# PhishDestroy domain threat record: gerwaldkronberg.com Content language: English Canonical HTML report: https://phishdestroy.io/domain/gerwaldkronberg.com/ Machine-readable companion: https://phishdestroy.io/domain/gerwaldkronberg.com/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-10-22 13:30:04 UTC - Last availability or vendor check: 2026-10-22 13:30:04 UTC - Stored record updated: 2026-10-22 16:30:27 UTC - VirusTotal detections in the stored snapshot: 1/92 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: no stored flag ## Stored classification - Targeted brand: signal ## Stored infrastructure - Observed IP address: 188.114.97.3 - Registrar in stored WHOIS data: NICENIC INTERNATIONAL GROUP CO., LIMITED - Last stored HTTP status: 200 - Registration date (registry RDAP, gerwaldkronberg.com): 2026-10-12 12:05:17 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a163cd-29d1-7238-a05a-02088aabba88/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/gerwaldkronberg.com - Certificate Transparency search: https://crt.sh/?q=%25.gerwaldkronberg.com - Web Archive lookup: https://web.archive.org/web/*/https://gerwaldkronberg.com/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview PhishDestroy’s intake AI marked the site as malicious because it promotes financial education and a KI‑trading platform that promises daily earnings, a pattern typical of fraudulent investment schemes. The page was first seen by PhishDestroy on 2026-10-22, ten days after the domain was registered on 2026-10-12. The recorded page title and meta description present the service as a trustworthy AI‑trading platform, which contrasts with the risk assessment. How the scam works Fake investment scams present a seemingly legitimate trading service, often using AI buzzwords, and promise high or guaranteed returns. Victims are usually urged to register and fund an account, after which the operators disappear with the deposited funds. Evidence VirusTotal scanned the domain on 2026-10-22 and recorded one suspicious detection (Fortinet labeling it as spam) out of 92 engines. Google Safe Browsing checked on 2026-10-22 and did not flag the site. Spamhaus DBL listed the domain as spam on 2026-10-22, and OTX reported four pulses referencing it on the same day. Cloudflare Radar flagged the domain as phishing and noted new‑domain risk, while urlscan’s engine score of 95 marked it malicious though its overall verdict was non‑malicious. PhishDestroy’s internal blocklist also contains the domain as of 2026-10-22, and the page returned HTTP 200 when fetched on that date. Infrastructure The domain was registered with NICENIC INTERNATIONAL GROUP CO., LIMITED on 2026-10-12 and is protected by Cloudflare’s CDN, resolving to IP 188.114.97.3 (and related Cloudflare addresses). TLS was issued by Let’s Encrypt on 2026-10-12 and is valid until 2027-01-10. What to do Do not enter personal, financial, or login information on the site; if any credentials were submitted, change the associated passwords immediately. Organizations should block gerwaldkronberg.com at the network perimeter and monitor logs for connections to the recorded Cloudflare IPs. Security teams can add the domain to internal blocklists and reference the VirusTotal, Spamhaus, and Cloudflare Radar findings for further investigation. