# PhishDestroy domain threat record: pizza-primavera-wiesbaden.de Content language: English Canonical HTML report: https://phishdestroy.io/domain/pizza-primavera-wiesbaden.de/ Machine-readable companion: https://phishdestroy.io/domain/pizza-primavera-wiesbaden.de/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-10-19 01:27:07 UTC - Last availability or vendor check: 2026-10-22 10:30:40 UTC - Stored record updated: 2026-10-22 16:07:29 UTC - VirusTotal detections in the stored snapshot: 12/92 - Independent public blocklist matches in the stored snapshot: 2 - Matching public blocklists: MetaMask, SEAL - Google Safe Browsing stored result: no stored flag ## Stored classification - Targeted brand: ankr ## Stored infrastructure - Observed IP address: 217.160.0.128 - Registrar in stored WHOIS data: REGISTRAR_NOT_FOUND - Last stored HTTP status: 200 ## Evidence links - URLScan report: https://urlscan.io/result/01a151cc-2f66-71ef-88a8-3bf56474e389/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/pizza-primavera-wiesbaden.de - Certificate Transparency search: https://crt.sh/?q=%25.pizza-primavera-wiesbaden.de - Web Archive lookup: https://web.archive.org/web/*/https://pizza-primavera-wiesbaden.de/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview The domain pizza-primavera-wiesbaden.de appeared on the PhishDestroy blocklist on 2026-10-19. Its status is currently unclassified, meaning its exact purpose has not been confirmed. The site mimics a German restaurant, suggesting it may target local or international diners searching for dining options in Wiesbaden. PhishDestroy first observed it on 2026-10-19. How the scam works This domain likely uses a deceptive website to trick visitors into entering personal information, downloading malware, or making fraudulent payments. Visitors risk exposing login credentials, payment details, or installing malicious software if they interact with the site. Without a confirmed page title or kit, the exact mechanism remains uncertain, but the risk of phishing or fraudulent activity is elevated due to its blocklist presence. Evidence VirusTotal flagged the domain with 12 detections out of 92 engines on 2026-10-19, including vendors such as BitDefender, Fortinet, and AlphaSOC. It is also listed on the PhishDestroy, MetaMask, and SEAL blocklists, reinforcing suspicions of malicious activity. The combination of detections and blocklist inclusions indicates a higher likelihood of harmful behavior. Infrastructure The domain resolves to an IP address (217.160.0.128) hosted by a network associated with this infrastructure. No further details about the registrar, TLS issuer, or registration date are available. What to do If you visited pizza-primavera-wiesbaden.de, avoid entering any personal or payment information. Clear your browser cache and run a malware scan if you interacted with the site. Report the domain to your security team or PhishDestroy to help investigate further. Defenders should block the domain at the network level and monitor for related activity. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a150c6-efc9-7051-b6fc-a694eff62352/ VirusTotal report: https://www.virustotal.com/gui/domain/pizza-primavera-wiesbaden.de Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=pizza-primavera-wiesbaden.de Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-19 01:34:24 UTC ## Stored page captures - Primary capture: https://i.ibb.co/5h3BcyKq/4a2fb9d03037.png Captured: 2026-10-19 01:36:50 UTC - URLScan capture 1: https://screenshots.phishdestroy.io/01a151cc-2f66-71ef-88a8-3bf56474e389.png Captured: 2026-10-19 01:36:50 UTC Source report: https://urlscan.io/result/01a151cc-2f66-71ef-88a8-3bf56474e389/ - URLScan capture 2: https://urlscan.io/screenshots/01a150c6-efc9-7051-b6fc-a694eff62352.png Captured: 2026-10-19 01:27:07 UTC Source report: https://urlscan.io/result/01a151cc-2f66-71ef-88a8-3bf56474e389/ - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/cc95404b-69b0-4822-a0ad-479764079633.png Captured: 2026-10-19 01:31:53 UTC Source report: https://radar.cloudflare.com/scan/cc95404b-69b0-4822-a0ad-479764079633 SHA-256: 3ed6167479aba294530597d0f0a8ac8a49c97954f304aa70adab0010b78a674d - URLQuery: https://screenshots.phishdestroy.io/uq/fa4a0014-099d-44b6-a155-48c915e0000e.png Source report: https://urlquery.net/report/fa4a0014-099d-44b6-a155-48c915e0000e SHA-256: e61d2b1a57cab72c3cd5b1f151bd8e95372e60d6a234b1134f21ce6b86266585 - URLScan · 2026-10-15: https://screenshots.phishdestroy.io/us/01a13fab-c255-7795-b413-86f8f7e6fc7d.png Captured: 2026-10-15 13:06:30 UTC Source report: https://urlscan.io/result/01a13fab-c255-7795-b413-86f8f7e6fc7d/ SHA-256: 1351571f1eb5306d98139364f6abdfef369533d3d30cf9a3297ae52a232d7847 - URLScan · 2026-10-17: https://screenshots.phishdestroy.io/us/01a149ef-d893-7201-b25e-f79e2719b316.png Captured: 2026-10-17 12:57:04 UTC Source report: https://urlscan.io/result/01a149ef-d893-7201-b25e-f79e2719b316/ SHA-256: a77164587acb23673126da332e00b8ae4b334fe3a033a953cd3a95ce1803f716 - URLScan · 2026-10-17: https://screenshots.phishdestroy.io/us/01a14acb-0c9b-7329-9f13-dbd28f251a33.png Captured: 2026-10-17 16:56:30 UTC Source report: https://urlscan.io/result/01a14acb-0c9b-7329-9f13-dbd28f251a33/ SHA-256: d8b9d05640280337a348efc6ebc9ae761222d98d5ba39b68704edef09cfbaebb - URLScan · 2026-10-18: https://screenshots.phishdestroy.io/us/01a14c9b-d284-700e-b2d4-c70c69a3da9b.png Captured: 2026-10-18 01:24:12 UTC Source report: https://urlscan.io/result/01a14c9b-d284-700e-b2d4-c70c69a3da9b/ SHA-256: 1351571f1eb5306d98139364f6abdfef369533d3d30cf9a3297ae52a232d7847 - URLScan · 2026-10-18: https://screenshots.phishdestroy.io/us/01a150c6-efc9-7051-b6fc-a694eff62352.png Captured: 2026-10-18 20:49:44 UTC Source report: https://urlscan.io/result/01a150c6-efc9-7051-b6fc-a694eff62352/ SHA-256: 1351571f1eb5306d98139364f6abdfef369533d3d30cf9a3297ae52a232d7847 - URLScan · 2026-10-19: https://screenshots.phishdestroy.io/us/01a15374-88a4-75c5-87ed-95b177060d09.png Captured: 2026-10-19 09:18:44 UTC Source report: https://urlscan.io/result/01a15374-88a4-75c5-87ed-95b177060d09/ SHA-256: 1351571f1eb5306d98139364f6abdfef369533d3d30cf9a3297ae52a232d7847 ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-20T16:44:46Z", "uuid": "01a151cc-2f66-71ef-88a8-3bf56474e389", "scanned_at": "2026-10-19T01:35:05Z", "final_url": "https://pizza-primavera-wiesbaden.de/", "status": 200, "redirected": "https-only", "redirects": [ { "to": "https://pizza-primavera-wiesbaden.de/", "from": "http://pizza-primavera-wiesbaden.de/", "status": 307 } ], "ip": "217.160.0.128", "ptr": "217-160-0-128.elastic-ssl.ui-r.com", "domains": [ "rpc-mainnet.matic.quiknode.pro", "verifing-server.codes", "polygon-bor-rpc.publicnode.com", "www.fbgcdn.com", "fonts.googleapis.com", "anvil-laii-r7tc2.pro" ], "ips": [ "150.136.141.142", "178.16.52.101", "172.66.150.162", "142.251.13.95", "2.20.142.4", "217.160.0.128" ], "asns": [ "31898", "202412", "13335", "15169", "20940", "8560" ], "countries": [ "US", "DE" ], "link_domains": [ "jackpotcitycasino.io", "spinmacho-es.eu.com", "neospincasino.io", "nationalcasinoslots.com", "nyspinscasino-se.eu.com", "n1-casino.co", "icecasino-ca.net", "nyspinscasino.se", "milkywinscasino.com", "de.wordpress.org" ], "doc_hash": "fd9ad2556ca861e349253ebc52de97652827a1c0dc75d1e8e8a9f909ddd208b8", "script_hashes": [ "cb6f2d32c49d1c2b25e9ffc9aaafa3f83075346c01bcd4ae6eb187392a4292cf", "5274f11e6fb32ae0cf2dfb9f8043272865c397a7c4223b4cfa7d50ea52fbde89", "726ac59577c8aeeec94c61bfb7791a709e401b5d871d35c39a65cd948f6124e3", "fbe11af6f29f55ae480e2058aad3ac400315d2792c3b14346f016b70cebf3bb3", "4a31f731949f3c3c841266d88e66015d3e295acfeea6eaf25d9213e61df77946", "063840b4b3f5869e0f0d078bab8bd29cfb3a59ee85e8e3edbbec35a8fe846fd3" ], "globals": [ "_9c6e63ad72", "glfLoaded", "glfWidget", "glfOpenWidget", "glfBindButtons", "jQuery", "_glf_setInterval", "runOpeningHours", "processOpeningHours", "getDaysString", "getTimeString", "numberToDaysOfWeek", "padLeft", "_7428bbf41b", "_wpemojiSettings", "twemoji", "wp" ], "storage_keys": [ "wpEmojiSettingsSupports" ], "tls": { "san": [ "*.pizza-primavera-wiesbaden.de", "pizza-primavera-wiesbaden.de" ], "cipher": "AES_256_GCM", "issuer": "Sectigo Public Server Authentication CA DV R36", "subject": "*.pizza-primavera-wiesbaden.de", "protocol": "TLS 1.3", "valid_to": "2027-02-14T23:59:59Z", "valid_from": "2026-02-14T00:00:00Z" }, "domain_age_days": 3, "apex_age_days": 3, "tls_age_days": 247, "tls_valid_days": 365, "requests": 21, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 69, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "Apache", "content-type": "text/html; charset=UTF-8" } }, "cf": { "v": 1, "fetched_at": "2026-10-20T17:56:03Z", "uuid": "cc95404b-69b0-4822-a0ad-479764079633", "scanned_at": "2026-10-19T01:31:53Z", "final_url": "https://pizza-primavera-wiesbaden.de/", "status": 200, "history": [ { "url": "https://pizza-primavera-wiesbaden.de/", "status": 200 } ], "dom_hash": "7622b6f14655453aa5b861c15f0e3ed5ea9bfaddf497d8b36ebbe1d834abb736", "doc_hash": "fd9ad2556ca861e349253ebc52de97652827a1c0dc75d1e8e8a9f909ddd208b8", "domain_risks": [ "Compromised Domain", "Security threats", "Shopping", "Shopping & Auctions", "CIPA