# PhishDestroy domain threat record: hafenzinsstein.digital

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/hafenzinsstein.digital/
Machine-readable companion: https://phishdestroy.io/domain/hafenzinsstein.digital/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-28 02:12:43 UTC
- Last availability or vendor check: 2026-10-28 11:00:25 UTC
- Stored record updated: 2026-10-28 11:23:05 UTC
- VirusTotal detections in the stored snapshot: 18/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored infrastructure

- Observed IP address: 188.114.96.1
- Registrar in stored WHOIS data: Spaceship, Inc.
- Last stored HTTP status: 200
- Registration date in stored WHOIS data: 2026-07-27 05:32:30 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/019fd60f-b9ea-77db-917e-303215fdb917/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/hafenzinsstein.digital
- Certificate Transparency search: https://crt.sh/?q=%25.hafenzinsstein.digital
- Web Archive lookup: https://web.archive.org/web/*/https://hafenzinsstein.digital/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
PhishDestroy added hafenzinsstein.digital to its internal blocklist on 2026-10-28 after the intake flagged it for a high number of malicious detections. The recorded page title reads “Hafen Zinsstein | AI Trading Platform | Official Platform”. An HTTP 200 response was observed on 2026-10-28, indicating the site was reachable at that time. The domain was registered on 2026-07-27 through Spaceship, Inc.

How the scam works
The listing does not confirm a particular fraud technique; the high malicious score suggests the site could be used to lure visitors into credential phishing or to deliver malware. The page advertises an AI‑driven trading service, a common lure for fake‑exchange scams that ask users to deposit funds or reveal private keys, but no such behavior was captured in the scans.

Evidence
VirusTotal scanned the domain on 2026-10-28 and returned 15 malicious and 3 suspicious detections from 92 engines. Google Safe Browsing checked on 2026-10-28 and did not flag the URL. urlscan.io captured the site on 2026-08-06; its overall verdict was clean but its engine scoring marked it malicious with a score of 99. Cloudflare Radar scanned on 2026-10-28 and classified the domain as malicious, labeling it under malware and phishing categories. OTX listed three pulses referencing the domain as of 2026-10-28. PhishDestroy’s internal blocklist marked the domain as malicious on 2026-10-28, while external blocklists showed no entries.

Infrastructure
The domain was created on 2026-07-27 via the registrar Spaceship, Inc. It is served through Cloudflare’s CDN, with recorded IPv4 addresses 188.114.96.1 and 188.114.97.3 and IPv6 addresses 2606:4700::6811:d005 and 2606:4700:3031::6815:3fa. The network is identified as CloudFLARENET‑EU and resolves to AS13335 (Cloudflare) located in Great Britain. The TLS certificate, issued by Google Trust Services, is valid from 2026-07-27 to 2026-10-25.

What to do
Visitors should not submit credentials, personal data, or download files from the site; if they have already done so, they should change any affected passwords and watch accounts for unusual activity. Security teams should block hafenzinsstein.digital at the perimeter, review network logs for connections to the recorded Cloudflare IPs, and keep the domain under observation for future intelligence updates.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/019fd60f-b9ea-77db-917e-303215fdb917/
Cloudflare Radar report: https://radar.cloudflare.com/scan/e0695fe7-95d5-4ddd-9e2f-0bfb55efaaa9
Stored capture screenshot: https://urlscan.io/screenshots/019fd60f-b9ea-77db-917e-303215fdb917.png
Cloudflare Radar screenshot (2026-10-28T02:20:58Z): https://screenshots.phishdestroy.io/cf/e0695fe7-95d5-4ddd-9e2f-0bfb55efaaa9.png
URLScan screenshot (2026-08-05T12:30:19Z): https://screenshots.phishdestroy.io/us/019fd1e7-215e-7003-873b-69714e45e211.png
URLScan capture report: https://urlscan.io/result/019fd1e7-215e-7003-873b-69714e45e211/
URLScan screenshot (2026-10-28T02:27:29Z): https://screenshots.phishdestroy.io/us/01a18055-53cf-71b8-a0f8-18345f0c99dc.png
URLScan capture report: https://urlscan.io/result/01a18055-53cf-71b8-a0f8-18345f0c99dc/
VirusTotal report: https://www.virustotal.com/gui/domain/hafenzinsstein.digital
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=hafenzinsstein.digital
Archived copy: https://web.archive.org/web/20261028021523/https://hafenzinsstein.digital/
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-28 02:55:53 UTC

