# PhishDestroy domain threat record: theinfstcks.com

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/theinfstcks.com/
Machine-readable companion: https://phishdestroy.io/domain/theinfstcks.com/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-09-14 05:47:45 UTC
- Last availability or vendor check: 2026-10-22 10:34:01 UTC
- Stored record updated: 2026-10-22 16:07:29 UTC
- VirusTotal detections in the stored snapshot: 6/89
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored infrastructure

- Observed IP address: 23.153.104.17
- Registrar in stored WHOIS data: INWX GmbH
- Registrar country in stored WHOIS data: NL
- Last stored HTTP status: 200
- Registration date (registry RDAP, theinfstcks.com): 2026-09-13 23:16:45 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a09e78-9733-7012-af50-8b9cc127b9c1/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/theinfstcks.com
- Certificate Transparency search: https://crt.sh/?q=%25.theinfstcks.com
- Web Archive lookup: https://web.archive.org/web/*/https://theinfstcks.com/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
theinfstcks.com is an impersonation phishing page that presents itself as "Infinity Stocks. — Trade With Ease." The domain is a compressed spelling of that brand name, and it targets would-be traders and investors who expect a legitimate brokerage. PhishDestroy first flagged it on 2026-09-14. As of 2026-10-19 the site was still online, with its content reachable behind a protection layer.

How the scam works
Pages like this copy the look and promises of a trading platform to win trust. The "Trade With Ease" pitch invites visitors to open an account, which hands over login credentials, contact details and often identity documents. Schemes of this type then push victims to deposit funds. The dashboard may show balances or gains that cannot actually be withdrawn, and new "fees" or "taxes" appear when the victim tries to cash out. Victims can lose the money they deposit, the accounts tied to reused passwords, and personal data that can be used for later fraud.

Evidence
Six of 89 VirusTotal engines flagged the domain when it was checked on 2026-09-18. The flagging vendors were alphaMountain.ai, CRDF, Forcepoint ThreatSeeker, Gridinsoft, SOCRadar and desenmascara.me. That is a modest count, but it comes from several unrelated detection sources. The domain also appears in five AlienVault OTX threat pulses, so other researchers have independently tracked it. PhishDestroy lists it on its own blocklist.

Infrastructure
The domain was registered through INWX GmbH on 2026-09-13, just one day before PhishDestroy detected it. That gap suggests the site was built to go live and start collecting victims almost immediately. It is hosted on the Aquiryn LLC network in the United States. Its Let's Encrypt certificate means the browser padlock only shows that the connection is encrypted. It says nothing about whether the operator is legitimate.

What to do
If you signed up on this site, change that password everywhere you reused it and turn on two-factor authentication on your email and financial accounts. If you sent money, contact your bank or payment provider right away and report the transfer as fraud. Do not pay any "withdrawal fee" or "tax" to unlock a balance, because that money is lost as well. If you uploaded ID documents, watch for identity misuse. Defenders should block theinfstcks.com and alert users to look-alike brokerage domains with abbreviated brand names.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a09e78-9733-7012-af50-8b9cc127b9c1/
VirusTotal report: https://www.virustotal.com/gui/domain/theinfstcks.com
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=theinfstcks.com
Archived copy: https://web.archive.org/web/20260922121513/https://theinfstcks.com/
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 09:43:00 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/20sFXd5y/17cf28ee5125.png
  Captured: 2026-09-14 05:52:24 UTC
- URLScan capture 1: https://screenshots.phishdestroy.io/01a09e78-9733-7012-af50-8b9cc127b9c1.png
  Captured: 2026-09-14 05:52:24 UTC
  Source report: https://urlscan.io/result/01a09e78-9733-7012-af50-8b9cc127b9c1/
- URLScan capture 2: https://urlscan.io/screenshots/01a09e73-ec8f-77b3-81bb-263eb508f109.png
  Captured: 2026-09-14 05:47:45 UTC
  Source report: https://urlscan.io/result/01a09e78-9733-7012-af50-8b9cc127b9c1/
- URLQuery: https://screenshots.phishdestroy.io/uq/2fbecfdd-2e8b-4091-99fc-dcc63c35e5ce.png
  Captured: 2026-09-14 05:53:20 UTC
  Source report: https://urlquery.net/report/2fbecfdd-2e8b-4091-99fc-dcc63c35e5ce
  SHA-256: 686a5210ecfc4c5eab472f59a452404adb15dc4abc519847fa55707065355a44
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/18f01f73-1eab-4c04-a0b3-5500abcae072.png
  Captured: 2026-09-14 05:50:18 UTC
  Source report: https://radar.cloudflare.com/scan/18f01f73-1eab-4c04-a0b3-5500abcae072
  SHA-256: 6f60c82c6d4da8651acc9a8c2b8ac201877c253434d88e5003080bae63f801b0
- URLScan · 2026-09-14: https://screenshots.phishdestroy.io/us/01a09e75-6c03-72e2-92ca-d26f82577acf.png
  Captured: 2026-09-14 05:48:21 UTC
  Source report: https://urlscan.io/result/01a09e75-6c03-72e2-92ca-d26f82577acf/
  SHA-256: 320a0445133317baf68dd34665c791c0e65bd01337ce2bcd39a088d03783f667
- URLScan · 2026-09-14: https://screenshots.phishdestroy.io/us/01a09e76-8ff4-761f-a6b7-b9110fe95883.png
  Captured: 2026-09-14 05:49:32 UTC
  Source report: https://urlscan.io/result/01a09e76-8ff4-761f-a6b7-b9110fe95883/
  SHA-256: 5681192e5bd1b91bee70a8b0f3b2bfe069a46279d3cfa13cd2bc621f5e57c968
- URLScan · 2026-09-25: https://screenshots.phishdestroy.io/us/01a0d5e8-3b3f-733d-ada8-b43896613a4f.png
  Captured: 2026-09-25 00:12:50 UTC
  Source report: https://urlscan.io/result/01a0d5e8-3b3f-733d-ada8-b43896613a4f/
  SHA-256: bcfb47249c0aa4efe483cc551d47034775a75f4474ebca532a91c1adab17e5f5
- URLScan · 2026-09-29: https://screenshots.phishdestroy.io/us/01a0ed07-63e9-75ab-b63a-bfcb633b3bfb.png
  Captured: 2026-09-29 11:58:05 UTC
  Source report: https://urlscan.io/result/01a0ed07-63e9-75ab-b63a-bfcb633b3bfb/
  SHA-256: d262f25a5185147d1ca2c74e9fa3cd492a336592b79a51f6823d463febd38b12
- URLScan · 2026-10-01: https://screenshots.phishdestroy.io/us/01a0f813-8eef-7143-b049-4c72409345b7.png
  Captured: 2026-10-01 15:27:17 UTC
  Source report: https://urlscan.io/result/01a0f813-8eef-7143-b049-4c72409345b7/
  SHA-256: c601f01ef4930a6dcd8968f98d5f0afb852c574ff941624957709a7e36a33a46