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a163cd-29d1-7238-a05a-02088aabba88/ Cloudflare Radar report: https://radar.cloudflare.com/scan/869e598c-ea57-4dfa-8dc9-faaf6183a37c Stored capture screenshot: https://i.ibb.co/rfH6ct0Z/bcf32b654aa2.png Cloudflare Radar screenshot (2026-10-22T14:03:14Z): https://screenshots.phishdestroy.io/cf/869e598c-ea57-4dfa-8dc9-faaf6183a37c.png URLScan screenshot (2026-10-22T13:20:43Z): https://screenshots.phishdestroy.io/us/01a163c5-3fb4-746c-bf62-cf23ff9242b3.png URLScan capture report: https://urlscan.io/result/01a163c5-3fb4-746c-bf62-cf23ff9242b3/ VirusTotal report: https://www.virustotal.com/gui/domain/gerwaldkronberg.com Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=gerwaldkronberg.com Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-22 14:35:09 UTC ## Stored page captures - Primary capture: https://i.ibb.co/rfH6ct0Z/bcf32b654aa2.png Captured: 2026-10-22 13:30:04 UTC - URLScan capture: https://screenshots.phishdestroy.io/01a163cd-29d1-7238-a05a-02088aabba88.png Captured: 2026-10-22 13:30:04 UTC Source report: https://urlscan.io/result/01a163cd-29d1-7238-a05a-02088aabba88/ - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/869e598c-ea57-4dfa-8dc9-faaf6183a37c.png Captured: 2026-10-22 14:03:14 UTC Source report: https://radar.cloudflare.com/scan/869e598c-ea57-4dfa-8dc9-faaf6183a37c SHA-256: 394adf933c3649e2700359f7684ffe65efc90fc8210ca994d86fa72db3983479 - URLScan · 2026-10-22: https://screenshots.phishdestroy.io/us/01a163c5-3fb4-746c-bf62-cf23ff9242b3.png Captured: 2026-10-22 13:20:43 UTC Source report: https://urlscan.io/result/01a163c5-3fb4-746c-bf62-cf23ff9242b3/ SHA-256: 220a142ae69cd97f86aae985a3dc26708df69230887fc0d3a252f2bff2bd928b ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-22T14:05:43Z", "uuid": "01a163cd-29d1-7238-a05a-02088aabba88", "scanned_at": "2026-10-22T13:29:19Z", "final_url": "https://gerwaldkronberg.com/", "status": 200, "ip": "188.114.96.3", "domains": [ "www.googletagmanager.com", "www.google.com", "ad.doubleclick.net", "region1.google-analytics.com" ], "ips": [ "142.251.110.148", "142.251.151.119", "142.251.127.97", "188.114.96.3" ], "asns": [ "15169", "13335" ], "countries": [ "US" ], "doc_hash": "0475c7d5bbde19bec4eaa97168ae67bdc3c709b99893f9b892d6dbb7d827c2c1", "script_hashes": [ "05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e", "52b7e9d5df3f1dd1675bc8496e5fc41169a004ab97d8470256555b20299c2025", "363771ba66fe85eab0a17cc677e554be6112aa939699f713f282dfeb75e2faf0", "92d8e6f62c4b40bc0732fdbdd07ee4369e115c7f68e81ca9c0828f26ed12f2f5", "91ea6a8b3311a4b0e68300ab475dbed77faba459355bc69cae54476dd58bd868", "7ff411886d3f2c916115f11b37283355f2dca4ee6e2c665b37589b2a793b44b8" ], "globals": [ "username", "password", "dvName", "funnelDefault", "source", "clicker", "dataLayer", "getCookie", "checkAndSendEvent", "$", "jQuery", "intlTelInput", "google_tag_manager", "google_tag_data", "sbjs", "onYouTubeIframeAPIReady", "gaGlobal", "faqItems", "count", "countElement" ], "cookies": [ "4a4e8101", "uclick", "bcid", "_gcl_au", "sbjs_migrations", "sbjs_current_add", "sbjs_first_add", "sbjs_current", "sbjs_first", "sbjs_udata", "sbjs_session", "_ga_SMGWBYRN7X", "_ga" ], "storage_keys": [ "_gcl_ls" ], "tls": { "san": [ "*.gerwaldkronberg.com", "gerwaldkronberg.com" ], "cipher": "AES_128_GCM", "issuer": "YE2", "subject": "gerwaldkronberg.com", "protocol": "QUIC", "valid_to": "2027-01-10T11:08:34Z", "valid_from": "2026-10-12T11:08:35Z" }, "domain_age_days": 8, "apex_age_days": 8, "tls_age_days": 10, "tls_valid_days": 89, "requests": 41, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 95, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "cloudflare", "content-type": "text/html; charset=UTF-8" } }, "cf": { "v": 1, "fetched_at": "2026-10-22T14:05:46Z", "uuid": "869e598c-ea57-4dfa-8dc9-faaf6183a37c", "scanned_at": "2026-10-22T14:03:14Z", "final_url": "https://gerwaldkronberg.com/", "status": 200, "history": [ { "url": "https://gerwaldkronberg.com/", "status": 200 } ], "dom_hash": "c285585e5d452301eaeaf32dd1068f0156b8ebd4916d9c31e3046a195a069f21", "doc_hash": "eb87e123285196311d420afbeb8263f5aafaf5641509e6253789c5e646a6e8e0", "phishing_v2": [ "phishing" ], "domain_risks": [ "Newly Seen Domains", "Security