## Stored page captures

- Primary capture: https://urlscan.io/screenshots/019fd60f-b9ea-77db-917e-303215fdb917.png
  Captured: 2026-10-28 02:12:43 UTC
- URLScan capture 1: https://screenshots.phishdestroy.io/019fd60f-b9ea-77db-917e-303215fdb917.png
  Captured: 2026-10-28 04:31:00 UTC
  Source report: https://urlscan.io/result/019fd60f-b9ea-77db-917e-303215fdb917/
- URLScan · 2026-08-05: https://screenshots.phishdestroy.io/us/019fd1e7-215e-7003-873b-69714e45e211.png
  Captured: 2026-08-05 12:30:19 UTC
  Source report: https://urlscan.io/result/019fd1e7-215e-7003-873b-69714e45e211/
  SHA-256: 291d9f9e0f122ff489a8a8c2b3f61ac92451390ac9c2d0dfd681326c759abf70
- URLScan · 2026-10-28: https://screenshots.phishdestroy.io/us/01a18055-53cf-71b8-a0f8-18345f0c99dc.png
  Captured: 2026-10-28 02:27:29 UTC
  Source report: https://urlscan.io/result/01a18055-53cf-71b8-a0f8-18345f0c99dc/
  SHA-256: c6155d7f70777862052393230d08175ba586bf36787593b346a09d1d0f8819bb
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/e0695fe7-95d5-4ddd-9e2f-0bfb55efaaa9.png
  Captured: 2026-10-28 02:20:58 UTC
  Source report: https://radar.cloudflare.com/scan/e0695fe7-95d5-4ddd-9e2f-0bfb55efaaa9
  SHA-256: d7c890a8e58a07c290c9fd443c8d3475edf4f51a41ca15c891f49b042cb1328d

