# PhishDestroy domain threat record: thalvexgermionistrade.de

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/thalvexgermionistrade.de/
Machine-readable companion: https://phishdestroy.io/domain/thalvexgermionistrade.de/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-09 03:53:43 UTC
- Last availability or vendor check: 2026-10-22 10:38:07 UTC
- Stored record updated: 2026-10-22 16:07:29 UTC
- VirusTotal detections in the stored snapshot: 18/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored infrastructure

- Observed IP address: 158.94.210.119
- Registrar in stored WHOIS data: REGISTRAR_NOT_FOUND
- Last stored HTTP status: 200

## Evidence links

- URLScan report: https://urlscan.io/result/01a11eca-3965-7041-be45-89e3cf9f83a7/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/thalvexgermionistrade.de
- Certificate Transparency search: https://crt.sh/?q=%25.thalvexgermionistrade.de
- Web Archive lookup: https://web.archive.org/web/*/https://thalvexgermionistrade.de/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
thalvexgermionistrade.de presents itself under the name "Thalvex Germionis", an invented-sounding brand with "trade" built into the domain, which points to a site posing as a trading service. It does not imitate any recognizable company, and PhishDestroy has not yet assigned it a specific scheme type. We first saw it on 2026-10-09 and added it to our blocklist. As of 2026-10-19 the site was still online and serving content.

How the scam works
The page title and domain show only a newly branded trading front, not the mechanics behind it. Unfamiliar trading brands with no history are a common vehicle for schemes that take deposits, show fabricated balances and block withdrawals, or that harvest account details and identity documents during sign-up. Nothing confirms which of these applies here, but the security-vendor flags and spam listing mean any money or personal data handed to this site is at serious risk.

Evidence
On 2026-10-09, 18 of 92 VirusTotal engines flagged the domain, including BitDefender, ESET, Fortinet, Forcepoint ThreatSeeker, alphaMountain.ai, CRDF, CyRadar and DNS8. That is a substantial share for a domain this young and means several vendors reached the same conclusion independently. Spamhaus lists it in its Domain Block List under the spam category, and it appears in 4 AlienVault OTX threat pulses, so other researchers have tracked it too.

Infrastructure
The site is hosted at 158.94.210.119 on the network of Omegatech LTD, registered in Seychelles, with the server located in the Netherlands. It uses a free Let's Encrypt certificate. The padlock in the browser only means the connection is encrypted and says nothing about whether the operator is trustworthy.

