on two-factor authentication where available. Treat follow-up emails or calls about your order with suspicion, and reach the winery only through contact details you have checked independently. Security teams should block the domain on mail and web gateways and check logs for user visits or form submissions.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a127c7-5385-72cd-ab9b-f95e0e15ffff/
VirusTotal report: https://www.virustotal.com/gui/domain/alphadomus.co.nz
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=alphadomus.co.nz
Archived copy: https://web.archive.org/web/20261010213821/https://alphadomus.co.nz/
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 09:27:29 UTC

## Stored page captures

- Primary capture: https://urlscan.io/screenshots/01a127c7-5385-72cd-ab9b-f95e0e15ffff.png
  Captured: 2026-10-10 21:47:39 UTC
- URLScan capture 1: https://screenshots.phishdestroy.io/01a127c7-5385-72cd-ab9b-f95e0e15ffff.png
  Captured: 2026-10-10 21:47:39 UTC
  Source report: https://urlscan.io/result/01a127c7-5385-72cd-ab9b-f95e0e15ffff/
- URLScan capture 2: https://urlscan.io/screenshots/01a07ce6-1d12-7120-9f7a-0a089482d1f1.png
  Captured: 2026-10-10 21:35:37 UTC
  Source report: https://urlscan.io/result/01a127c7-5385-72cd-ab9b-f95e0e15ffff/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/3e5d5394-de01-486d-a203-e14c8cad2aa9.png
  Captured: 2026-10-12 11:52:05 UTC
  Source report: https://radar.cloudflare.com/scan/3e5d5394-de01-486d-a203-e14c8cad2aa9
  SHA-256: 2117c9cb5c730cf8e6512579e2286322fa99f98fc811943c5ffa83fbed3ce554
- URLScan · 2026-08-15: https://screenshots.phishdestroy.io/us/01a006bc-cb47-726d-b296-47efe996682a.png
  Captured: 2026-08-15 18:44:02 UTC
  Source report: https://urlscan.io/result/01a006bc-cb47-726d-b296-47efe996682a/
  SHA-256: 137dadfb460cd73eac51eb81e701f7fc802e3ff5ec0005efcb306027be3a49c5
- URLScan · 2026-08-18: https://screenshots.phishdestroy.io/us/01a014ec-dec5-77f9-869f-b7dde3ad1b87.png
  Captured: 2026-08-18 12:51:17 UTC
  Source report: https://urlscan.io/result/01a014ec-dec5-77f9-869f-b7dde3ad1b87/
  SHA-256: a9da82c8936dd37beaef17d92bfda3a759ae66d232de3f0d139c55c43e118fd3
- URLScan · 2026-08-22: https://screenshots.phishdestroy.io/us/01a0274e-ecf4-74d7-baa9-c16ed65458c9.png
  Captured: 2026-08-22 02:31:30 UTC
  Source report: https://urlscan.io/result/01a0274e-ecf4-74d7-baa9-c16ed65458c9/
  SHA-256: c57c95109977bb039f4fdbc62ab9d9b29fff782981eace25f53286e8b4710954
- URLScan · 2026-09-04: https://screenshots.phishdestroy.io/us/01a06cd3-7ae6-743a-af6d-0194d42e3767.png
  Captured: 2026-09-04 14:30:05 UTC
  Source report: https://urlscan.io/result/01a06cd3-7ae6-743a-af6d-0194d42e3767/
  SHA-256: c57c95109977bb039f4fdbc62ab9d9b29fff782981eace25f53286e8b4710954
- URLScan · 2026-09-07: https://screenshots.phishdestroy.io/us/01a07ce6-1d12-7120-9f7a-0a089482d1f1.png
  Captured: 2026-09-07 17:24:22 UTC
  Source report: https://urlscan.io/result/01a07ce6-1d12-7120-9f7a-0a089482d1f1/
  SHA-256: a9da82c8936dd37beaef17d92bfda3a759ae66d232de3f0d139c55c43e118fd3
- URLScan · 2026-10-10: https://screenshots.phishdestroy.io/us/01a127c1-5dfe-77f2-9e1d-3aa43b6f869b.png
  Captured: 2026-10-10 21:39:18 UTC
  Source report: https://urlscan.io/result/01a127c1-5dfe-77f2-9e1d-3aa43b6f869b/
  SHA-256: 246fcd6d86d01e4b70c915d3dcfd7dfded6d562fa00be005904d4c05807d62a6

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-20T18:33:58Z",
        "uuid": "01a127c7-5385-72cd-ab9b-f95e0e15ffff",
        "scanned_at": "2026-10-10T21:45:45Z",
        "final_url": "https://alphadomus.co.nz/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://alphadomus.co.nz/",
                "from": "http://alphadomus.co.nz/",
                "status": 307
            }
        ],
        "ip": "172.67.187.184",
        "domains": [
            "api.commerce7.com",
            "alpha-domus.imgix.net",
            "cdn.commerce7.com",
            "app.referral.wine",
            "www.gstatic.com",
            "maps.googleapis.com",
            "www.recaptcha.net",
            "connect.facebook.net",
            "www.googletagmanager.com",
            "fonts.gstatic.com",
            "stats.g.doubleclick.net",
            "analytics.google.com",
            "www.google.com",
            "gtm.alphadomus.co.nz"
        ],
        "ips": [
            "142.251.20.94",
            "2a00:1450:4001:c25::5e",
            "18.245.60.7",
            "2a00:1450:4001:c21::9a",
            "2001:4860:4802:38::181",
            "157.240.0.6",
            "172.217.112.4",
            "2001:4860:4844:400::",
            "2a00:1450:4001:c15::61",
            "2a00:1450:4001:c0f::5e",
            "2a04:4e42::720",
