# PhishDestroy domain threat record: klimabonus-jetzt.com Content language: English Canonical HTML report: https://phishdestroy.io/domain/klimabonus-jetzt.com/ Machine-readable companion: https://phishdestroy.io/domain/klimabonus-jetzt.com/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: unknown - First observed by PhishDestroy: 2026-10-21 15:29:04 UTC - Stored record updated: 2026-10-21 15:39:51 UTC - VirusTotal detections in the stored snapshot: 2/92 - Independent public blocklist matches in the stored snapshot: 1 - Matching public blocklists: OpenPhish - Google Safe Browsing stored result: no stored flag ## Stored infrastructure - Observed IP address: 91.215.85.131 - Registrar in stored WHOIS data: NICENIC INTERNATIONAL GROUP CO., LIMITED - Last stored HTTP status: 200 ## Evidence links - URLScan report: https://urlscan.io/result/01a15e8d-2e88-7719-9e64-647c4df115bf/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/klimabonus-jetzt.com - Certificate Transparency search: https://crt.sh/?q=%25.klimabonus-jetzt.com - Web Archive lookup: https://web.archive.org/web/*/https://klimabonus-jetzt.com/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored page captures - Primary capture: https://urlscan.io/screenshots/01a15e8d-2e88-7719-9e64-647c4df115bf.png Captured: 2026-10-21 15:29:04 UTC - URLScan capture: https://screenshots.phishdestroy.io/01a15e8d-2e88-7719-9e64-647c4df115bf.png Source report: https://urlscan.io/result/01a15e8d-2e88-7719-9e64-647c4df115bf/ - URLScan · 2026-10-21: https://screenshots.phishdestroy.io/us/01a15cca-4db0-727d-bca3-db5381e910a6.png Captured: 2026-10-21 04:49:36 UTC Source report: https://urlscan.io/result/01a15cca-4db0-727d-bca3-db5381e910a6/ SHA-256: df3ce695eeda95f111b61246eece94247a44e1cee863fd5d0198a9abfe6c9599 - URLScan · 2026-10-21: https://screenshots.phishdestroy.io/us/01a15e7f-4227-70f6-89a9-ff13a598b75c.png Captured: 2026-10-21 12:46:27 UTC Source report: https://urlscan.io/result/01a15e7f-4227-70f6-89a9-ff13a598b75c/ SHA-256: b1ca8268bf2abcaa4e5901086d1111356596c5899e9125e17c2144311ffd2865 ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-21T15:33:13Z", "uuid": "01a15e8d-2e88-7719-9e64-647c4df115bf", "scanned_at": "2026-10-21T13:01:20Z", "final_url": "https://klimabonus-jetzt.com/ch/postfinance", "status": 200, "ip": "91.215.85.131", "domains": [ "eccvqfyjdckvlugpwqxy.supabase.co", "fonts.googleapis.com", "www.postfinance.ch" ], "ips": [ "172.64.149.246", "2a00:1450:4001:c15::5f", "91.215.85.131" ], "asns": [ "13335", "15169", "200593" ], "countries": [ "DE", "RU" ], "link_domains": [ "www.postfinance.ch" ], "doc_hash": "10bba9c171c4890a5ef291d19969ef4b7dca7ecc339aad4c39543f440de54198", "script_hashes": [ "4141649d68634156fe171a87dde2be062378aea15f88f684aa318204caa7882a" ], "globals": [ "__reactRouterVersion", "setImmediate", "clearImmediate" ], "storage_keys": [ "lswt-0.9839059286900910.24450617882180614", "hi_ok" ], "tls": { "san": [ "klimabonus-jetzt.com" ], "cipher": "AES_256_GCM", "issuer": "YE1", "subject": "klimabonus-jetzt.com", "protocol": "TLS 1.3", "valid_to": "2027-01-18T14:50:45Z", "valid_from": "2026-10-20T14:50:46Z" }, "domain_age_days": 0, "apex_age_days": 0, "tls_age_days": 0, "tls_valid_days": 89, "requests": 13, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 99, "malicious": true }, "overall": { "tags": [ "phishing" ], "score": 100, "brands": [ "postfinance" ], "malicious": true, "categories": [ "phishing" ] }, "urlscan": { "tags": [ "phishing" ], "score": 100, "brands": [ "PostFinance" ], "malicious": true, "categories": [ "phishing" ] } }, "headers": { "server": "nginx/1.22.1", "content-type": "text/html; charset=utf-8" } }, "vt": { "v": 1, "fetched_at": "2026-10-21T15:30:07Z", "analysis_at": "2026-10-21T12:56:43Z", "stats": { "timeout": 0, "harmless": 55, "malicious": 2, "suspicious": 0, "undetected": 35 }, "detections": { "SOCRadar": "phishing", "alphaMountain.ai": "phishing" }, "reputation": 0, "categories": { "alphaMountain.ai": "Phishing (alphaMountain.ai)" }, "registrar": "NICENIC INTERNATIONAL GROUP CO., LIMITED", "created": "2026-10-20T15:24:13Z", "expires": "2027-10-20T15:24:13Z", "updated": "2026-10-20T15:24:14Z", "first_seen": "2026-10-20T15:57:49Z", "dns": [ { "ttl": 7200, "type": "NS", "value": "ns3.my-ndns.com" }, { "ttl": 