# PhishDestroy domain threat record: wolfkapitthal.de

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/wolfkapitthal.de/
Machine-readable companion: https://phishdestroy.io/domain/wolfkapitthal.de/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-09 03:11:30 UTC
- Last availability or vendor check: 2026-10-22 10:37:49 UTC
- Stored record updated: 2026-10-22 16:07:29 UTC
- VirusTotal detections in the stored snapshot: 16/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored infrastructure

- Observed IP address: 158.94.210.119
- Registrar in stored WHOIS data: REGISTRAR_NOT_FOUND
- Last stored HTTP status: 200

## Evidence links

- URLScan report: https://urlscan.io/result/01a11ea3-1f45-76ea-a2f5-11cae473ec1d/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/wolfkapitthal.de
- Certificate Transparency search: https://crt.sh/?q=%25.wolfkapitthal.de
- Web Archive lookup: https://web.archive.org/web/*/https://wolfkapitthal.de/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
wolfkapitthal.de presents itself under the page title "Wolf Kapitthal", a company-style name that does not match any brand we can confirm. PhishDestroy first saw the domain on 2026-10-09 and placed it on our blocklist. It has not yet been assigned a specific scheme type. On 2026-10-19 the site was still online and serving live content, so anyone reaching it today sees a working page.

How the scam works
The detections show a domain that multiple security engines and a spam reputation list treat as malicious. They do not show what the page asks visitors to do. Sites flagged this way often try to collect logins, personal details, payments or crypto deposits under a convincing business name. Until the scheme is pinned down, treat any form, sign-up, deposit request or wallet prompt on this site as a way to lose money or credentials.

Evidence
VirusTotal shows 16 of 92 engines flagging the domain as of 2026-10-09. That is a solid minority from independent vendors, including alphaMountain.ai, BitDefender, CRDF, CyRadar, DNS8, ESET, Forcepoint ThreatSeeker and Fortinet. Spamhaus lists it in its Domain Block List under the spam category, which affects how mail and traffic referencing it are treated. Five AlienVault OTX threat pulses also reference the domain, so other researchers are tracking it too.

Infrastructure
The site resolves to a server in the Netherlands on the Omegatech LTD network, registered in Seychelles. Its certificate comes from Let's Encrypt, a free automated issuer. The padlock in the browser only means the connection is encrypted and says nothing about whether the operator is trustworthy.

What to do
If you visited wolfkapitthal.de, do not return or follow any instructions it gave. If you typed a password there, change it everywhere you reused it and turn on two-factor authentication. If you sent a payment or shared card details, contact your bank or payment provider immediately and ask about a chargeback. Do not pay any further fee the site or its contacts demand to release funds. Defenders should block the domain and its hosting IP at DNS and proxy level, check logs for earlier connections, and alert users who may have interacted with it.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a11ea3-1f45-76ea-a2f5-11cae473ec1d/
VirusTotal report: https://www.virustotal.com/gui/domain/wolfkapitthal.de
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=wolfkapitthal.de
Archived copy: https://web.archive.org/web/20261009165430/https://wolfkapitthal.de/
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 10:40:25 UTC

## Stored page captures

- Primary capture: https://urlscan.io/screenshots/01a11ea3-1f45-76ea-a2f5-11cae473ec1d.png
  Captured: 2026-10-09 03:11:30 UTC
- URLScan capture: https://screenshots.phishdestroy.io/01a11ea3-1f45-76ea-a2f5-11cae473ec1d.png
  Captured: 2026-10-09 03:11:30 UTC
  Source report: https://urlscan.io/result/01a11ea3-1f45-76ea-a2f5-11cae473ec1d/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/91f81f0e-ecd1-41f3-8093-94f5eaf7d80d.png
  Captured: 2026-10-09 03:43:32 UTC
  Source report: https://radar.cloudflare.com/scan/91f81f0e-ecd1-41f3-8093-94f5eaf7d80d
  SHA-256: 5e59883e82de3ba7ee6b5af91908256b2590f696f53cb3e84d825d31bb808029
- URLQuery: https://screenshots.phishdestroy.io/uq/f6f9d94c-0bac-4dbf-add4-a7e7c7ae0233.png
  Source report: https://urlquery.net/report/f6f9d94c-0bac-4dbf-add4-a7e7c7ae0233
  SHA-256: e64abd1b5fc29d66fec56d30c150bbe6602c41d07e4eae4b1004981c57c75d0c
- URLScan · 2026-07-28: https://screenshots.phishdestroy.io/us/019fa82d-46d6-73aa-8936-8cc14f495cfd.png
  Captured: 2026-07-28 10:02:53 UTC
  Source report: https://urlscan.io/result/019fa82d-46d6-73aa-8936-8cc14f495cfd/
  SHA-256: 5446a487b52b7030687eb06af514825d072f376c422cfe601dd494931c95c791
- URLScan · 2026-08-02: https://screenshots.phishdestroy.io/us/019fc39e-6961-71fb-9d52-77e2776293ec.png
  Captured: 2026-08-02 17:56:12 UTC
  Source report: https://urlscan.io/result/019fc39e-6961-71fb-9d52-77e2776293ec/
  SHA-256: a367da92ee8129831d77489cc53b723c0293b0b89153d774383f04e6390c2a22
- URLScan · 2026-10-09: https://screenshots.phishdestroy.io/us/01a11ea1-5339-71e8-b642-8a3a95c84265.png
  Captured: 2026-10-09 03:07:37 UTC
  Source report: https://urlscan.io/result/01a11ea1-5339-71e8-b642-8a3a95c84265/
  SHA-256: a367da92ee8129831d77489cc53b723c0293b0b89153d774383f04e6390c2a22