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-21T00:15:38Z",
        "uuid": "01a09e78-9733-7012-af50-8b9cc127b9c1",
        "scanned_at": "2026-09-14T05:51:45Z",
        "final_url": "https://theinfstcks.com/",
        "status": 200,
        "ip": "23.153.104.17",
        "ptr": "c4-17.my-control-panel.com",
        "domains": [
            "images.unsplash.com",
            "coin-images.coingecko.com",
            "user-images.trustpilot.com",
            "widget-v3.smartsuppcdn.com",
            "fonts.gstatic.com",
            "cdnjs.cloudflare.com",
            "zennestmarkets.com",
            "cdn.tailwindcss.com",
            "websocket-visitors.smartsupp.com",
            "translations.smartsuppcdn.com",
            "bootstrap.smartsuppchat.com",
            "www.smartsuppchat.com",
            "cdn.jsdelivr.net",
            "fonts.googleapis.com"
        ],
        "ips": [
            "212.102.56.178",
            "195.181.175.41",
            "63.186.192.74",
            "195.181.170.18",
            "142.251.20.94",
            "18.245.31.2",
            "151.101.2.208",
            "172.67.142.173",
            "188.114.97.3",
            "104.17.208.5",
            "172.67.68.11",
            "104.17.24.14",
            "142.250.154.95",
            "23.153.104.17"
        ],
        "asns": [
            "60068",
            "16509",
            "15169",
            "54113",
            "13335",
            "32561"
        ],
        "countries": [
            "DE",
            "US"
        ],
        "doc_hash": "a8b04874e1333f435a91a523762c19b0358f4c612329318fac3ff172a991d5e8",
        "globals": [
            "tailwind",
            "/template.html",
            "resize",
            "drawGrid",
            "drawCandles",
            "drawSymbols",
            "drawParticles",
            "animate",
            "countUp",
            "liveActivity",
            "_smartsupp",
            "smartsupp",
            "Alpine",
            "SMARTSUPP_LOADED",
            "$smartsupp",
            "cvs",
            "ctx",
            "W",
            "H",
            "candles",
            "ChartLine",
            "chartLines",
            "symbols",
            "floatSymbols",
            "dataPts",
            "cur",
            "ring",
            "mx",
            "my",
            "rx",
            "ry",
            "mainnav",
            "obs",
            "cobs",
            "levEl",
            "levFill",
            "levTargets",
            "li"
        ],
        "cookies": [
            "XSRF-TOKEN",
            "tradexpromax_session"
        ],
        "tls": {
            "san": [
                "*.theinfstcks.com",
                "theinfstcks.com"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "YR2",
            "subject": "theinfstcks.com",
            "protocol": "TLS 1.3",
            "valid_to": "2026-12-12T23:12:15Z",
            "valid_from": "2026-09-13T23:12:16Z"
        },
        "domain_age_days": 0,
        "apex_age_days": 0,
        "tls_age_days": 0,
        "tls_valid_days": 89,
        "requests": 45,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 100,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "LiteSpeed",
            "content-type": "text/html; charset=UTF-8",
            "x-powered-by": "PHP/8.2.33"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-21T00:26:26Z",
        "uuid": "18f01f73-1eab-4c04-a0b3-5500abcae072",
        "scanned_at": "2026-09-14T05:50:18Z",
        "final_url": "https://theinfstcks.com/",
        "status": 200,
        "redirected": "https-only",
        "history": [
            {
                "url": "http://theinfstcks.com/",
                "status": 307
            },
            {
                "url": "https://theinfstcks.com/",
                "status": 200
            }
        ],
        "dom_hash": "bda6616060ca5cd35f1fbf6c7906c9ed8677e304707a22bc7e390aa5f32174bb",
        "doc_hash": "fc214a0e4b49cab4dafa28a890a994c4beaaea9e125a572ad552c132e83f1e7e",
