# PhishDestroy domain threat record: felszinsgrund.click

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/felszinsgrund.click/
Machine-readable companion: https://phishdestroy.io/domain/felszinsgrund.click/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: unknown
- First observed by PhishDestroy: 2026-10-26 20:42:14 UTC
- Stored record updated: 2026-10-26 21:10:49 UTC
- VirusTotal detections in the stored snapshot: 16/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored infrastructure

- Observed IP address: 188.114.97.1
- Registrar in stored WHOIS data: NETIM SARL
- Registration date in stored WHOIS data: 2026-07-27 05:55:22 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/019fd60e-ceb2-74bd-9776-cf54baaad3a2/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/felszinsgrund.click
- Certificate Transparency search: https://crt.sh/?q=%25.felszinsgrund.click
- Web Archive lookup: https://web.archive.org/web/*/https://felszinsgrund.click/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
PhishDestroy added felszinsgrund.click to its internal blocklist because several security engines flagged the domain as malicious. The page that was fetched on 2026-10-26 returned HTTP 200 and carried the title “Fels Zinsgrund | AI Trading Platform | Official App”. The domain was first seen by PhishDestroy on 2026-10-26, 91 days after its registration on 2026-07-27.

How the scam works
Listings such as this rely on aggregated detections that often target phishing, malware distribution, or fraudulent trading fronts. In general, attackers host pages that imitate legitimate services to trick users into disclosing credentials, installing malware, or performing financial transactions. No specific mechanism was observed on this page, so the risk remains the possibility of credential harvesting or malware delivery typical of suspicious crypto‑related sites.

Evidence
VirusTotal (2026-10-26) reported 13 malicious and 3 suspicious detections from 92 engines, with vendors including BitDefender, Fortinet and Kaspersky labeling it phishing. Google Safe Browsing (2026-10-26) did not flag the URL. urlscan.io (captured 2026-08-06) gave an overall clean verdict but its engine score was 99 % malicious. Cloudflare Radar (2026-10-26) marked the domain malicious under the “malware” category. OTX listed one pulse on 2026-10-26. PhishDestroy’s internal list shows the domain as blocked, while external blocklists returned zero matches on the same day.

Infrastructure
The domain was registered with NETIM SARL on 2026-07-27 and expires on 2027-07-27. It uses Cloudflare nameservers (ruth.ns.cloudflare.com, vern.ns.cloudflare.com) and resolves to Cloudflare‑served IPs (e.g., 188.114.97.1, 104.21.1.243). TLS was issued by Google Trust Services, valid from 2026-09-29 to 2026-12-28. No further infrastructure details are available.

What to do
Do not submit credentials, personal data, or download files from this site; if you have already done so, change passwords on affected accounts and monitor for unauthorized activity. Network defenders should block felszinsgrund.click and its resolved IPs at the firewall or DNS level and review logs for any connections. Share the indicator with threat‑intel platforms to aid broader detection.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/019fd60e-ceb2-74bd-9776-cf54baaad3a2/
Cloudflare Radar report: https://radar.cloudflare.com/scan/e43608f2-d82b-4ca7-a7d8-266a34ef29a0
Stored capture screenshot: https://urlscan.io/screenshots/019fd60e-ceb2-74bd-9776-cf54baaad3a2.png
Cloudflare Radar screenshot (2026-10-26T20:44:38Z): https://screenshots.phishdestroy.io/cf/e43608f2-d82b-4ca7-a7d8-266a34ef29a0.png
URLScan screenshot (2026-08-05T12:45:44Z): https://screenshots.phishdestroy.io/us/019fd1f5-392f-73f8-a6c2-cd0adf2ca5f8.png
URLScan capture report: https://urlscan.io/result/019fd1f5-392f-73f8-a6c2-cd0adf2ca5f8/
URLScan screenshot (2026-10-26T20:47:55Z): https://screenshots.phishdestroy.io/us/01a179f8-1694-777d-9529-97ed44cf63b2.png
URLScan capture report: https://urlscan.io/result/01a179f8-1694-777d-9529-97ed44cf63b2/
VirusTotal report: https://www.virustotal.com/gui/domain/felszinsgrund.click
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=felszinsgrund.click
Archived copy: https://web.archive.org/web/20261026204320/https://felszinsgrund.click/
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-26 20:48:23 UTC