            "172.67.160.211",
            "142.251.152.119",
            "3.167.227.113",
            "172.67.187.184"
        ],
        "asns": [
            "15169",
            "16509",
            "32934",
            "54113",
            "13335"
        ],
        "countries": [
            "US",
            "DE"
        ],
        "link_domains": [
            "www.nzherald.co.nz",
            "www.google.com",
            "www.instagram.com",
            "www.facebook.com",
            "generalstudios.com",
            "www.winecollective.direct"
        ],
        "social": [
            "https://www.instagram.com/alphadomus",
            "https://www.facebook.com/AlphaDomus"
        ],
        "doc_hash": "a9dfd3f077921cbf224e607dba30fe01f6cdacba0160abaf9fa78313b8a7102e",
        "script_hashes": [
            "a4d69f2393da43c8342928ac1041f24c19dc36825e0eaef39feb1c794a2c6409"
        ],
        "globals": [
            "___grecaptcha_cfg",
            "grecaptcha",
            "__recaptcha_api",
            "__google_recaptcha_client",
            "dataLayer",
            "ACR_TOKEN_EXPIRY_SKEW_S",
            "acrJwtIsProvablyExpired",
            "acrCookieValues",
            "acrPurgeExpiredCustomerToken",
            "ACR_AUTH_FRAGMENT_PREFIX",
            "acrConsumeAuthFragment",
            "ACR_PARAMS_STORAGE_KEY",
            "ACR_PARAMS_MAX_AGE_MS",
            "acrSearchHasReferralParams",
            "acrStashParams",
            "acrClearStashedParams",
            "acrReadStashedParams",
            "onWireExtenderLoaded",
            "acrJwtSecondsUntilExpiry",
            "executePostLogin",
            "__acrInitialSearch",
            "__acrEffectiveSearch",
            "google",
            "module$exports$google3$maps$api$javascript$geometry$lat_lng_bounds",
            "module$exports$google3$maps$api$javascript$marker$marker",
            "litHtmlVersions",
            "litElementVersions",
            "reactiveElementVersions",
            "getCookie",
            "hideActiveModal",
            "bannerHeight",
            "initMap",
            "initRecaptcha",
            "loadScript",
            "google_tag_manager",
            "google_tag_data",
            "gtmPageLoadId",
            "fbq",
            "_fbq",
            "_fbq_gtm_ids"
        ],
        "cookies": [
            "__cf_bm",
            "_ga_VZGC0RXR9D",
            "_ga",
            "_fbp"
        ],
        "storage_keys": [
            "localstorage.test",
            "gtmBrowserId",
            "lastExternalReferrer",
            "lastExternalReferrerTime",
            "__sak"
        ],
        "tls": {
            "san": [
                "alphadomus.co.nz",
                "*.alphadomus.co.nz"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "WE1",
            "subject": "alphadomus.co.nz",
            "protocol": "QUIC",
            "valid_to": "2026-12-19T19:58:05Z",
            "valid_from": "2026-09-20T18:58:10Z"
        },
        "domain_age_days": 2925,
        "apex_age_days": 2925,
        "tls_age_days": 20,
        "tls_valid_days": 90,
        "requests": 136,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": -81,
                "malicious": false
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "cloudflare",
            "content-type": "text/html; charset=UTF-8",
            "x-powered-by": "Craft CMS\nSEOmatic",
            "x-frame-options": "SAMEORIGIN",
            "x-content-type-options": "nosniff",
            "referrer-policy": "no-referrer-when-downgrade"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-20T18:45:12Z",
        "uuid": "3e5d5394-de01-486d-a203-e14c8cad2aa9",
        "scanned_at": "2026-10-12T11:52:05Z",
        "final_url": "https://alphadomus.co.nz/",
        "status": 200,
        "history": [
            {
                "url": "https://alphadomus.co.nz/",
                "status": 200
            }
        ],
        "dom_hash": "cb3dae776ac383ad6a03304db21b3cfa3c30b222a8a4d194ef34e49e0dc1861d",
        "doc_hash": "3baecfa10044300e73ec05b9cd668e9041c08120eaeea579f680071c3098b608",
        "domain_risks": [
            "Alcohol",
            "Society & Lifestyle",
            "CIPA Filter",
            "CIPA"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "alphadomus.co.nz",
                "type": "A",
                "value": "172.67.187.184"
            },
            {
                "name": "alphadomus.co.nz",
                "type": "A",
                "value": "104.21.60.19"
            },
            {
                "name": "alphadomus.co.nz",
                "type": "AAAA",