Risks", "New Domains" ], "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "gerwaldkronberg.com", "type": "A", "value": "104.21.79.61" }, { "name": "gerwaldkronberg.com", "type": "A", "value": "172.67.142.139" }, { "name": "gerwaldkronberg.com", "type": "AAAA", "value": "2606:4700:3035::ac43:8e8b" }, { "name": "gerwaldkronberg.com", "type": "AAAA", "value": "2606:4700:3033::6815:4f3d" } ], "dnssec_valid": false, "ip": "104.21.79.61", "whois": { "registrar": "NICENIC INTERNATIONAL GROUP CO., LIMITED", "created": "2026-10-12T12:05:17Z", "updated": "2026-10-12T12:05:18Z", "expires": "2027-10-12T12:05:17Z", "nameservers": [ "connie.ns.cloudflare.com", "tanner.ns.cloudflare.com" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-22T14:33:58Z", "analysis_at": "2026-10-22T13:58:10Z", "stats": { "timeout": 0, "harmless": 53, "malicious": 0, "suspicious": 1, "undetected": 38 }, "detections": { "Fortinet": "spam" }, "reputation": 0, "registrar": "NICENIC INTERNATIONAL GROUP CO., LIMITED", "created": "2026-10-12T12:05:17Z", "expires": "2027-10-12T12:05:17Z", "updated": "2026-10-12T12:05:18Z", "first_seen": "2026-10-12T13:27:20Z", "dns": [ { "ttl": 21600, "type": "NS", "value": "tanner.ns.cloudflare.com" }, { "ttl": 300, "type": "A", "value": "172.67.142.139" }, { "ttl": 1800, "type": "SOA", "rname": "dns.cloudflare.com", "value": "connie.ns.cloudflare.com" }, { "ttl": 300, "type": "AAAA", "value": "2606:4700:3035::ac43:8e8b" }, { "ttl": 3600, "type": "TXT", "value": "google-site-verification=gEvtcXWyiCqJbfGH4YYxYIh_kMbALo6DiIW0tb-qSO8" }, { "ttl": 21600, "type": "NS", "value": "connie.ns.cloudflare.com" }, { "ttl": 300, "type": "AAAA", "value": "2606:4700:3033::6815:4f3d" }, { "ttl": 300, "type": "A", "value": "104.21.79.61" } ], "dns_at": "2026-10-22T14:04:01Z", "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c", "cert": { "san": [ "*.gerwaldkronberg.com", "gerwaldkronberg.com" ], "issuer": "Let's Encrypt / YE2", "serial": "5fd8756621035011581b0e4ba50331061cb", "sha256": "1f88256197481554c929f93c15c0b26f5d6e18d153cb9c522ce90ee0ae49b7a2", "subject": "gerwaldkronberg.com", "valid_to": "2027-01-10T11:08:34Z", "valid_from": "2026-10-12T11:08:35Z" }, "whois": { "registrar": "NICENIC INTERNATIONAL GROUP CO., LIMITED", "registrar_iana_id": "3765", "registrar_url": "https://nicenic.com", "created": "2026-10-12T12:05:17Z", "updated": "2026-10-12T12:05:17Z", "expires": "2027-10-12T12:05:17Z", "status": [ "clientDeleteProhibited", "clientTransferProhibited" ], "nameservers": [ "connie.ns.cloudflare.com", "tanner.ns.cloudflare.com" ], "dnssec": "unsigned" }, "rdap": { "status": [ "client delete prohibited", "client transfer prohibited" ], "events": { "expiration": "2027-10-12T12:05:17Z", "registration": "2026-10-12T12:05:17Z", "registrar expiration": "2027-10-12T12:05:17Z", "last update of RDAP database": "2026-10-12T12:05:17Z" } } }, "webcheck": { "v": 1, "fetched_at": "2026-10-22T13:55:12Z", "mail_config": { "spf_lookups": 0 }, "caa_records": { "domain": "gerwaldkronberg.com" }, "block_lists": { "resolvers": 12, "blocked_count": 0 }, "archives": { "last": "2026-10-22T13:33:02Z", "first": "2026-10-12T15:36:36Z", "changes": 1, "days_archived": 2, "scans_per_day": 0.1, "avg_page_bytes": 14777 }, "social_tags": { "ogUrl": "https://felmirauxqeno.net", "title": "Gerwald Kronberg – Vertrauenswürdige KI-Trading-Plattform", "ogType": "website", "robots": "index, follow", "ogImage": "images/og-image.jpg", "ogTitle": "Gerwald Kronberg™ – Vertrauenswürdige KI-Trading-Plattform", "description": "Erzielen Sie tägliche Einnahmen mit Gerwald Kronberg™ – der KI-Trading-Plattform, die Sie aus dem Fernsehen kennen. Keine Vorkenntnisse nötig. Registrieren Sie sich und legen Sie los.", "ogDescription": "Erzielen Sie tägliche Einnahmen