# PhishDestroy domain threat record: zukunfttreuhand.de

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/zukunfttreuhand.de/
Machine-readable companion: https://phishdestroy.io/domain/zukunfttreuhand.de/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-09 03:02:02 UTC
- Last availability or vendor check: 2026-10-22 10:37:55 UTC
- Stored record updated: 2026-10-22 16:07:29 UTC
- VirusTotal detections in the stored snapshot: 17/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: zelle

## Stored infrastructure

- Observed IP address: 158.94.210.119
- Registrar in stored WHOIS data: REGISTRAR_NOT_FOUND
- Last stored HTTP status: 200

## Evidence links

- URLScan report: https://urlscan.io/result/01a11eb5-125d-70da-b4bd-1e32c97b98c2/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/zukunfttreuhand.de
- Certificate Transparency search: https://crt.sh/?q=%25.zukunfttreuhand.de
- Web Archive lookup: https://web.archive.org/web/*/https://zukunfttreuhand.de/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
zukunfttreuhand.de presents itself as "Zukunft Treuhand - KI-Trading", a name that borrows the credibility of a German Treuhand, or fiduciary trust firm, and pairs it with promises of AI-driven trading. It targets German-speaking savers and retail investors who are looking for managed or automated returns. PhishDestroy first flagged it on 2026-10-09. On 2026-10-19 the site was still online and serving its content.

How the scam works
Sites in this category pose as a trustworthy investment manager and pitch an AI trading system that supposedly earns steady profits. Victims are usually asked to register with personal details, then pushed by phone or messenger "advisors" to deposit money, often by bank transfer or cryptocurrency. A dashboard shows invented gains to encourage larger deposits. When the victim tries to withdraw, new "taxes", "fees" or verification payments appear, and the money already sent is gone. The identity details collected along the way can also be reused for further fraud.

Evidence
On 2026-10-09, 17 of 92 VirusTotal engines classified the domain as malicious. The vendors included BitDefender, ESET, Fortinet, Forcepoint ThreatSeeker, alphaMountain.ai, CRDF, CyRadar and DNS8. Detection by that many independent vendors on the same day PhishDestroy found it points to a recognisable fraud pattern, not a single false positive. The domain also appears in 3 AlienVault OTX threat pulses and on the PhishDestroy blocklist.

Infrastructure
The site is hosted in the Netherlands on AS202412, operated by Omegatech LTD, so a German-language "Treuhand" brand is running from a foreign network. Its certificate comes from Let's Encrypt, which means the padlock in the browser only confirms an encrypted connection. It says nothing about whether the business behind the site is real.

What to do
Do not deposit anything further and ignore any demand for withdrawal fees, taxes or "release" payments, because these are part of the scam. If you have paid, contact your bank or payment provider right away to attempt a recall, and report the case to the police with transaction records and chat logs. If you shared ID documents or personal data, watch for identity misuse and be suspicious of later "recovery" offers. Change any password you reused on the site. Defenders should block the domain and its hosting IP and report it to the hosting network and the relevant registry.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a11eb5-125d-70da-b4bd-1e32c97b98c2/
VirusTotal report: https://www.virustotal.com/gui/domain/zukunfttreuhand.de
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=zukunfttreuhand.de
Archived copy: https://web.archive.org/web/20261009164308/https://zukunfttreuhand.de/
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 10:57:03 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/gFg3JjY8/937ecafaff66.png
  Captured: 2026-10-09 03:30:31 UTC
- URLScan capture 1: https://screenshots.phishdestroy.io/01a11eb5-125d-70da-b4bd-1e32c97b98c2.png
  Captured: 2026-10-09 03:30:31 UTC
  Source report: https://urlscan.io/result/01a11eb5-125d-70da-b4bd-1e32c97b98c2/
- URLScan capture 2: https://urlscan.io/screenshots/019f8b41-159d-707d-b7a8-7617af17fc12.png
  Captured: 2026-10-09 03:02:02 UTC
  Source report: https://urlscan.io/result/01a11eb5-125d-70da-b4bd-1e32c97b98c2/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/1b7d4e40-e263-41c0-9b4f-06b86cde98f0.png
  Captured: 2026-10-09 03:07:18 UTC
  Source report: https://radar.cloudflare.com/scan/1b7d4e40-e263-41c0-9b4f-06b86cde98f0
  SHA-256: 7b11af89a3acc00a7cd7456dd498589eeea65f346925f5ac493c95c9bc6623f2
- URLQuery: https://screenshots.phishdestroy.io/uq/d7ffa02a-1eac-4e6e-b655-78e3027ebc4c.png
  Source report: https://urlquery.net/report/d7ffa02a-1eac-4e6e-b655-78e3027ebc4c
  SHA-256: ede536709cc31c5fe33c62ee26faa0e7284f9c6e1d0e6a62c0c03086767ed5b8
- URLScan · 2026-07-23: https://screenshots.phishdestroy.io/us/019f8e6a-eb7b-7023-b678-671338968448.png
  Captured: 2026-07-23 10:00:06 UTC
  Source report: https://urlscan.io/result/019f8e6a-eb7b-7023-b678-671338968448/
  SHA-256: 7fa0b6abb2bc1b6e7765b0a8235961e8be6252eee2fc55ce6a793dc702bb290c
- URLScan · 2026-10-09: https://screenshots.phishdestroy.io/us/01a11ea6-e25f-71af-ade2-8a9d6af724b6.png
  Captured: 2026-10-09 03:13:42 UTC
  Source report: https://urlscan.io/result/01a11ea6-e25f-71af-ade2-8a9d6af724b6/
  SHA-256: e6ff35f4162f1f95cfac6fbb67d34c4e5a9cbb8741ad6366141b5445c9b3d064
- URLScan · 2026-10-09: https://screenshots.phishdestroy.io/us/01a11eaa-7c5c-7541-8ec2-392e186ec530.png
  Captured: 2026-10-09 03:17:38 UTC
  Source report: https://urlscan.io/result/01a11eaa-7c5c-7541-8ec2-392e186ec530/
  SHA-256: 5fa21b368871b89e446390f3fde7421080ff6ba0aca4616aaf88f8f3511169a7