7200, "type": "NS", "value": "ns4.my-ndns.com" }, { "ttl": 7200, "type": "SOA", "rname": "root.klimabonus-jetzt.com", "value": "klimabonus-jetzt.com" }, { "ttl": 7200, "type": "A", "value": "91.215.85.131" } ], "dns_at": "2026-10-21T13:05:24Z", "jarm": "27d40d40d00040d00042d42d0000007d20e9b9a3e87aa1ec17cb4d646ce9a5", "cert": { "san": [ "klimabonus-jetzt.com" ], "issuer": "Let's Encrypt / YE1", "serial": "68c4f6a10976a5558636fa4f11c475c4806", "sha256": "b048317e22bfd7b196b1b551ad3ab8bba931e5ff994513f74c5fb4a373a4b056", "subject": "klimabonus-jetzt.com", "valid_to": "2027-01-18T14:50:45Z", "valid_from": "2026-10-20T14:50:46Z" }, "whois": { "registrar": "NICENIC INTERNATIONAL GROUP CO., LIMITED", "registrar_iana_id": "3765", "registrar_url": "https://nicenic.com", "created": "2026-10-20T15:24:13Z", "updated": "2026-10-20T15:24:13Z", "expires": "2027-10-20T15:24:13Z", "status": [ "clientDeleteProhibited", "clientTransferProhibited" ], "nameservers": [ "ns3.my-ndns.com", "ns4.my-ndns.com" ], "dnssec": "unsigned" }, "rdap": { "status": [ "client delete prohibited", "client transfer prohibited" ], "events": { "expiration": "2027-10-20T15:24:13Z", "registration": "2026-10-20T15:24:13Z", "registrar expiration": "2027-10-20T15:24:13Z", "last update of RDAP database": "2026-10-20T15:24:13Z" } } }, "webcheck": { "v": 1, "fetched_at": "2026-10-21T15:33:31Z", "mail_config": { "spf_lookups": 0 }, "caa_records": { "domain": "klimabonus-jetzt.com" }, "block_lists": { "resolvers": 12, "blocked_by": [ "CloudFlare Family" ], "blocked_count": 1 }, "robots_txt": { "agents": [ "*" ], "present": true }, "social_tags": { "title": "Online-Portal", "author": "Bundesministerium für Finanzen", "ogType": "website", "robots": "noindex, nofollow, noarchive, nosnippet, noimageindex", "ogImage": "/favicon.png", "ogTitle": "Online-Portal", "description": "Sicheres Online-Portal – wird geladen.", "twitterCard": "summary", "ogDescription": "Sicheres Online-Portal – wird geladen." }, "trackers": { "requests": 6, "trackers": [ { "name": "Google Fonts", "company": "Google", "country": "US", "category": "Hosting", "requests": 2 } ] }, "mixed_content": { "third_party_scripts": 0 }, "status": { "up": true, "code": 200, "timings": { "dns": 3205, "tls": 65, "wait": 46, "connect": 43, "download": 0 }, "response_ms": 3359 }, "tls_connection": { "alpn": "h2", "cipher": "TLS_AES_256_GCM_SHA384", "protocol": "TLSv1.3", "versions": [ "TLSv1.2", "TLSv1.3" ], "authorized": true, "forward_secrecy": true }, "carbon": { "bytes": 1548, "co2_grams": 0.0001, "cleaner_than": 95 }, "dns_server": { "ns": [ { "ip": "43.162.114.218", "host": "ns4.my-ndns.com" }, { "ip": "154.85.54.43", "host": "ns3.my-ndns.com" } ], "zone": "klimabonus-jetzt.com" }, "location": { "ip": "91.215.85.131", "asn": "200593", "org": "Prospero OOO", "city": "St Petersburg", "country": "RU" }, "ssl": { "issuer": "Let's Encrypt / YE1", "subject": "klimabonus-jetzt.com" }, "dns": { "A": [ "91.215.85.131" ], "NS": [ "ns4.my-ndns.com", "ns3.my-ndns.com" ], "SOA": "{\"nsname\": \"klimabonus-jetzt.com\", \"hostmaster\": \"root.klimabonus-jetzt.com\", \"serial\": 2026102000, \"refresh\": 7200, \"retry\": 1800, \"expire\": 1209600, \"minttl\": 7200}" }, "dnssec": { "ds": false, "rrsig": false, "dnskey": false }, "hsts": { "message": "Site does not serve any HSTS headers." }, "http_security": { "xFrameOptions": false, "referrerPolicy": false, "xXSSProtection": false, "permissionsPolicy": false, "xContentTypeOptions": false, "contentSecurityPolicy": false, "strictTransportPolicy": false, "crossOriginOpenerPolicy": false, "crossOriginEmbedderPolicy": false, "crossOriginResourcePolicy": false }, "get_ip": { "ip": "91.215.85.131", "family": 4 }, "redirects": { "chain": [ "https://klimabonus-jetzt.com" ] }, "tech_stack": { "technologies": [ "Nginx", "Google Font API", "Open Graph" ] }, "whois": { "registrar": "NICENIC INTERNATIONAL GROUP CO., LIMITED", "created": "2026-10-20T15:24:13Z", "updated": "2026-10-20T15:24:14Z", "expires": "2027-10-20T15:24:13Z", "status": [ "clientDeleteProhibited https://icann.org/epp", "clientTransferProhibited https://icann.org/epp" ], "nameservers": [ "ns3.my-ndns.com", "ns4.my-ndns.com" ] }, "headers": { "headers": { "server": "nginx/1.22.1", "content-type": "text/html; charset=utf-8" } } } } ```