mit Gerwald Kronberg™ – der KI-Trading-Plattform, die Sie aus dem Fernsehen kennen. Keine Vorkenntnisse nötig. Registrieren Sie sich und legen Sie los." }, "trackers": { "requests": 34, "trackers": [ { "name": "Google", "company": "Google", "country": "US", "category": "Advertising", "requests": 2 }, { "name": "Google Marketing Platform", "company": "Google", "country": "US", "category": "Advertising", "requests": 1 }, { "name": "Google Tag", "company": "Google", "country": "US", "category": "Advertising", "requests": 3 }, { "name": "Google Analytics", "company": "Google", "country": "US", "category": "Site Analytics", "requests": 1 }, { "name": "Google Tag Manager", "company": "Google", "country": "US", "category": "Utilities", "requests": 1 } ] }, "mixed_content": { "third_party_scripts": 0 }, "status": { "up": true, "code": 200, "timings": { "dns": 23, "tls": 106, "wait": 217, "connect": 11, "download": 60 }, "response_ms": 417 }, "tls_connection": { "alpn": "h2", "cipher": "TLS_AES_256_GCM_SHA384", "protocol": "TLSv1.3", "versions": [ "TLSv1", "TLSv1.1", "TLSv1.2", "TLSv1.3" ], "authorized": true, "forward_secrecy": true }, "ports": { "open": [ 80, 443, 8080 ] }, "carbon": { "bytes": 175661, "co2_grams": 0.0064, "cleaner_than": 10 }, "dns_server": { "ns": [ { "ip": "162.159.44.97", "host": "tanner.ns.cloudflare.com" }, { "ip": "173.245.58.247", "host": "connie.ns.cloudflare.com" } ], "zone": "gerwaldkronberg.com" }, "cookies": { "cookies": [ { "name": "4a4e8101", "secure": true, "http_only": true, "same_site": "Lax" }, { "name": "uclick", "same_site": "Lax" }, { "name": "bcid", "same_site": "Lax" }, { "name": "_gcl_au" }, { "name": "sbjs_migrations" }, { "name": "sbjs_current_add" }, { "name": "sbjs_first_add" }, { "name": "sbjs_current" }, { "name": "sbjs_first" }, { "name": "sbjs_udata" }, { "name": "sbjs_session" }, { "name": "_ga_SMGWBYRN7X" }, { "name": "_ga" } ] }, "location": { "ip": "2a06:98c1:3121::9", "asn": "13335", "org": "Cloudflare, Inc.", "city": "Washington", "country": "US" }, "ssl": { "issuer": "Let's Encrypt / YE2", "subject": "gerwaldkronberg.com" }, "dns": { "A": [ "188.114.96.9", "188.114.97.9" ], "NS": [ "connie.ns.cloudflare.com", "tanner.ns.cloudflare.com" ], "SOA": "{\"nsname\": \"connie.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2417878208, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}", "TXT": [ "google-site-verification=gEvtcXWyiCqJbfGH4YYxYIh_kMbALo6DiIW0tb-qSO8" ], "AAAA": [ "2a06:98c1:3120::9", "2a06:98c1:3121::9" ] }, "dnssec": { "ds": false, "rrsig": false, "dnskey": false }, "hsts": { "message": "Site does not serve any HSTS headers." }, "http_security": { "xFrameOptions": false, "referrerPolicy": false, "xXSSProtection": false, "permissionsPolicy": false, "xContentTypeOptions": false, "contentSecurityPolicy": false, "strictTransportPolicy": false, "crossOriginOpenerPolicy": false, "crossOriginEmbedderPolicy": false, "crossOriginResourcePolicy": false }, "firewall": { "waf": "Cloudflare", "has_waf": true }, "get_ip": { "ip": "2a06:98c1:3121::9", "family": 6 }, "redirects": { "chain": [ "https://gerwaldkronberg.com" ] }, "tech_stack": { "technologies": [ "Google Tag Manager", "jQuery", "Google Analytics", "Priority Hints", "Cloudflare", "Open Graph", "HTTP/3" ] }, "linked_pages": { "internal_count": 1 }, "whois": { "registrar": "NICENIC INTERNATIONAL GROUP CO., LIMITED", "created": "2026-10-12T12:05:17Z", "updated": "2026-10-12T12:05:18Z", "expires": "2027-10-12T12:05:17Z", "status": [ "clientDeleteProhibited https://icann.org/epp", "clientTransferProhibited https://icann.org/epp" ], "nameservers": [ "connie.ns.cloudflare.com", "tanner.ns.cloudflare.com" ] }, "headers": { "headers": { "server": "cloudflare", "content-type": "text/html; charset=UTF-8" } } } } ```