Filter", "CIPA", "Gambling" ], "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "pizza-primavera-wiesbaden.de", "type": "A", "value": "217.160.0.128" }, { "name": "pizza-primavera-wiesbaden.de", "type": "AAAA", "value": "2001:8d8:100f:f000::200" } ], "dnssec_valid": false, "ip": "217.160.0.128", "whois": { "updated": "2026-02-14T18:44:01Z", "nameservers": [ "ns1068.ui-dns.de", "ns1070.ui-dns.org", "ns1078.ui-dns.com", "ns1103.ui-dns.biz" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-20T18:07:11Z", "analysis_at": "2026-10-17T14:31:46Z", "stats": { "timeout": 0, "harmless": 48, "malicious": 7, "suspicious": 2, "undetected": 35 }, "detections": { "CRDF": "malicious", "Lionic": "malicious", "Fortinet": "malware", "SOCRadar": "suspicious", "URLQuery": "malicious", "LevelBlue": "phishing", "alphaMountain.ai": "malicious", "Bfore.Ai PreCrime": "malicious", "Forcepoint ThreatSeeker": "spam" }, "reputation": -11, "votes": { "malicious": 1 }, "categories": { "alphaMountain.ai": "Malicious (alphaMountain.ai)" }, "first_seen": "2026-02-14T21:49:29Z", "dns": [ { "ttl": 21600, "type": "NS", "value": "ns1078.ui-dns.com" }, { "ttl": 21600, "type": "SOA", "rname": "hostmaster.1und1.com", "value": "ns1070.ui-dns.org" }, { "ttl": 21600, "type": "NS", "value": "ns1070.ui-dns.org" }, { "ttl": 3600, "type": "AAAA", "value": "2001:8d8:100f:f000::200" }, { "ttl": 21600, "type": "NS", "value": "ns1103.ui-dns.biz" }, { "ttl": 3600, "type": "A", "value": "217.160.0.128" }, { "ttl": 21600, "type": "NS", "value": "ns1068.ui-dns.de" }, { "ttl": 3600, "type": "MX", "value": "mx01.ionos.de", "priority": 10 }, { "ttl": 3600, "type": "MX", "value": "mx00.ionos.de", "priority": 10 }, { "ttl": 3600, "type": "TXT", "value": "v=spf1 include:_spf-eu.ionos.com ~all" } ], "dns_at": "2026-10-17T14:32:13Z", "jarm": "29d29d00029d29d00042d42d0000002059a3b916699461c5923779b77cf06b", "cert": { "san": [ "*.pizza-primavera-wiesbaden.de", "pizza-primavera-wiesbaden.de" ], "issuer": "Sectigo Limited / Sectigo Public Server Authentication CA DV R36", "serial": "3ccd57cbf936b172b828ba25d3cc655f", "sha256": "c938d2710daa44de6323f598d25d554b2bf2fd13776d57e57c13602211991355", "subject": "*.pizza-primavera-wiesbaden.de", "valid_to": "2027-02-14T23:59:59Z", "valid_from": "2026-02-14T00:00:00Z" }, "rdap": { "status": [ "active" ], "events": { "last changed": "2026-02-14T18:44:01Z" } } }, "webcheck": { "v": 1, "fetched_at": "2026-10-22T01:01:33Z", "mail_config": { "mx": [ "mx01.ionos.de", "mx00.ionos.de" ], "spf": "v=spf1 include:_spf-eu.ionos.com ~all", "dmarc": true, "spf_lookups": 1 }, "caa_records": { "domain": "pizza-primavera-wiesbaden.de" }, "block_lists": { "resolvers": 12, "blocked_count": 0 }, "archives": { "last": "2026-10-19T01:39:26Z", "first": "2026-10-19T01:39:26Z", "changes": 0, "days_archived": 1, "avg_page_bytes": 46633 }, "robots_txt": { "agents": [ "*" ], "present": true, "sitemaps": [ "https://pizza-primavera-wiesbaden.de/wp-sitemap.xml" ] }, "trackers": { "requests": 19, "trackers": [ { "name": "Google Fonts", "company": "Google", "country": "US", "category": "Hosting", "requests": 1 } ] }, "mixed_content": { "no_sri": [ "https://www.fbgcdn.com/embedder/js/ewm2.js", "https://indigo-flicker-zephyr-truior.pro/t.js" ], "third_party_scripts": 2 }, "status": { "up": true, "code": 200, "timings": { "dns": 2, "tls": 25, "wait": 2449, "connect": 11, "download": 29 }, "response_ms": 2516 }, "tls_connection": { "alpn": "h2", "cipher": "TLS_AES_256_GCM_SHA384", "protocol": "TLSv1.3", "versions": [ "TLSv1.2", "TLSv1.3" ], "authorized": true, "forward_secrecy": true }, "ports": { "open": [ 80, 443 ] }, "carbon": { "bytes": 168382, "co2_grams": 0.0062, "cleaner_than": 11 }, "dns_server": { "ns": [ { "ip": "185.132.34.78", "host": "ns1078.ui-dns.com" }, { "ip": "185.132.33.103", "host": "ns1103.ui-dns.biz" }, { "ip": "185.132.35.70", "host": "ns1070.ui-dns.org" }, { "ip": "185.132.32.68", "host": "ns1068.ui-dns.de" } ], "zone": "pizza-primavera-wiesbaden.de" }, "cookies": { "cookies": [ { "name": "_av", "same_site": "Lax" }, { "name": "_avs", "same_site": "Lax" } ] }, "location": { "ip": "2001:8d8:100f:f000::200", "asn": "8560", "org": "IONOS SE", "city": "Frankfurt am Main", "country": "DE" }, "ssl": { "issuer": "Sectigo Limited / Sectigo Public Server Authentication CA DV R36", "subject": "*.pizza-primavera-wiesbaden.de" }, "dns": { "A": [ "217.160.0.128" ], "MX": [ "{\"exchange\": \"mx01.ionos.de\", \"priority\": 10}", "{\"exchange\": \"mx00.ionos.de\", \"priority\": 10}" ], "NS": [ "ns1070.ui-dns.org", "ns1078.ui-dns.com", "ns1103.ui-dns.biz", "ns1068.ui-dns.de" ], "SOA": "{\"nsname\": \"ns1070.ui-dns.org\", \"hostmaster\": \"hostmaster.1und1.com\", \"serial\": 2017060110, \"refresh\": 28800, \"retry\": 7200, \"expire\": 604800, \"minttl\": 600}", "TXT": [ "v=spf1 include:_spf-eu.ionos.com ~all" ], "AAAA": [ "2001:8d8:100f:f000::200" ] }, "dnssec": { "ds": false, "rrsig": false, "dnskey": false }, "hsts": { "message": "Site does not serve any HSTS headers." }, "http_security": { "xFrameOptions": false, "referrerPolicy": false, "xXSSProtection": false, "permissionsPolicy": false, "xContentTypeOptions": false, "contentSecurityPolicy": false, "strictTransportPolicy": false, "crossOriginOpenerPolicy": false, "crossOriginEmbedderPolicy": false, "crossOriginResourcePolicy": false }, "get_ip": { "ip": "2001:8d8:100f:f000::200", "family": 6 }, "redirects": { "chain": [ "https://pizza-primavera-wiesbaden.de" ] }, "tech_stack": { "technologies": [ "WordPress", "MySQL", "PHP", "Apache HTTP Server", "FoodBooking", "jQuery Migrate", "jQuery", "GloriaFood", "Priority Hints", "Google Font API", "Sectigo", "RSS" ] }, "linked_pages": { "external": [ "https://jackpotcitycasino.io/it-it/bonus/", "https://spinmacho-es.eu.com/", "https://neospincasino.io/pt-pt/codigo-promocional/", "https://nationalcasinoslots.com/bonus/", "https://nyspinscasino-se.eu.com/", "https://n1-casino.co/promo-code/", "https://icecasino-ca.net/it/bonus/", "https://nyspinscasino.se/", "https://milkywinscasino.com/pt-pt/iniciar-sessao/", "https://de.wordpress.org/" ], "external_count": 10, "internal_count": 25 }, "whois": { "updated": "2026-02-14T18:44:01Z", "status": [ "connect" ], "nameservers": [ "ns1068.ui-dns.de", "ns1070.ui-dns.org", "ns1078.ui-dns.com", "ns1103.ui-dns.biz" ] }, "headers": { "headers": { "server": "Apache", "content-type": "text/html; charset=UTF-8" } } } } ```