What to do
Do not register, deposit or upload documents. If you already sent money, stop all further payments, especially any "fees" or "taxes" requested to release a balance, and contact your bank or card issuer right away about reversing the transfer. If you created an account, change that password everywhere you reused it, turn on two-factor authentication and watch for follow-up contact from anyone offering to "recover" your funds. Security teams should block the domain and consider alerting on traffic to its hosting IP.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a11eca-3965-7041-be45-89e3cf9f83a7/
VirusTotal report: https://www.virustotal.com/gui/domain/thalvexgermionistrade.de
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=thalvexgermionistrade.de
Archived copy: https://web.archive.org/web/20261009172540/https://thalvexgermionistrade.de/
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 10:40:20 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/wrJ8Mc1C/c99e5c575bb2.png
  Captured: 2026-10-09 03:53:43 UTC
- URLScan capture: https://screenshots.phishdestroy.io/01a11eca-3965-7041-be45-89e3cf9f83a7.png
  Captured: 2026-10-09 03:53:43 UTC
  Source report: https://urlscan.io/result/01a11eca-3965-7041-be45-89e3cf9f83a7/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/ca614841-81d1-4edb-bf3d-3c7be583284d.png
  Captured: 2026-10-09 04:25:53 UTC
  Source report: https://radar.cloudflare.com/scan/ca614841-81d1-4edb-bf3d-3c7be583284d
  SHA-256: 645ee42bb0d93f097c3e77f0b5342417a037d6b26211d977afd060ad65b8eac2
- URLQuery: https://screenshots.phishdestroy.io/uq/f2fcd889-00aa-4fb2-89e6-1c8bfc778328.png
  Source report: https://urlquery.net/report/f2fcd889-00aa-4fb2-89e6-1c8bfc778328
  SHA-256: b7f0da4d357332ee9957ac8820171c9dd11082dfdf127667a034235894a22202
- URLScan · 2026-08-03: https://screenshots.phishdestroy.io/us/019fc84c-f89c-776c-8757-4c2797a634a4.png
  Captured: 2026-08-03 15:45:23 UTC
  Source report: https://urlscan.io/result/019fc84c-f89c-776c-8757-4c2797a634a4/
  SHA-256: a7d454b4e29e030c876306e907f8a06b776812b314f94af9f980474484a24b23
- URLScan · 2026-08-03: https://screenshots.phishdestroy.io/us/019fc8d5-eb1d-7135-829c-53fdae66a590.png
  Captured: 2026-08-03 18:14:57 UTC
  Source report: https://urlscan.io/result/019fc8d5-eb1d-7135-829c-53fdae66a590/
  SHA-256: e82be8b7bdac8f51a2bfab10070ab07434fa85933ddd1622ae23d80f03ff6ce7
- URLScan · 2026-08-04: https://screenshots.phishdestroy.io/us/019fcb29-6aa8-777f-9fb9-db1dcef5edf7.png
  Captured: 2026-08-04 05:05:23 UTC
  Source report: https://urlscan.io/result/019fcb29-6aa8-777f-9fb9-db1dcef5edf7/
  SHA-256: b50c0b4d9a95897932ccb16b566a3b5bab353fd7c14a6e94efdf125ac2918d5b
- URLScan · 2026-08-04: https://screenshots.phishdestroy.io/us/019fcbc9-bfbb-73d1-8331-89952fe65e9e.png
  Captured: 2026-08-04 08:00:30 UTC
  Source report: https://urlscan.io/result/019fcbc9-bfbb-73d1-8331-89952fe65e9e/
  SHA-256: b50c0b4d9a95897932ccb16b566a3b5bab353fd7c14a6e94efdf125ac2918d5b
- URLScan · 2026-10-09: https://screenshots.phishdestroy.io/us/01a11eb7-53e8-734f-9623-01387de9d4b4.png
  Captured: 2026-10-09 03:31:40 UTC
  Source report: https://urlscan.io/result/01a11eb7-53e8-734f-9623-01387de9d4b4/
  SHA-256: d99d3232a88b0e70038a244412a47340119f645066f899d7018bc5d137f49d84
- URLScan · 2026-10-09: https://screenshots.phishdestroy.io/us/01a11eb7-6017-705c-ad73-019eb798a94f.png
  Captured: 2026-10-09 03:31:44 UTC
  Source report: https://urlscan.io/result/01a11eb7-6017-705c-ad73-019eb798a94f/
  SHA-256: 089cce25cd3f2928ccb66d309177952b978bd06eefed8f94e555694c531d2558