        "phishing_v2": [
            "phishing"
        ],
        "domain_risks": [
            "Newly Seen Domains",
            "Security Risks"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "theinfstcks.com",
                "type": "A",
                "value": "23.153.104.17"
            }
        ],
        "dnssec_valid": false,
        "ip": "23.153.104.17",
        "whois": {
            "registrar": "INWX GmbH",
            "created": "2026-09-13T23:16:45Z",
            "updated": "2026-09-13T23:16:49Z",
            "expires": "2027-09-13T23:16:45Z",
            "nameservers": [
                "ns7.asurahosting.com",
                "ns8.asurahosting.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-22T11:58:04Z",
        "analysis_at": "2026-10-14T09:39:57Z",
        "stats": {
            "timeout": 0,
            "harmless": 49,
            "malicious": 7,
            "suspicious": 1,
            "undetected": 35
        },
        "detections": {
            "CRDF": "malicious",
            "Webroot": "malicious",
            "Netcraft": "malicious",
            "SOCRadar": "phishing",
            "Gridinsoft": "suspicious",
            "desenmascara.me": "malicious",
            "alphaMountain.ai": "phishing",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "tags": [
            "dga"
        ],
        "registrar": "INWX GmbH",
        "created": "2026-09-13T23:16:45Z",
        "expires": "2027-09-13T23:16:45Z",
        "updated": "2026-09-23T18:21:41Z",
        "first_seen": "2026-09-14T01:13:28Z",
        "dns": [
            {
                "ttl": 14400,
                "type": "MX",
                "value": "theinfstcks.com",
                "priority": 0
            },
            {
                "ttl": 14400,
                "type": "TXT",
                "value": "v=spf1 +a +mx +ip4:192.168.168.2 ~all"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "ns3.my-control-panel.com"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "ns4.my-control-panel.com"
            },
            {
                "ttl": 14400,
                "type": "A",
                "value": "198.251.84.141"
            },
            {
                "ttl": 21600,
                "type": "SOA",
                "rname": "abuse.my-control-panel.com",
                "value": "ns3.my-control-panel.com"
            }
        ],
        "dns_at": "2026-10-14T09:45:15Z",
        "jarm": "29d29d00029d29d00042d43d00041d598ac0c1012db967bb1ad0ff2491b3ae",
        "cert": {
            "san": [
                "*.theinfstcks.com",
                "theinfstcks.com"
            ],
            "issuer": "Let's Encrypt / YR2",
            "serial": "62e1adc292ffa29ab51477e4cbe38a0fbbc",
            "sha256": "69209cb234bb32d1e4217623e044258ef5ebaff90ca1cbc082b0b31073afaef8",
            "subject": "*.theinfstcks.com",
            "valid_to": "2026-12-22T17:31:19Z",
            "valid_from": "2026-09-23T17:31:20Z"
        },
        "whois": {
            "registrar": "INWX GmbH",
            "registrar_iana_id": "1420",
            "registrar_url": "http://www.inwx.com",
            "created": "2026-09-13T23:16:45Z",
            "updated": "2026-09-23T18:21:41Z",
            "expires": "2027-09-13T23:16:45Z",
            "status": [
                "clientTransferProhibited"
            ],
            "nameservers": [
                "ns3.asurahosting.com",
                "ns4.asurahosting.com"
            ],
            "dnssec": "unsigned"
        },
        "rdap": {
            "status": [
                "client transfer prohibited"
            ],
            "events": {
                "expiration": "2027-09-13T23:16:45Z",
                "last changed": "2026-09-23T18:21:42Z",
                "registration": "2026-09-13T23:16:45Z",
                "registrar expiration": "2027-09-13T23:16:45Z",
                "last update of RDAP database": "2026-10-14T09:45:15Z"
            }
        }
    }
}
```