## Stored page captures

- Primary capture: https://urlscan.io/screenshots/019fd60e-ceb2-74bd-9776-cf54baaad3a2.png
  Captured: 2026-10-26 20:42:14 UTC
- URLScan capture 1: https://screenshots.phishdestroy.io/019fd60e-ceb2-74bd-9776-cf54baaad3a2.png
  Source report: https://urlscan.io/result/019fd60e-ceb2-74bd-9776-cf54baaad3a2/
- URLScan · 2026-08-05: https://screenshots.phishdestroy.io/us/019fd1f5-392f-73f8-a6c2-cd0adf2ca5f8.png
  Captured: 2026-08-05 12:45:44 UTC
  Source report: https://urlscan.io/result/019fd1f5-392f-73f8-a6c2-cd0adf2ca5f8/
  SHA-256: 54eaa3a0bba38fd528dfb74343bd5637e9af5b4dc72a6ce91921fd2623b586d1
- URLScan · 2026-10-26: https://screenshots.phishdestroy.io/us/01a179f8-1694-777d-9529-97ed44cf63b2.png
  Captured: 2026-10-26 20:47:55 UTC
  Source report: https://urlscan.io/result/01a179f8-1694-777d-9529-97ed44cf63b2/
  SHA-256: b48712953b4cf8f8f5a8f1a03b83b388c6c140fd21b74bcf7dc8c5d1efc571c1
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/e43608f2-d82b-4ca7-a7d8-266a34ef29a0.png
  Captured: 2026-10-26 20:44:38 UTC
  Source report: https://radar.cloudflare.com/scan/e43608f2-d82b-4ca7-a7d8-266a34ef29a0
  SHA-256: 2d9b43d510520301caf01d09c96e19413250e99231021e775bee88983d181c6d