                "value": "2606:4700:3032::6815:3c13"
            },
            {
                "name": "alphadomus.co.nz",
                "type": "AAAA",
                "value": "2606:4700:3030::ac43:bbb8"
            }
        ],
        "dnssec_valid": false,
        "ip": "172.67.187.184",
        "whois": {
            "registrar": "Dreamscape Networks International Pte Ltd t/a Crazy Domains",
            "created": "1997-09-07T12:00:00Z",
            "updated": "2026-09-05T02:56:12Z",
            "nameservers": [
                "dave.ns.cloudflare.com",
                "sara.ns.cloudflare.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-21T02:39:06Z",
        "analysis_at": "2026-10-20T02:00:14Z",
        "stats": {
            "timeout": 0,
            "harmless": 56,
            "malicious": 3,
            "suspicious": 1,
            "undetected": 32
        },
        "detections": {
            "Seclookup": "malicious",
            "Gridinsoft": "malicious",
            "alphaMountain.ai": "suspicious",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "categories": {
            "alphaMountain.ai": "Alcohol, Tobacco (alphaMountain.ai)"
        },
        "popularity": {
            "Alexa": 719304,
            "Statvoo": 719304,
            "Majestic": 961008,
            "Cisco Umbrella": 818302
        },
        "registrar": "Dreamscape Networks International Pte Ltd t/a Crazy Domains",
        "created": "1997-09-07T12:00:00Z",
        "updated": "2026-09-05T02:56:12Z",
        "first_seen": "2023-10-08T00:28:25Z",
        "dns": [
            {
                "ttl": 300,
                "type": "TXT",
                "value": "google-site-verification=Xp9BC_AR2rKzN18RuZNO4-LTfDllTWAfgp3UrS_VeGs"
            },
            {
                "ttl": 300,
                "type": "TXT",
                "value": "google-site-verification=0lUZqIsZrT-lAMTk7SfIq6R3VNHfjqtXBu4_NVbtRMs"
            },
            {
                "ttl": 1800,
                "type": "SOA",
                "rname": "dns.cloudflare.com",
                "value": "dave.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "MX",
                "value": "aspmx.l.google.com",
                "priority": 0
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "dave.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "MX",
                "value": "alt4.aspmx.l.google.com",
                "priority": 30
            },
            {
                "ttl": 300,
                "type": "MX",
                "value": "alt2.aspmx.l.google.com",
                "priority": 20
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "172.67.187.184"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "sara.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "MX",
                "value": "alt3.aspmx.l.google.com",
                "priority": 30
            },
            {
                "ttl": 300,
                "type": "MX",
                "value": "alt1.aspmx.l.google.com",
                "priority": 20
            },
            {
                "ttl": 300,
                "type": "TXT",
                "value": "klaviyo-site-verification=VFm8UG"
            },
            {
                "ttl": 300,
                "type": "TXT",
                "value": "v=spf1 a mx ptr include:_spf.commerce7.com"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3030::ac43:bbb8"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3032::6815:3c13"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "104.21.60.19"
            }
        ],
        "dns_at": "2026-10-20T02:00:27Z",
        "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c",
        "cert": {
            "san": [
                "alphadomus.co.nz",
                "*.alphadomus.co.nz"
            ],
            "issuer": "Google Trust Services / WE1",
            "serial": "4cf590f6f66810aa135d1ae264f64a02",
            "sha256": "0cb9ce293d3958b2a3cfa0e9da90f3bb85d4f573c9ba264626f35bcf8a778d19",
            "subject": "alphadomus.co.nz",
            "valid_to": "2026-12-19T19:58:05Z",
            "valid_from": "2026-09-20T18:58:10Z"
        },
        "whois": {
            "registrar": "Dreamscape Networks International Pte Ltd t/a Crazy Domains",
            "registrar_url": "https://www.crazydomains.com.au/",
            "created": "1997-09-07T12:00:00Z",
            "updated": "2026-09-05T02:56:12Z",
            "status": [
                "ok"
            ],
            "nameservers": [
                "dave.ns.cloudflare.com",
                "sara.ns.cloudflare.com"
            ],
            "dnssec": "unsigned"
        }
    }
}
```