# PhishDestroy domain threat record: edleokoberg.de

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/edleokoberg.de/
Machine-readable companion: https://phishdestroy.io/domain/edleokoberg.de/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-25 23:32:16 UTC
- Last availability or vendor check: 2026-10-25 23:32:16 UTC
- Stored record updated: 2026-10-26 03:21:43 UTC
- VirusTotal detections in the stored snapshot: 2/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored infrastructure

- Observed IP address: 158.94.210.119
- Registrar in stored WHOIS data: REGISTRAR_NOT_FOUND
- Last stored HTTP status: 200

## Evidence links

- URLScan report: https://urlscan.io/result/01a17566-d0e8-761c-800f-e250c015d2ff/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/edleokoberg.de
- Certificate Transparency search: https://crt.sh/?q=%25.edleokoberg.de
- Web Archive lookup: https://web.archive.org/web/*/https://edleokoberg.de/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
PhishDestroy’s intake AI assessment classified edleokoberg.de as malicious due to its claim of being a “Trusted AI Trading Platform”, a pattern common in fraudulent investment offers. The recorded page title reads “Edle Ökoberg — Adaptive KI-Plattform für Vermögensplanung” and the excerpt shows “Edle Ökoberg – Vertrauenswürdige KI-Handelsplattform”. The domain was first seen by PhishDestroy on 2026-10-26. An HTTP 200 response was recorded on that date.

How the scam works
Fake AI‑investment sites promise automated, high‑return portfolio management powered by artificial intelligence and then solicit deposits, personal data, or login credentials from victims. Because the service is fictitious, any funds or information provided are lost to the operators.

Evidence
VirusTotal scanned the domain on 2026-10-26 and reported two spam detections from Fortinet and Sophos out of 92 engines. Google Safe Browsing checked on the same day and did not flag the URL. urlscan captured the site on 2026-10-25, its machine‑learning engine gave a malicious score of 92 with tags indicating malicious content, but the overall verdict was non‑malicious. OTX recorded zero pulses on 2026-10-26. No external blocklists listed the domain, while PhishDestroy’s internal blocklist marked it as malicious.

Infrastructure
The domain is 161 days old and resolves to IP 158.94.210.119, which belongs to Omegatech LTD in the Netherlands. It uses a Let’s Encrypt certificate valid until 2026-11-26. Nameservers are ns1.dyna-ns.net and ns2.dyna-ns.net, and DNSSEC is not enabled. Open ports observed were 22, 80 and 443.

What to do
Visitors should not submit personal, financial, or login information to the site and should avoid making any deposits. If credentials were entered, change the associated passwords immediately and monitor accounts for unauthorized activity. Defenders can add edleokoberg.de to their blocklists and review server logs for connections to 158.94.210.119. Keep the domain on threat‑intel blocklists for continued monitoring.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a17566-d0e8-761c-800f-e250c015d2ff/
Cloudflare Radar report: https://radar.cloudflare.com/scan/d0e749ef-7c16-4a46-932c-6d7fbb44a6a4
Stored capture screenshot: https://i.ibb.co/DPMvFSz8/498043fcd28c.png
Cloudflare Radar screenshot (2026-10-25T23:34:13Z): https://screenshots.phishdestroy.io/cf/d0e749ef-7c16-4a46-932c-6d7fbb44a6a4.png
VirusTotal report: https://www.virustotal.com/gui/domain/edleokoberg.de
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=edleokoberg.de
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-25 23:35:37 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/DPMvFSz8/498043fcd28c.png
  Captured: 2026-10-25 23:32:16 UTC
- URLScan capture: https://screenshots.phishdestroy.io/01a17566-d0e8-761c-800f-e250c015d2ff.png
  Captured: 2026-10-25 23:32:16 UTC
  Source report: https://urlscan.io/result/01a17566-d0e8-761c-800f-e250c015d2ff/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/d0e749ef-7c16-4a46-932c-6d7fbb44a6a4.png
  Captured: 2026-10-25 23:34:13 UTC
  Source report: https://radar.cloudflare.com/scan/d0e749ef-7c16-4a46-932c-6d7fbb44a6a4
  SHA-256: ddc3f600aa1e7e9b16ef44fdebeec10361dcac78c5756f9500f2e1d8c95857ac
- URLQuery: https://screenshots.phishdestroy.io/uq/04faabb8-ed4f-4c12-a962-e182a4362213.png
  Source report: https://urlquery.net/report/04faabb8-ed4f-4c12-a962-e182a4362213
  SHA-256: 79d04ccfcc6d70cf23d4b49c17b2e9fd77b4bbfc9923628276ee5c1e20acac4f
- URLScan · 2026-10-25: https://screenshots.phishdestroy.io/us/01a17570-976b-744f-bf9d-39537d92e078.png
  Captured: 2026-10-25 23:41:22 UTC
  Source report: https://urlscan.io/result/01a17570-976b-744f-bf9d-39537d92e078/
  SHA-256: 62fd347d8f8c674ec4d5a0b50fc4212d4cb2c78533f8f73dab0e3e54c46147d7