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-26T20:47:19Z",
        "uuid": "019fd60e-ceb2-74bd-9776-cf54baaad3a2",
        "scanned_at": "2026-08-06T07:52:08Z",
        "final_url": "https://felszinsgrund.click/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://felszinsgrund.click/",
                "from": "http://felszinsgrund.click/",
                "status": 307
            }
        ],
        "ip": "188.114.97.3",
        "domains": [
            "cdnjs.cloudflare.com",
            "cdn.jsdelivr.net",
            "fonts.googleapis.com",
            "static.cloudflare.com"
        ],
        "ips": [
            "151.101.65.229",
            "142.250.154.95",
            "104.17.25.14",
            "188.114.97.3"
        ],
        "asns": [
            "54113",
            "15169",
            "13335"
        ],
        "countries": [
            "US"
        ],
        "doc_hash": "a81c54278f873ddb49aff336616e1c1d9562dc5cf4ea01900dbecf637dee9f55",
        "script_hashes": [
            "ccf00d1923b0131a10e0c6d26f95e5dee6ebf8621a27e83c5a2f68a2e0093142"
        ],
        "globals": [
            "LANG_MSGS",
            "ClientJS",
            "_d9jdd6z",
            "toggleTermsPopup",
            "__cfQR",
            "__cfRLUnblockHandlers",
            "__lgT0"
        ],
        "cookies": [
            "entry_url"
        ],
        "tls": {
            "san": [
                "felszinsgrund.click"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "WE1",
            "subject": "felszinsgrund.click",
            "protocol": "QUIC",
            "valid_to": "2026-10-30T11:31:19Z",
            "valid_from": "2026-08-01T10:31:24Z"
        },
        "domain_age_days": 9,
        "apex_age_days": 9,
        "tls_age_days": 4,
        "tls_valid_days": 90,
        "requests": 17,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 99,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "cloudflare",
            "content-type": "text/html; charset=utf-8",
            "strict-transport-security": "max-age=31536000; includeSubDomains; preload",
            "content-security-policy": "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://static.cloudflare.com https://cdn.jsdelivr.net; frame-ancestors 'self'; img-src 'self' data: blob:; font-src 'self' https://",
            "x-frame-options": "SAMEORIGIN",
            "x-content-type-options": "nosniff",
            "referrer-policy": "strict-origin",
            "permissions-policy": "camera=(), microphone=(), geolocation=()",
            "cross-origin-opener-policy": "same-origin"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-26T20:47:20Z",
        "uuid": "e43608f2-d82b-4ca7-a7d8-266a34ef29a0",
        "scanned_at": "2026-10-26T20:44:38Z",
        "final_url": "https://felszinsgrund.click/",
        "status": 200,
        "history": [
            {
                "url": "https://felszinsgrund.click/",
                "status": 200
            }
        ],
        "dom_hash": "36a08c52a3e6dc017832225aa258765690a13fa904f187ed5f93b5f1d07e013b",
        "doc_hash": "1821a6c360ab8e3012ffabc7f7783dc9d0e53c2ed753a84200d5bc0abe2fef1e",
        "phishing_v2": [
            "phishing"
        ],
        "domain_risks": [
            "Malware",
            "Security threats",
            "CIPA Filter",
            "CIPA"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "felszinsgrund.click",
                "type": "A",
                "value": "104.21.1.243"
            },
            {
                "name": "felszinsgrund.click",
                "type": "A",
                "value": "172.67.152.155"
            },
            {
                "name": "felszinsgrund.click",
                "type": "AAAA",
                "value": "2606:4700:3033::6815:1f3"
            },
            {
                "name": "felszinsgrund.click",
                "type": "AAAA",
                "value": "2606:4700:3034::ac43:989b"
            }
        ],
        "dnssec_valid": false,
        "ip": "104.21.1.243",
        "verdict": {
            "tags": [
                "malware"
            ],
            "malicious": true,
            "categories": [
                "malware"
            ]
        },
        "whois": {
            "registrar": "NETIM SARL",
            "created": "2026-07-27T07:55:22Z",
            "updated": "2026-08-01T07:55:55Z",
            "expires": "2027-07-27T07:55:22Z",
            "nameservers": [
                "ruth.ns.cloudflare.com",
                "vern.ns.cloudflare.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-26T20:43:37Z",
        "analysis_at": "2026-10-26T13:07:23Z",
        "stats": {
            "timeout": 0,
            "harmless": 44,
            "malicious": 13,
            "suspicious": 3,
            "undetected": 32
        },
        "detections": {
            "CRDF": "malicious",
            "DNS8": "suspicious",
            "ESET": "suspicious",
            "VIPRE": "phishing",
            "G-Data": "phishing",
            "Lionic": "phishing",
            "Sophos": "phishing",
            "CyRadar": "phishing",
            "Fortinet": "phishing",
            "SOCRadar": "phishing",
            "Kaspersky": "phishing",
            "Seclookup": "malicious",
            "Gridinsoft": "suspicious",
            "BitDefender": "phishing",
            "alphaMountain.ai": "phishing",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "registrar": "NETIM SARL",
        "created": "2026-07-27T07:55:22Z",
        "expires": "2027-07-27T07:55:22Z",
        "updated": "2026-08-01T07:55:55Z",
        "first_seen": "2026-07-27T11:59:05Z",
        "dns": [
            {
                "ttl": 1800,
                "type": "SOA",
                "rname": "dns.cloudflare.com",
                "value": "ruth.ns.cloudflare.com"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "ruth.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "172.67.152.155"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3033::6815:1f3"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3034::ac43:989b"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "104.21.1.243"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "vern.ns.cloudflare.com"
            }
        ],
        "dns_at": "2026-10-26T13:14:54Z",
        "jarm": "27d40d40d00040d00042d43d00041df04c41293ba84f6efe3a613b22f983e6",
        "cert": {
            "san": [
                "felszinsgrund.click"
            ],
            "issuer": "Google Trust Services / WE1",
            "serial": "50f28d9909ac72b513f020935d4498e3",
            "sha256": "166a5f7aa7d499812f3eadb73ecbf5b1a62b427d7f59313225e921c35ac6ca85",
            "subject": "felszinsgrund.click",
            "valid_to": "2026-12-28T05:34:41Z",
            "valid_from": "2026-09-29T04:34:44Z"
        },
        "whois": {
            "registrar": "NETIM SARL",
            "registrar_iana_id": "1519",
            "registrar_url": "www.netim.com",
            "created": "2026-07-27T07:55:22Z",
            "updated": "2026-08-01T07:55:55Z",
            "expires": "2027-07-27T07:55:22Z",
            "status": [
                "clientTransferProhibited"
            ],
            "nameservers": [
                "ruth.ns.cloudflare.com",
                "vern.ns.cloudflare.com"
            ],
            "dnssec": "unsigned"
        },
        "rdap": {
            "status": [
                "active",
                "client transfer prohibited"
            ],
            "events": {
                "expiration": "2027-07-27T21:00:00Z",
                "last changed": "2026-07-27T09:55:18Z",
                "registration": "2026-07-27T00:00:00Z",
                "registrar expiration": "2027-07-27T21:00:00Z",
                "last update of RDAP database": "2026-10-26T14:14:53Z"
            }
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-26T20:48:02Z",
        "mail_config": {
            "spf_lookups": 0
        },
        "caa_records": {
            "domain": "felszinsgrund.click"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_by": [
                "CloudFlare Family"
            ],
            "blocked_count": 1
        },
        "trackers": {
            "requests": 18,
            "trackers": [
                {
                    "name": "Cloudflare",
                    "company": "Cloudflare",
                    "country": "US",
                    "category": "Hosting",
                    "requests": 8
                },
                {
                    "name": "Google Fonts",
                    "company": "Google",
                    "country": "US",
                    "category": "Hosting",
                    "requests": 1
                },
                {
                    "name": "jsDelivr",
                    "company": "jsDelivr",
                    "category": "Hosting",
                    "requests": 1
                }
            ]
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "108.162.192.143",
                    "host": "ruth.ns.cloudflare.com"
                },
                {
                    "ip": "172.64.33.243",
                    "host": "vern.ns.cloudflare.com"
                }
            ],
            "zone": "felszinsgrund.click"
        },
        "dns": {
            "A": [
                "188.114.97.3",
                "188.114.96.3"
            ],
            "NS": [
                "ruth.ns.cloudflare.com",
                "vern.ns.cloudflare.com"
            ],
            "SOA": "{\"nsname\": \"ruth.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2418085957, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}",
            "AAAA": [
                "2a06:98c1:3120::3",
                "2a06:98c1:3121::3"
            ]
        },
        "tech_stack": {
            "technologies": [
                "jsDelivr",
                "Cloudflare Turnstile",
                "Cloudflare Rocket Loader",
                "ClientJS",
                "Priority Hints",
                "Google Font API",
                "Font Awesome",
                "cdnjs",
                "HSTS",
                "Cloudflare",
                "Open Graph",
                "HTTP/3"
            ]
        }
    }
}
```