# PhishDestroy domain threat record: grundschule-hofeck.de

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/grundschule-hofeck.de/
Machine-readable companion: https://phishdestroy.io/domain/grundschule-hofeck.de/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-11 12:00:33 UTC
- Last availability or vendor check: 2026-10-22 10:28:39 UTC
- Stored record updated: 2026-10-22 16:07:29 UTC
- VirusTotal detections in the stored snapshot: 11/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: adobe

## Stored infrastructure

- Observed IP address: 85.236.38.11
- Last stored HTTP status: 301

## Evidence links

- URLScan report: https://urlscan.io/result/01a0bc55-cfb0-76ba-a982-eb163474ae64/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/grundschule-hofeck.de
- Certificate Transparency search: https://crt.sh/?q=%25.grundschule-hofeck.de
- Web Archive lookup: https://web.archive.org/web/*/https://grundschule-hofeck.de/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
grundschule-hofeck.de presents itself as "Hofecker Grundschule - TaskCards", a German primary school's page on the TaskCards digital pinboard that schools use to share material with parents and pupils. PhishDestroy classifies it as an impersonation phishing page and first flagged it on 2026-10-11. As of 2026-10-19 the domain was still online and serving content through a redirect.

How the scam works
The page title points to a school notice board, which would interest parents, teachers and pupils, while urlscan.io matched the page to a document lure. Document-lure phishing typically shows what looks like a shared file or class notice and asks the visitor to sign in to open it. Any username and password entered goes to the operator, who can then take over the email or school account and send further lures from it. The page title presents an ordinary school TaskCards board, while our analysis classifies the site as impersonation phishing.

Evidence
On 2026-10-12, 11 of 92 VirusTotal engines flagged the domain, including ESET, Fortinet, Forcepoint ThreatSeeker, Emsisoft, CRDF, alphaMountain.ai, Gridinsoft and MalwareURL. That is a modest share of engines, but the flagging vendors use separate detection methods, and they agree with each other. urlscan.io rated the page malicious. Five AlienVault OTX threat pulses reference it, and PhishDestroy is the only blocklist listing it so far.

Infrastructure
The site runs on InterNetX GmbH's network in Germany, so a .de domain on German hosting adds to the local, school-community feel the page relies on. It uses a free Let's Encrypt certificate. The padlock in the browser only means the connection is encrypted and says nothing about whether the page is legitimate.

What to do
If you entered a password on this page, change it right away, starting with your email account and any school or learning platform logins. Change it anywhere else you reused it, then turn on two-factor authentication and review recent sign-ins and mail forwarding rules. Tell the school through a channel you already know, not through a link in the message that brought you here, so it can warn other parents. Security teams should block the domain and check proxy and mail logs for visits or messages pointing to it. Any users who reached it should be treated as possibly compromised.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a0bc55-cfb0-76ba-a982-eb163474ae64/
VirusTotal report: https://www.virustotal.com/gui/domain/grundschule-hofeck.de
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=grundschule-hofeck.de
Archived copy: https://web.archive.org/web/20260911103726/https://www.grundschule-hofeck.de/
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 09:26:39 UTC