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-25T23:34:28Z",
        "uuid": "01a17566-d0e8-761c-800f-e250c015d2ff",
        "scanned_at": "2026-10-25T23:30:41Z",
        "final_url": "https://edleokoberg.de/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://edleokoberg.de/",
                "from": "http://edleokoberg.de/",
                "status": 307
            }
        ],
        "ip": "158.94.210.119",
        "ips": [
            "158.94.210.119"
        ],
        "asns": [
            "202412"
        ],
        "countries": [
            "NL"
        ],
        "doc_hash": "2ef107a4480324b4f1d24b5e6c66e43f2c8c5ea0e1aeddbfb23d242ef6c378a7",
        "script_hashes": [
            "8aa5f8f647356dcd4fc5dbbe0efd5bc0e8da74026bc61e24636e2e1f5749b0ce"
        ],
        "globals": [
            "__dclq",
            "__dclOrig",
            "__dclFlush",
            "__smsCheckBeforeSubmit",
            "__isSmsEnabled",
            "__isSmsVerified",
            "intlTelInput"
        ],
        "cookies": [
            "connect.sid"
        ],
        "tls": {
            "san": [
                "edleokoberg.de"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "YE1",
            "subject": "edleokoberg.de",
            "protocol": "TLS 1.3",
            "valid_to": "2026-11-26T07:44:50Z",
            "valid_from": "2026-08-28T07:44:51Z"
        },
        "domain_age_days": 161,
        "apex_age_days": 161,
        "tls_age_days": 58,
        "tls_valid_days": 89,
        "requests": 9,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 92,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "content-type": "text/html; charset=utf-8",
            "x-content-type-options": "nosniff",
            "referrer-policy": "same-origin"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-25T23:34:39Z",
        "uuid": "d0e749ef-7c16-4a46-932c-6d7fbb44a6a4",
        "scanned_at": "2026-10-25T23:34:13Z",
        "final_url": "https://edleokoberg.de/",
        "status": 200,
        "history": [
            {
                "url": "https://edleokoberg.de/",
                "status": 200
            }
        ],
        "dom_hash": "b3bf5541a0e5b16fc1973078cd0940985bd6b91e3c02c9324e471e8b106c1241",
        "doc_hash": "07a608c5911a8585c71354a3d6a60d61376861ec279177c1ab45573c7707c9a0",
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "edleokoberg.de",
                "type": "A",
                "value": "158.94.210.119"
            }
        ],
        "dnssec_valid": false,
        "ip": "158.94.210.119",
        "whois": {
            "updated": "2026-08-28T08:31:19Z",
            "nameservers": [
                "ns1.dyna-ns.net",
                "ns2.dyna-ns.net"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-25T23:33:01Z",
        "analysis_at": "2026-10-25T07:13:44Z",
        "stats": {
            "timeout": 0,
            "harmless": 51,
            "malicious": 0,
            "suspicious": 2,
            "undetected": 39
        },
        "detections": {
            "Sophos": "spam",
            "Fortinet": "spam"
        },
        "reputation": 0,
        "categories": {
            "Sophos": "spam urls"
        },
        "first_seen": "2026-05-17T21:38:58Z",
        "dns": [
            {
                "ttl": 300,
                "type": "A",
                "value": "158.94.210.119"
            },
            {
                "ttl": 300,
                "type": "NS",
                "value": "ns2.dyna-ns.net"
            },
            {
                "ttl": 300,
                "type": "SOA",
                "rname": "hostmaster.edleokoberg.de",
                "value": "ns1.dyna-ns.net"
            },
            {
                "ttl": 300,
                "type": "NS",
                "value": "ns1.dyna-ns.net"
            }
        ],
        "dns_at": "2026-10-25T07:15:25Z",
        "jarm": "40d40d40d00000000043d43d00043d6aff5ab0f4fc31897186312c9e639319",
        "cert": {
            "san": [
                "edleokoberg.de"
            ],
            "issuer": "Let's Encrypt / YE1",
            "serial": "61c4a245bf2746811b1ffb3e08dc6e5aecb",
            "sha256": "ec9d4718b9785c108baf4a5ecc7c8d02a36b4096f4fb90ac2d904b6e46c500af",
            "subject": "edleokoberg.de",
            "valid_to": "2026-11-26T07:44:50Z",
            "valid_from": "2026-08-28T07:44:51Z"
        },
        "rdap": {
            "status": [
                "active"
            ],
            "events": {
                "last changed": "2026-08-28T08:31:19Z"
            }
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-25T23:34:56Z",
        "mail_config": {
            "spf_lookups": 0
        },
        "caa_records": {
            "domain": "edleokoberg.de"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_count": 0
        },
        "archives": {
            "last": "2026-10-25T23:34:31Z",
            "first": "2026-10-25T23:34:31Z",
            "changes": 0,
