# PhishDestroy domain threat record: it-coman.de Content language: English Canonical HTML report: https://phishdestroy.io/domain/it-coman.de/ Machine-readable companion: https://phishdestroy.io/domain/it-coman.de/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-10-10 23:30:44 UTC - Last availability or vendor check: 2026-10-22 10:00:33 UTC - Stored record updated: 2026-10-22 16:07:29 UTC - VirusTotal detections in the stored snapshot: 8/92 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: no stored flag ## Stored infrastructure - Observed IP address: 81.169.145.151 - Registrar in stored WHOIS data: REGISTRAR_NOT_FOUND - Last stored HTTP status: 200 ## Evidence links - URLScan report: https://urlscan.io/result/01a12826-5a1b-7798-9d3b-9f3d36c83822/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/it-coman.de - Certificate Transparency search: https://crt.sh/?q=%25.it-coman.de - Web Archive lookup: https://web.archive.org/web/*/https://it-coman.de/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview it-coman.de is on the PhishDestroy blocklist as an impersonation phishing page, a site built to pass itself off as a trusted party so visitors lower their guard. PhishDestroy first saw it on 2026-10-11. As of 2026-10-19 the domain was still online and serving content. Its page title reads "STRATO - Domain reserved", the hosting provider's parking placeholder, while our classification is impersonation phishing. How the scam works Impersonation pages borrow the look, name or wording of a known service so a visitor believes they are somewhere legitimate. The usual payoff is a login form, a fake verification step or a support prompt that collects passwords, one-time codes or personal details. Those details are then replayed against the real service, which can lead to account takeover. An innocuous-looking title such as a hosting placeholder offers no assurance about what the domain serves to every visitor. Evidence On 2026-10-12, 8 of 92 VirusTotal engines flagged the domain: ADMINUSLabs, alphaMountain.ai, Chong Lua Dao, Fortinet, Gridinsoft, Seclookup, SOCRadar and URLQuery. That is a minority of engines, but the vendors are independent of one another and include both commercial feeds and community anti-phishing projects. The domain also appears in 34 AlienVault OTX threat pulses, which shows it has been tracked repeatedly in shared intelligence. Among blocklists, PhishDestroy currently lists it. Infrastructure The domain resolves to 81.169.145.151 on the STRATO network (Strato GmbH) in Germany. That matches the STRATO placeholder title, so the site sits on ordinary mainstream shared hosting and not on dedicated criminal infrastructure. Registrar details for this .de domain could not be retrieved. What to do If you entered a password on it-coman.de, change it right away on the real service and on any other site where you reused it. Turn on two-factor authentication, preferably with an authenticator app, and review recent logins and recovery settings for changes you did not make. If you supplied personal or payment details, watch for follow-up phishing that uses them and alert your bank where relevant. Defenders should block the domain and the address 81.169.145.151 for this hostname, search proxy and mail logs for visits since 2026-10-11, and report the domain to the hosting provider's abuse team. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a12826-5a1b-7798-9d3b-9f3d36c83822/ VirusTotal report: https://www.virustotal.com/gui/domain/it-coman.de Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=it-coman.de Archived copy: https://web.archive.org/web/20190919042113/http://it-coman.de/ Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-19 09:27:07 UTC ## Stored page captures - Primary capture: https://i.ibb.co/0yRvwK9c/9283fc091c52.png Captured: 2026-10-10 23:30:44 UTC - URLScan capture 1: https://screenshots.phishdestroy.io/01a12826-5a1b-7798-9d3b-9f3d36c83822.png Captured: 2026-10-10 23:30:44 UTC Source report: https://urlscan.io/result/01a12826-5a1b-7798-9d3b-9f3d36c83822/ - URLScan capture 2: https://urlscan.io/screenshots/01a12646-68ae-71dd-8191-9cf31799f839.png Captured: 2026-10-10 