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-28T02:28:06Z",
        "uuid": "019fd60f-b9ea-77db-917e-303215fdb917",
        "scanned_at": "2026-08-06T07:53:08Z",
        "final_url": "https://hafenzinsstein.digital/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://hafenzinsstein.digital/",
                "from": "http://hafenzinsstein.digital/",
                "status": 307
            }
        ],
        "ip": "188.114.97.3",
        "domains": [
            "cdnjs.cloudflare.com",
            "cdn.jsdelivr.net",
            "fonts.googleapis.com",
            "static.cloudflare.com"
        ],
        "ips": [
            "2606:4700::6811:d005",
            "2a00:1450:4001:c13::5f",
            "104.17.24.14",
            "188.114.97.3"
        ],
        "asns": [
            "13335",
            "15169"
        ],
        "countries": [
            "DE"
        ],
        "doc_hash": "083767c873f39616b8dfd28c09f32b37077c3a6fafa1bb3cd0c826158dda3586",
        "script_hashes": [
            "ccf00d1923b0131a10e0c6d26f95e5dee6ebf8621a27e83c5a2f68a2e0093142"
        ],
        "globals": [
            "LANG_MSGS",
            "ClientJS",
            "_j57s0",
            "toggleTermsPopup",
            "__cfQR",
            "__cfRLUnblockHandlers",
            "__lgT0"
        ],
        "cookies": [
            "entry_url"
        ],
        "tls": {
            "san": [
                "hafenzinsstein.digital"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "WE1",
            "subject": "hafenzinsstein.digital",
            "protocol": "QUIC",
            "valid_to": "2026-10-25T09:53:20Z",
            "valid_from": "2026-07-27T08:53:29Z"
        },
        "domain_age_days": 9,
        "apex_age_days": 9,
        "tls_age_days": 9,
        "tls_valid_days": 90,
        "requests": 17,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 99,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "cloudflare",
            "content-type": "text/html; charset=utf-8",
            "strict-transport-security": "max-age=15552000; includeSubDomains; preload",
            "content-security-policy": "font-src 'self' https://fonts.gstatic.com https://cdnjs.cloudflare.com; default-src 'self'; connect-src 'self' https://cloudflareinsights.com; img-src 'self' data: blob:; style-src 'self' 'unsafe-inli",
            "x-frame-options": "SAMEORIGIN",
            "x-content-type-options": "nosniff",
            "referrer-policy": "no-referrer-when-downgrade",
            "permissions-policy": "camera=(), microphone=(), geolocation=()",
            "cross-origin-opener-policy": "same-origin"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-28T02:28:11Z",
        "uuid": "e0695fe7-95d5-4ddd-9e2f-0bfb55efaaa9",
        "scanned_at": "2026-10-28T02:20:58Z",
        "final_url": "https://hafenzinsstein.digital/",
        "status": 200,
        "history": [
            {
                "url": "https://hafenzinsstein.digital/",
                "status": 200
            }
        ],
        "dom_hash": "112beb5d63b8c292de1f100b066c14c8238da870ecb36a4c545a1342c1a80cff",
        "doc_hash": "223d394dd5ca390374b5d10292ec6e1f2d7b2da525beaf4e2d5574271caf16f8",
        "phishing_v2": [
            "phishing"
        ],
        "domain_risks": [
            "Malware",
            "Security threats",
            "CIPA Filter",
            "CIPA"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "hafenzinsstein.digital",
                "type": "A",
                "value": "172.67.131.99"
            },
            {
                "name": "hafenzinsstein.digital",
                "type": "A",
                "value": "104.21.3.250"
            },
            {
                "name": "hafenzinsstein.digital",
                "type": "AAAA",
                "value": "2606:4700:3031::6815:3fa"
            },
            {
                "name": "hafenzinsstein.digital",
                "type": "AAAA",
                "value": "2606:4700:3037::ac43:8363"
            }
        ],
        "dnssec_valid": false,
        "ip": "127.0.1.6",
        "verdict": {
            "tags": [
                "malware"
            ],
            "malicious": true,
            "categories": [
                "malware"
            ]
        },
        "whois": {
            "registrar": "Spaceship, Inc.",
            "created": "2026-07-27T07:32:30Z",
            "updated": "2026-08-12T02:29:33Z",
            "expires": "2027-07-27T07:32:30Z",
            "nameservers": [
                "tani.ns.cloudflare.com",
                "leland.ns.cloudflare.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-28T02:52:26Z",
        "analysis_at": "2026-10-25T12:26:10Z",
        "stats": {
            "timeout": 0,
            "harmless": 43,
            "malicious": 15,
            "suspicious": 3,
            "undetected": 31
        },
        "detections": {
            "Bkav": "malicious",
            "CRDF": "malicious",
            "DNS8": "suspicious",
            "ESET": "suspicious",
            "VIPRE": "phishing",
            "G-Data": "phishing",
            "Lionic": "phishing",
            "Sophos": "phishing",
            "CyRadar": "phishing",
            "Fortinet": "phishing",
            "SOCRadar": "phishing",
            "Kaspersky": "phishing",
            "Seclookup": "malicious",
            "Gridinsoft": "suspicious",
            "BitDefender": "phishing",
            "Chong Lua Dao": "malicious",
            "alphaMountain.ai": "phishing",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "categories": {
            "alphaMountain.ai": "Phishing (alphaMountain.ai)"
        },
        "first_seen": "2026-07-27T10:20:36Z",
        "dns": [
            {
                "ttl": 21600,
                "type": "NS",
                "value": "leland.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "172.67.131.99"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3037::ac43:8363"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "tani.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3031::6815:3fa"
            },
            {
                "ttl": 1800,
                "type": "SOA",
                "rname": "dns.cloudflare.com",
                "value": "leland.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "104.21.3.250"
            }
        ],
        "dns_at": "2026-10-25T12:31:41Z",
        "jarm": "27d40d40d00040d00042d43d00041df04c41293ba84f6efe3a613b22f983e6",
        "cert": {
            "san": [
                "hafenzinsstein.digital"
            ],
            "issuer": "Google Trust Services / WE1",
            "serial": "265b6a8ac54331020eff1d6e4ff7718f",
            "sha256": "ff418a2fa21890a4bafc23a54411dc2cd86d61a738aa90b892fd7ae70aa1b158",
            "subject": "hafenzinsstein.digital",
            "valid_to": "2026-12-23T11:32:21Z",
            "valid_from": "2026-09-24T10:32:23Z"
        },
        "rdap": {
            "status": [
                "client transfer prohibited"
            ],
            "events": {
                "last changed": "2026-08-23T09:06:42Z",
                "registration": "2026-07-27T07:32:30Z",
                "registrar expiration": "2027-07-27T07:32:30Z",
                "last update of RDAP database": "2026-10-20T13:02:31Z"