## Stored page captures

- Primary capture: https://urlscan.io/screenshots/01a0bc55-cfb0-76ba-a982-eb163474ae64.png
  Captured: 2026-10-11 12:00:33 UTC
- URLScan capture: https://screenshots.phishdestroy.io/01a0bc55-cfb0-76ba-a982-eb163474ae64.png
  Source report: https://urlscan.io/result/01a0bc55-cfb0-76ba-a982-eb163474ae64/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/cd5f94a8-d4e8-4a8d-a0ec-cd88f262b834.png
  Captured: 2026-10-12 09:49:09 UTC
  Source report: https://radar.cloudflare.com/scan/cd5f94a8-d4e8-4a8d-a0ec-cd88f262b834
  SHA-256: c060832dc9bc585d6328f4242b5aea24afd5f4c4341cfe8be20bef619261be40
- URLScan · 2026-09-19: https://screenshots.phishdestroy.io/us/01a0ba34-edca-73ce-b0ec-dcb37394543c.png
  Captured: 2026-09-19 15:07:11 UTC
  Source report: https://urlscan.io/result/01a0ba34-edca-73ce-b0ec-dcb37394543c/
  SHA-256: d25e9186e062578f6b55cd21d2bf7e25702fd52be4fea3ae6d642c67ae7bf809
- URLScan · 2026-09-23: https://screenshots.phishdestroy.io/us/01a0cf3a-a2eb-714a-b551-f67497b3dfb1.png
  Captured: 2026-09-23 17:05:28 UTC
  Source report: https://urlscan.io/result/01a0cf3a-a2eb-714a-b551-f67497b3dfb1/
  SHA-256: b4bd61e2538738b0b0f2eb3105900b92169519b8dd3f7bb51592b241bae1b586
- URLScan · 2026-09-25: https://screenshots.phishdestroy.io/us/01a0d83a-d490-7755-ac80-28d4b8f51b95.png
  Captured: 2026-09-25 11:02:18 UTC
  Source report: https://urlscan.io/result/01a0d83a-d490-7755-ac80-28d4b8f51b95/
  SHA-256: 5ee17193cc323554c7d005fe4285a5a44506060f9fee395b01ac851505b76aa3
- URLScan · 2026-10-11: https://screenshots.phishdestroy.io/us/01a12ad8-b90f-72ce-a70b-ae010f4ae83c.png
  Captured: 2026-10-11 12:03:39 UTC
  Source report: https://urlscan.io/result/01a12ad8-b90f-72ce-a70b-ae010f4ae83c/
  SHA-256: c871cb705e0869e6bffd5b01267a65174a08057567e350bdd2a29ae9a92fc1f0
- URLScan · 2026-10-21: https://screenshots.phishdestroy.io/us/01a15bfa-0d98-7628-a813-e8ecfab8ffd2.png
  Captured: 2026-10-21 01:01:23 UTC
  Source report: https://urlscan.io/result/01a15bfa-0d98-7628-a813-e8ecfab8ffd2/
  SHA-256: b4bd61e2538738b0b0f2eb3105900b92169519b8dd3f7bb51592b241bae1b586
- URLScan · 2026-10-21: https://screenshots.phishdestroy.io/us/01a15c01-5b64-76f8-91ee-f479627c794b.png
  Captured: 2026-10-21 01:09:22 UTC
  Source report: https://urlscan.io/result/01a15c01-5b64-76f8-91ee-f479627c794b/
  SHA-256: b4bd61e2538738b0b0f2eb3105900b92169519b8dd3f7bb51592b241bae1b586