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-20T18:37:09Z",
        "uuid": "01a11eca-3965-7041-be45-89e3cf9f83a7",
        "scanned_at": "2026-10-09T03:52:17Z",
        "final_url": "https://thalvexgermionistrade.de/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://thalvexgermionistrade.de/",
                "from": "http://thalvexgermionistrade.de/",
                "status": 307
            }
        ],
        "ip": "158.94.210.119",
        "ips": [
            "158.94.210.119"
        ],
        "asns": [
            "202412"
        ],
        "countries": [
            "NL"
        ],
        "doc_hash": "32fe225afdce1bc23e0d40dce762b2e030d9961b0b3dd7670919f782439d2bc7",
        "script_hashes": [
            "8aa5f8f647356dcd4fc5dbbe0efd5bc0e8da74026bc61e24636e2e1f5749b0ce"
        ],
        "globals": [
            "__dclq",
            "__dclOrig",
            "__dclFlush",
            "__smsCheckBeforeSubmit",
            "__isSmsEnabled",
            "__isSmsVerified",
            "intlTelInput"
        ],
        "tls": {
            "san": [
                "thalvexgermionistrade.de"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "YE1",
            "subject": "thalvexgermionistrade.de",
            "protocol": "TLS 1.3",
            "valid_to": "2026-11-26T10:04:20Z",
            "valid_from": "2026-08-28T10:04:21Z"
        },
        "domain_age_days": 124,
        "apex_age_days": 124,
        "tls_age_days": 41,
        "tls_valid_days": 89,
        "requests": 5,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 84,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "content-type": "text/html; charset=utf-8",
            "x-content-type-options": "nosniff"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-20T18:47:06Z",
        "uuid": "ca614841-81d1-4edb-bf3d-3c7be583284d",
        "scanned_at": "2026-10-09T04:25:53Z",
        "final_url": "https://thalvexgermionistrade.de/",
        "status": 200,
        "history": [
            {
                "url": "https://thalvexgermionistrade.de/",
                "status": 200
            }
        ],
        "dom_hash": "bab8b2ecc852c395f42a9f863fbb3da413bdb89790cd073821afb78f6bc6fcd6",
        "doc_hash": "a0096237ef809fe652b74eb0f6e217edfd2f72117d0a43ac4395e548b2cf1d24",
        "phishing_v2": [
            "phishing"
        ],
        "domain_risks": [
            "Malware",
            "Security threats",
            "CIPA Filter",
            "CIPA"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "thalvexgermionistrade.de",
                "type": "A",
                "value": "158.94.210.119"
            }
        ],
        "dnssec_valid": false,
        "ip": "158.94.210.119",
        "verdict": {
            "tags": [
                "malware"
            ],
            "malicious": true,
            "categories": [
                "malware"
            ]
        },
        "whois": {
            "updated": "2026-08-28T09:18:54Z",
            "nameservers": [
                "ns1.dyna-ns.net",
                "ns2.dyna-ns.net"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-21T04:40:47Z",
        "analysis_at": "2026-10-18T13:41:18Z",
        "stats": {
            "timeout": 0,
            "harmless": 43,
            "malicious": 14,
            "suspicious": 4,
            "undetected": 31
        },
        "detections": {
            "CRDF": "malicious",
            "DNS8": "suspicious",
            "ESET": "suspicious",
            "VIPRE": "phishing",
            "G-Data": "phishing",
            "Lionic": "phishing",
            "Sophos": "phishing",
            "CyRadar": "phishing",
            "Webroot": "malicious",
            "Fortinet": "spam",
            "SOCRadar": "phishing",
            "URLQuery": "malicious",
            "Kaspersky": "phishing",
            "Seclookup": "malicious",
            "Gridinsoft": "suspicious",
            "BitDefender": "phishing",
            "alphaMountain.ai": "phishing",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "tags": [
            "dga"
        ],
        "first_seen": "2026-06-05T05:30:34Z",
        "dns": [
            {
                "ttl": 300,
                "type": "NS",
                "value": "ns2.dyna-ns.net"
            },
            {
                "ttl": 300,
                "type": "SOA",
                "rname": "hostmaster.thalvexgermionistrade.de",
                "value": "ns1.dyna-ns.net"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "158.94.210.119"
            },
            {
                "ttl": 300,
                "type": "NS",
                "value": "ns1.dyna-ns.net"
            }
        ],
        "dns_at": "2026-10-18T13:46:35Z",
        "jarm": "40d40d40d00000000043d43d00043d6aff5ab0f4fc31897186312c9e639319",
        "cert": {
            "san": [
                "thalvexgermionistrade.de"
            ],
            "issuer": "Let's Encrypt / YE1",
            "serial": "62c6bb2f4a1246221cddaea83ff423969fc",
            "sha256": "f5493cdcd8b068c34fcdc5f8a6fcbc8692ba4ca4661c10a770fbd04db109f7c3",
            "subject": "thalvexgermionistrade.de",
            "valid_to": "2026-11-26T10:04:20Z",
            "valid_from": "2026-08-28T10:04:21Z"
        },
        "rdap": {
            "status": [
                "active"
            ],
            "events": {
                "last changed": "2026-08-28T09:18:54Z"
            }
        }
    }
}
```