            },
            "registrar": "Spaceship, Inc.",
            "registrar_iana_id": "3862"
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-28T02:27:00Z",
        "mail_config": {
            "spf_lookups": 0
        },
        "caa_records": {
            "domain": "hafenzinsstein.digital"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_by": [
                "CloudFlare Family"
            ],
            "blocked_count": 1
        },
        "archives": {
            "last": "2026-10-28T02:15:23Z",
            "first": "2026-10-28T02:15:23Z",
            "changes": 0,
            "days_archived": 1,
            "avg_page_bytes": 41214
        },
        "robots_txt": {
            "agents": [
                "*"
            ],
            "present": true,
            "sitemaps": [
                "https://hafenzinsstein.digital/sitemap.xml"
            ]
        },
        "sitemap": {
            "present": true,
            "url_count": 140
        },
        "social_tags": {
            "ogUrl": "https://hafenzinsstein.digital/",
            "title": "Hafen Zinsstein | AI Trading Platform | Official Platform",
            "ogType": "website",
            "robots": "index, follow",
            "ogTitle": "Hafen Zinsstein | Premium AI Trading Intelligence",
            "ogSiteName": "Hafen Zinsstein",
            "themeColor": "#121212",
            "description": "Hafen Zinsstein delivers advanced AI-driven trading guidance, automated bot workflows, risk governance, and streamlined market operations for modern digital asset participants.",
            "twitterCard": "summary",
            "canonicalUrl": "https://hafenzinsstein.digital/",
            "ogDescription": "Hafen Zinsstein delivers advanced AI-driven trading guidance, automated bot workflows, risk governance, and streamlined market operations for modern digital asset participants."
        },
        "trackers": {
            "requests": 18,
            "trackers": [
                {
                    "name": "Cloudflare",
                    "company": "Cloudflare",
                    "country": "US",
                    "category": "Hosting",
                    "requests": 8
                },
                {
                    "name": "Google Fonts",
                    "company": "Google",
                    "country": "US",
                    "category": "Hosting",
                    "requests": 1
                },
                {
                    "name": "jsDelivr",
                    "company": "jsDelivr",
                    "category": "Hosting",
                    "requests": 1
                }
            ]
        },
        "mixed_content": {
            "no_sri": [
                "https://static.cloudflare.com/beacon.min.js",
                "https://challenges.cloudflare.com/turnstile/v0/api.js",
                "https://cdn.jsdelivr.net/npm/clientjs@0.2.1/dist/client.min.js"
            ],
            "third_party_scripts": 3
        },
        "status": {
            "up": true,
            "code": 200,
            "timings": {
                "dns": 2,
                "tls": 20,
                "wait": 140,
                "connect": 18,
                "download": 14
            },
            "response_ms": 194
        },
        "tls_connection": {
            "alpn": "h2",
            "cipher": "TLS_AES_256_GCM_SHA384",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                80,
                443,
                8080
            ]
        },
        "carbon": {
            "bytes": 134208,
            "co2_grams": 0.0049,
            "cleaner_than": 16
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "108.162.192.224",
                    "host": "tani.ns.cloudflare.com"
                },
                {
                    "ip": "108.162.195.8",
                    "host": "leland.ns.cloudflare.com"
                }
            ],
            "zone": "hafenzinsstein.digital"
        },
        "cookies": {
            "cookies": [
                {
                    "name": "entry_url",
                    "secure": true,
                    "same_site": "Lax"
                }
            ]
        },
        "location": {
            "ip": "2a06:98c1:3120::3",
            "asn": "13335",
            "org": "CloudFLARENET-EU",
            "city": "London",
            "country": "GB"
        },
        "ssl": {
            "issuer": "Google Trust Services / WE1",
            "subject": "hafenzinsstein.digital"
        },
        "dns": {
            "A": [
                "188.114.96.3",
                "188.114.97.3"
            ],
            "NS": [
                "leland.ns.cloudflare.com",
                "tani.ns.cloudflare.com"
            ],
            "SOA": "{\"nsname\": \"leland.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2418085958, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}",
            "AAAA": [
                "2a06:98c1:3120::3",
                "2a06:98c1:3121::3"
            ]
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "hsts": {
            "header": "max-age=63072000; includeSubDomains; preload",
            "message": "Site is compatible with the HSTS preload list!",
            "compatible": true
        },
        "http_security": {
            "xFrameOptions": "SAMEORIGIN",
            "referrerPolicy": "strict-origin",
            "xXSSProtection": false,
            "permissionsPolicy": "camera=(), microphone=(), geolocation=()",
            "xContentTypeOptions": "nosniff",
            "contentSecurityPolicy": "default-src 'self'; img-src 'self' data: blob:; connect-src 'self' https://cloudflareinsights.com https://challenges.clo",
            "strictTransportPolicy": "max-age=63072000; includeSubDomains; preload",
            "crossOriginOpenerPolicy": "same-origin",
            "crossOriginEmbedderPolicy": false,
            "crossOriginResourcePolicy": false
        },
        "firewall": {
            "waf": "Cloudflare",
            "has_waf": true
        },
        "get_ip": {
            "ip": "2a06:98c1:3121::3",
            "family": 6
        },
        "redirects": {
            "chain": [
                "https://hafenzinsstein.digital"
            ]
        },
        "linked_pages": {
            "internal_count": 39
        },
        "headers": {
            "headers": {
                "server": "cloudflare",
                "content-type": "text/html; charset=utf-8",
                "strict-transport-security": "max-age=63072000; includeSubDomains; preload",
                "content-security-policy": "default-src 'self'; img-src 'self' data: blob:; connect-src 'self' https://cloudflareinsights.com https://challenges.cloudflare.com; frame-src https://challenges.cloudflare.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://cdnjs.cloudflare.com; font-src 'self' https://fonts.",
                "x-frame-options": "SAMEORIGIN",
                "x-content-type-options": "nosniff",
                "referrer-policy": "strict-origin",
                "permissions-policy": "camera=(), microphone=(), geolocation=()",
                "cross-origin-opener-policy": "same-origin"
            }
        }
    }
}
```