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-20T17:52:50Z",
        "uuid": "01a0bc55-cfb0-76ba-a982-eb163474ae64",
        "scanned_at": "2026-09-20T01:02:21Z",
        "final_url": "https://www.grundschule-hofeck.de/wlstqgo/tdcesbv/fawcihl/payment/onlinepm.html",
        "status": 200,
        "redirected": "parent-domain",
        "redirects": [
            {
                "to": "https://grundschule-hofeck.de/wlstqgo/tdcesbv/fawcihl/payment/onlinepm.html",
                "from": "http://grundschule-hofeck.de/wlstqgo/tdcesbv/fawcihl/payment/onlinepm.html",
                "status": 307
            },
            {
                "to": "https://www.grundschule-hofeck.de/wlstqgo/tdcesbv/fawcihl/payment/onlinepm.html",
                "from": "https://grundschule-hofeck.de/wlstqgo/tdcesbv/fawcihl/payment/onlinepm.html",
                "status": 301
            }
        ],
        "ip": "85.236.38.11",
        "ptr": "plesk.hof.de",
        "domains": [
            "lametric.com",
            "res-1.cdn.office.net",
            "grundschule-hofeck.de",
            "gyazo.com"
        ],
        "ips": [
            "188.114.97.3",
            "2.20.245.176",
            "85.236.38.11"
        ],
        "asns": [
            "13335",
            "20940",
            "15456"
        ],
        "countries": [
            "DE"
        ],
        "doc_hash": "6e9f4a58673fcc10c4585c1c3dbed78cd3a4a6a7606c6bfb77d40ae86c348bac",
        "globals": [
            "sendToTelegram",
            "attempt",
            "maxAttempts",
            "form",
            "messageDiv",
            "emailInput",
            "passwordInput",
            "TELEGRAM_BOT_TOKEN",
            "TELEGRAM_CHAT_ID"
        ],
        "tls": {
            "san": [
                "grundschule-hofeck.de",
                "www.grundschule-hofeck.de"
            ],
            "cipher": "AES_256_GCM",
            "issuer": "YR1",
            "subject": "grundschule-hofeck.de",
            "protocol": "TLS 1.3",
            "valid_to": "2026-11-28T04:52:01Z",
            "valid_from": "2026-08-30T04:52:02Z"
        },
        "domain_age_days": 2857,
        "apex_age_days": 2857,
        "tls_age_days": 20,
        "tls_valid_days": 89,
        "requests": 5,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 37,
                "malicious": true
            },
            "overall": {
                "tags": [
                    "phishing"
                ],
                "score": 100,
                "brands": [
                    "documentlure"
                ],
                "malicious": true,
                "categories": [
                    "phishing"
                ]
            },
            "urlscan": {
                "tags": [
                    "phishing"
                ],
                "score": 100,
                "brands": [
                    "Document Lure"
                ],
                "malicious": true,
                "categories": [
                    "phishing"
                ]
            }
        },
        "headers": {
            "server": "nginx",
            "content-type": "text/html",
            "x-powered-by": "PleskLin"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-20T18:03:27Z",
        "uuid": "cd5f94a8-d4e8-4a8d-a0ec-cd88f262b834",
        "scanned_at": "2026-10-12T09:49:09Z",
        "final_url": "https://schule-hof.taskcards.app/",
        "status": 200,
        "redirected": "off-domain",
        "history": [
            {
                "url": "https://grundschule-hofeck.de/",
                "status": 301
            },
            {
                "url": "https://schule-hof.taskcards.app/",
                "status": 200
            }
        ],
        "dom_hash": "82d9c460cccefdfd904fdef5a2afa0caa15894496b196f2a142d14185f49e567",
        "doc_hash": "7216605dca33a4d36ce7d17971efaa3ca74ff9bfd31a1ace085209f1ca979f74",
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "schule-hof.taskcards.app",
                "type": "A",
                "value": "135.125.217.140"
            }
        ],
        "dnssec_valid": true,
        "ip": "135.125.217.140"
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-21T00:29:27Z",
        "analysis_at": "2026-10-06T14:05:40Z",
        "stats": {
            "timeout": 0,
            "harmless": 49,
            "malicious": 11,
            "suspicious": 1,
            "undetected": 31
        },
        "detections": {
            "CRDF": "malicious",
            "ESET": "suspicious",
            "VIPRE": "malware",
            "Lionic": "phishing",
            "Emsisoft": "malware",
            "Fortinet": "phishing",
            "SOCRadar": "phishing",
            "URLQuery": "malicious",
            "Gridinsoft": "phishing",
            "MalwareURL": "phishing",
            "alphaMountain.ai": "phishing",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "categories": {
            "alphaMountain.ai": "Phishing (alphaMountain.ai)"
        },
        "popularity": {
            "Alexa": 17384
        },
        "first_seen": "2024-03-04T16:08:53Z",
        "dns": [
            {
                "ttl": 19200,
                "type": "NS",
                "value": "d.ns14.net"
            },
            {
                "ttl": 3600,
                "type": "MX",
                "value": "mail.bayern.de",
                "priority": 10
            },
            {
                "ttl": 3600,
                "type": "TXT",
                "value": "v=spf1 include:bayern.de ip4:176.94.160.18/29 -all"
            },
            {
                "ttl": 3600,
                "type": "A",
                "value": "85.236.38.11"
            },
            {
                "ttl": 19200,
                "type": "NS",
                "value": "a.ns14.net"
            },
            {
                "ttl": 19200,
                "type": "NS",
                "value": "c.ns14.net"
            },
            {
                "ttl": 19200,
                "type": "NS",
                "value": "b.ns14.net"
            },
            {
                "ttl": 21600,
                "type": "SOA",
                "rname": "it.hof.de",
                "value": "a.ns14.net"
            }
        ],
        "dns_at": "2026-10-06T14:27:50Z",
        "jarm": "29d29d15d29d29d21c42d42d000000f32b46bb363c1d114f3d1b5a3cfbaa76",
        "cert": {
            "san": [
                "grundschule-hofeck.de",
                "www.grundschule-hofeck.de"
            ],
            "issuer": "Let's Encrypt / YR2",
            "serial": "596b55d0377ef748a7d4009290f6960cf4f",
            "sha256": "e4a61bd11779445cc17ee8ebd3222d960200e57e25de3c1c54d96d546eba1cf8",
            "subject": "grundschule-hofeck.de",
            "valid_to": "2026-12-20T09:24:32Z",
            "valid_from": "2026-09-21T09:24:33Z"
        },
        "rdap": {
            "status": [
                "active"
            ],
            "events": {
                "last changed": "2026-02-12T12:23:34Z"
            }
        }
    }
}
```