23:02:32 UTC Source report: https://urlscan.io/result/01a12826-5a1b-7798-9d3b-9f3d36c83822/ - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/f3c05511-e670-44b1-bb1e-c02bbd64a83f.png Captured: 2026-10-12 11:21:27 UTC Source report: https://radar.cloudflare.com/scan/f3c05511-e670-44b1-bb1e-c02bbd64a83f SHA-256: 36d07495bcca5f3e48f8eca8aedf572633b1c8597772c12bfb5fcf7563770e66 - URLQuery: https://screenshots.phishdestroy.io/uq/03ae5593-9244-428d-a8f3-a8afedd0ecd4.png Source report: https://urlquery.net/report/03ae5593-9244-428d-a8f3-a8afedd0ecd4 SHA-256: 3a7583dda94cfa2a421193b48dbd5da0a4ca5b27fbd828b9fd0f3f01d5367f31 - URLScan · 2026-07-28: https://screenshots.phishdestroy.io/us/019fa946-3f8f-706e-89db-9bcc1e86e713.png Captured: 2026-07-28 15:09:48 UTC Source report: https://urlscan.io/result/019fa946-3f8f-706e-89db-9bcc1e86e713/ SHA-256: 844152d651181e9c204086320c4f1c41de2608789133015326aa5e800b29cb69 - URLScan · 2026-10-10: https://screenshots.phishdestroy.io/us/01a12646-68ae-71dd-8191-9cf31799f839.png Captured: 2026-10-10 14:45:16 UTC Source report: https://urlscan.io/result/01a12646-68ae-71dd-8191-9cf31799f839/ SHA-256: 844152d651181e9c204086320c4f1c41de2608789133015326aa5e800b29cb69 ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-20T18:33:00Z", "uuid": "01a12826-5a1b-7798-9d3b-9f3d36c83822", "scanned_at": "2026-10-10T23:29:32Z", "final_url": "http://it-coman.de/", "status": 200, "redirects": [ { "to": "https://it-coman.de/", "from": "http://it-coman.de/", "status": 307 }, { "to": "http://it-coman.de/", "from": "https://it-coman.de/", "status": 307 } ], "ip": "81.169.145.151", "ptr": "w97.rzone.de", "ips": [ "81.169.145.151" ], "asns": [ "6724" ], "countries": [ "DE" ], "link_domains": [ "www.strato.de" ], "doc_hash": "5f11f74468294f5bfc5f1786425ba9c7f19c62759b6e19143528e678104133dd", "domain_age_days": 2989, "apex_age_days": 2989, "requests": 2, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": -15, "malicious": false }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "Apache/2.4.68 (Unix)", "content-type": "text/html" } }, "cf": { "v": 1, "fetched_at": "2026-10-20T18:44:25Z", "uuid": "f3c05511-e670-44b1-bb1e-c02bbd64a83f", "scanned_at": "2026-10-12T11:21:27Z", "final_url": "https://it-coman.de/", "history": [ { "url": "https://it-coman.de/", "status": 0 } ], "domain_risks": [ "Educational Institutions", "Education" ], "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "it-coman.de", "type": "A", "value": "81.169.145.151" }, { "name": "it-coman.de", "type": "AAAA", "value": "2a01:238:20a:202:1151::" } ], "dnssec_valid": false, "whois": { "updated": "2022-06-25T10:24:30Z", "nameservers": [ "docks20.rzone.de", "shades15.rzone.de" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-21T02:37:59Z", "analysis_at": "2026-10-13T12:04:10Z", "stats": { "timeout": 0, "harmless": 52, "malicious": 7, "suspicious": 0, "undetected": 33 }, "detections": { "Fortinet": "malware", "SOCRadar": "phishing", "Seclookup": "malicious", "Gridinsoft": "malicious", "ADMINUSLabs": "malicious", "Chong Lua Dao": "malicious", "alphaMountain.ai": "malicious" }, "reputation": 0, "categories": { "alphaMountain.ai": "Malicious (alphaMountain.ai)" }, "first_seen": "2023-10-05T12:48:47Z", "dns": [ { "ttl": 150, "type": "AAAA", "value": "2a01:238:20a:202:1151::" }, { "ttl": 150, "type": "NS", "value": "shades15.rzone.de" }, { "ttl": 150, "type": "NS", "value": "docks20.rzone.de" }, { "ttl": 150, "type": "MX", "value": "smtpin.rzone.de", "priority": 5 }, { "ttl": 150, "type": "SOA", "rname": "hostmaster.strato-rz.de", "value": "docks20.rzone.de" }, { "ttl": 150, "type": "A", "value": "81.169.145.151" } ], "dns_at": "2026-10-13T12:06:11Z", "jarm": "2ad2ad0002ad2ad22c42d42d00000053159b1774e85efa5daee9eb6c5fb552", "cert": { "san": [ "it-coman.de", "www.it-coman.de" ], "issuer": "Let's Encrypt / R3", "serial": "04371e0b53c3f79cde3c75ab972a5974f87c", "sha256": "79cdf34d1e178bc3688b7739e53814b3ee5d7f331065fb3d90bc15e88b7e57dd", "subject": "www.it-coman.de", "valid_to": "2022-09-15T00:33:19Z", "valid_from": "2022-06-17T00:33:20Z" }, "rdap": { "status": [ "active" ], "events": { "last changed": "2022-06-25T10:24:30Z" } } } } ```