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-20T18:37:26Z",
        "uuid": "01a11ea3-1f45-76ea-a2f5-11cae473ec1d",
        "scanned_at": "2026-10-09T03:09:52Z",
        "final_url": "https://wolfkapitthal.de/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://wolfkapitthal.de/",
                "from": "http://wolfkapitthal.de/",
                "status": 307
            }
        ],
        "ip": "158.94.210.119",
        "ips": [
            "158.94.210.119"
        ],
        "asns": [
            "202412"
        ],
        "countries": [
            "NL"
        ],
        "doc_hash": "598e440ab0f4361a620b0f3880a2f37222cd68a2b1ff83703f9277032be751fd",
        "script_hashes": [
            "8aa5f8f647356dcd4fc5dbbe0efd5bc0e8da74026bc61e24636e2e1f5749b0ce"
        ],
        "globals": [
            "__dclq",
            "__dclOrig",
            "__dclFlush",
            "__smsCheckBeforeSubmit",
            "__isSmsEnabled",
            "__isSmsVerified",
            "intlTelInput"
        ],
        "tls": {
            "san": [
                "wolfkapitthal.de"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "YE2",
            "subject": "wolfkapitthal.de",
            "protocol": "TLS 1.3",
            "valid_to": "2026-11-27T06:58:49Z",
            "valid_from": "2026-08-29T06:58:50Z"
        },
        "domain_age_days": 108,
        "apex_age_days": 108,
        "tls_age_days": 40,
        "tls_valid_days": 89,
        "requests": 5,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 77,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "content-type": "text/html; charset=utf-8",
            "x-content-type-options": "nosniff"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-20T18:47:23Z",
        "uuid": "91f81f0e-ecd1-41f3-8093-94f5eaf7d80d",
        "scanned_at": "2026-10-09T03:43:32Z",
        "final_url": "https://wolfkapitthal.de/",
        "status": 200,
        "history": [
            {
                "url": "https://wolfkapitthal.de/",
                "status": 200
            }
        ],
        "dom_hash": "bab8b2ecc852c395f42a9f863fbb3da413bdb89790cd073821afb78f6bc6fcd6",
        "doc_hash": "4c3fb37fc15882fd824dfce672b7bf3788e62c9ac5d4c069491a9ab0cc3cc757",
        "phishing_v2": [
            "phishing"
        ],
        "url_risks": [
            "Scam"
        ],
        "domain_risks": [
            "Malware",
            "Security threats",
            "Scam",
            "CIPA Filter",
            "CIPA"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "wolfkapitthal.de",
                "type": "A",
                "value": "158.94.210.119"
            }
        ],
        "dnssec_valid": false,
        "ip": "158.94.210.119",
        "verdict": {
            "tags": [
                "malware"
            ],
            "malicious": true,
            "categories": [
                "malware"
            ]
        },
        "whois": {
            "updated": "2026-08-28T10:11:02Z",
            "nameservers": [
                "ns1.dyna-ns.net",
                "ns2.dyna-ns.net"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-21T04:41:19Z",
        "analysis_at": "2026-10-17T11:47:42Z",
        "stats": {
            "timeout": 0,
            "harmless": 44,
            "malicious": 14,
            "suspicious": 4,
            "undetected": 30
        },
        "detections": {
            "CRDF": "malicious",
            "DNS8": "suspicious",
            "ESET": "suspicious",
            "VIPRE": "phishing",
            "G-Data": "phishing",
            "Lionic": "phishing",
            "Sophos": "phishing",
            "CyRadar": "phishing",
            "Fortinet": "spam",
            "Netcraft": "malicious",
            "SOCRadar": "phishing",
            "URLQuery": "malicious",
            "Kaspersky": "phishing",
            "Seclookup": "malicious",
            "Gridinsoft": "suspicious",
            "BitDefender": "phishing",
            "alphaMountain.ai": "phishing",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "first_seen": "2026-06-22T11:17:01Z",
        "dns": [
            {
                "ttl": 300,
                "type": "NS",
                "value": "ns2.dyna-ns.net"
            },
            {
                "ttl": 300,
                "type": "NS",
                "value": "ns1.dyna-ns.net"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "158.94.210.119"
            },
            {
                "ttl": 300,
                "type": "SOA",
                "rname": "hostmaster.wolfkapitthal.de",
                "value": "ns1.dyna-ns.net"
            }
        ],
        "dns_at": "2026-10-17T11:53:07Z",
        "jarm": "40d40d40d00000000043d43d00043d6aff5ab0f4fc31897186312c9e639319",
        "cert": {
            "san": [
                "wolfkapitthal.de"
            ],
            "issuer": "Let's Encrypt / YE2",
            "serial": "6e0ee4eed6598d8c570b59c1d8cb4909982",
            "sha256": "233ae6f3249100917cbe212932147ff598fa816870bf1972dbdd1b00ea403361",
            "subject": "wolfkapitthal.de",
            "valid_to": "2026-11-27T06:58:49Z",
            "valid_from": "2026-08-29T06:58:50Z"
        },
        "rdap": {
            "status": [
                "active"
            ],
            "events": {
                "last changed": "2026-08-28T10:11:02Z"
            }
        }
    }
}
```