            "days_archived": 1,
            "avg_page_bytes": 21139
        },
        "robots_txt": {
            "agents": [
                "*"
            ],
            "present": true,
            "sitemaps": [
                "https://edleokoberg.de/sitemap.xml"
            ]
        },
        "sitemap": {
            "present": true,
            "url_count": 5
        },
        "social_tags": {
            "title": "Edle Ökoberg — Adaptive KI-Plattform für Vermögensplanung",
            "robots": "index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1",
            "description": "Edle Ökoberg bietet adaptive KI-Analyse, die Marktdaten laufend auswertet und die Anlagestrategie automatisch an die Risikobereitschaft Ihrer Familie anpasst. Erfahren Sie, wie das funktioniert.",
            "canonicalUrl": "https://edleokoberg.de/"
        },
        "trackers": {
            "requests": 22,
            "trackers": [
                {
                    "name": "Cloudflare",
                    "company": "Cloudflare",
                    "country": "US",
                    "category": "Hosting",
                    "requests": 1
                },
                {
                    "name": "jsDelivr",
                    "company": "jsDelivr",
                    "category": "Hosting",
                    "requests": 3
                }
            ]
        },
        "mixed_content": {
            "third_party_scripts": 0
        },
        "status": {
            "up": true,
            "code": 200,
            "timings": {
                "dns": 363,
                "tls": 81,
                "wait": 79,
                "connect": 66,
                "download": 139
            },
            "response_ms": 728
        },
        "tls_connection": {
            "alpn": "h2",
            "cipher": "TLS_AES_128_GCM_SHA256",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                22,
                80,
                443
            ]
        },
        "carbon": {
            "bytes": 73282,
            "co2_grams": 0.0027,
            "cleaner_than": 29
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "162.159.26.92",
                    "host": "ns1.dyna-ns.net"
                },
                {
                    "ip": "162.159.24.5",
                    "host": "ns2.dyna-ns.net"
                }
            ],
            "zone": "edleokoberg.de"
        },
        "cookies": {
            "cookies": [
                {
                    "name": "cf-c",
                    "http_only": true,
                    "same_site": "Lax"
                },
                {
                    "name": "__cf_clicked"
                },
                {
                    "name": "ph_phc_t6w4wzJE2sbz4ro8LmZZTssm5go3KD6mP7QsqcDQRSp6_posthog",
                    "secure": true,
                    "same_site": "Lax"
                }
            ]
        },
        "location": {
            "ip": "158.94.210.119",
            "asn": "202412",
            "org": "Omegatech LTD",
            "city": "Amsterdam",
            "country": "NL"
        },
        "ssl": {
            "issuer": "Let's Encrypt / YE1",
            "subject": "edleokoberg.de"
        },
        "dns": {
            "A": [
                "158.94.210.119"
            ],
            "NS": [
                "ns1.dyna-ns.net",
                "ns2.dyna-ns.net"
            ],
            "SOA": "{\"nsname\": \"ns1.dyna-ns.net\", \"hostmaster\": \"hostmaster.edleokoberg.de\", \"serial\": 2026082801, \"refresh\": 16384, \"retry\": 2048, \"expire\": 1209600, \"minttl\": 300}"
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "hsts": {
            "message": "Site does not serve any HSTS headers."
        },
        "http_security": {
            "xFrameOptions": false,
            "referrerPolicy": "same-origin",
            "xXSSProtection": false,
            "permissionsPolicy": false,
            "xContentTypeOptions": "nosniff",
            "contentSecurityPolicy": false,
            "strictTransportPolicy": false,
            "crossOriginOpenerPolicy": false,
            "crossOriginEmbedderPolicy": false,
            "crossOriginResourcePolicy": false
        },
        "get_ip": {
            "ip": "158.94.210.119",
            "family": 4
        },
        "redirects": {
            "chain": [
                "https://edleokoberg.de"
            ]
        },
        "linked_pages": {
            "internal_count": 9
        },
        "whois": {
            "updated": "2026-08-28T08:31:19Z",
            "status": [
                "connect"
            ],
            "nameservers": [
                "ns1.dyna-ns.net",
                "ns2.dyna-ns.net"
            ]
        },
        "headers": {
            "headers": {
                "content-type": "text/html; charset=utf-8",
                "x-content-type-options": "nosniff",
                "referrer-policy": "same-origin"
            }
        }
    }
}
```