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-20T18:37:36Z",
        "uuid": "01a11eb5-125d-70da-b4bd-1e32c97b98c2",
        "scanned_at": "2026-10-09T03:29:15Z",
        "final_url": "https://zukunfttreuhand.de/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://zukunfttreuhand.de/",
                "from": "http://zukunfttreuhand.de/",
                "status": 307
            }
        ],
        "ip": "158.94.210.119",
        "ips": [
            "158.94.210.119"
        ],
        "asns": [
            "202412"
        ],
        "countries": [
            "NL"
        ],
        "doc_hash": "4296641bf6b41c75dd4b0666d1943babc9a08c237981c6190edcf5b8fa126f4c",
        "script_hashes": [
            "8aa5f8f647356dcd4fc5dbbe0efd5bc0e8da74026bc61e24636e2e1f5749b0ce"
        ],
        "globals": [
            "__dclq",
            "__dclOrig",
            "__dclFlush",
            "__smsCheckBeforeSubmit",
            "__isSmsEnabled",
            "__isSmsVerified",
            "intlTelInput",
            "navToggle",
            "mainNav",
            "langBtn",
            "langDropdown"
        ],
        "tls": {
            "san": [
                "zukunfttreuhand.de"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "YE1",
            "subject": "zukunfttreuhand.de",
            "protocol": "TLS 1.3",
            "valid_to": "2026-11-29T17:58:58Z",
            "valid_from": "2026-08-31T17:58:59Z"
        },
        "domain_age_days": 171,
        "apex_age_days": 171,
        "tls_age_days": 38,
        "tls_valid_days": 89,
        "requests": 5,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 94,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "content-type": "text/html; charset=utf-8",
            "x-content-type-options": "nosniff"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-20T18:47:33Z",
        "uuid": "1b7d4e40-e263-41c0-9b4f-06b86cde98f0",
        "scanned_at": "2026-10-09T03:07:18Z",
        "final_url": "https://zukunfttreuhand.de/",
        "status": 200,
        "history": [
            {
                "url": "https://zukunfttreuhand.de/",
                "status": 200
            }
        ],
        "dom_hash": "15f2bb68b621f4c6b470074d01c124cddcf11947a8de3f72ad35ac1b26853696",
        "doc_hash": "cf2f252627466fe7569f89f28672d517cb8d14c5e236d8acc726917f54b4e444",
        "url_risks": [
            "Scam"
        ],
        "domain_risks": [
            "Scam",
            "Security threats",
            "Malware",
            "CIPA Filter",
            "CIPA"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "zukunfttreuhand.de",
                "type": "A",
                "value": "158.94.210.119"
            }
        ],
        "dnssec_valid": false,
        "ip": "158.94.210.119",
        "verdict": {
            "tags": [
                "malware"
            ],
            "malicious": true,
            "categories": [
                "malware"
            ]
        },
        "whois": {
            "updated": "2026-08-31T17:03:31Z",
            "nameservers": [
                "ns1.dyna-ns.net",
                "ns2.dyna-ns.net"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-21T04:41:29Z",
        "analysis_at": "2026-10-20T03:49:27Z",
        "stats": {
            "timeout": 0,
            "harmless": 43,
            "malicious": 15,
            "suspicious": 3,
            "undetected": 31
        },
        "detections": {
            "CRDF": "malicious",
            "DNS8": "suspicious",
            "ESET": "suspicious",
            "VIPRE": "malware",
            "G-Data": "phishing",
            "Lionic": "phishing",
            "Sophos": "phishing",
            "Fortinet": "phishing",
            "Netcraft": "malicious",
            "SOCRadar": "phishing",
            "URLQuery": "malicious",
            "Kaspersky": "phishing",
            "Seclookup": "malicious",
            "Gridinsoft": "suspicious",
            "BitDefender": "phishing",
            "Chong Lua Dao": "malicious",
            "alphaMountain.ai": "phishing",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "tags": [
            "dga"
        ],
        "first_seen": "2026-04-20T14:27:50Z",
        "dns": [
            {
                "ttl": 300,
                "type": "NS",
                "value": "ns1.dyna-ns.net"
            },
            {
                "ttl": 300,
                "type": "NS",
                "value": "ns2.dyna-ns.net"
            },
            {
                "ttl": 300,
                "type": "SOA",
                "rname": "hostmaster.zukunfttreuhand.de",
                "value": "ns1.dyna-ns.net"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "158.94.210.119"
            }
        ],
        "dns_at": "2026-10-20T03:57:01Z",
        "jarm": "40d40d40d00000000043d43d00043d6aff5ab0f4fc31897186312c9e639319",
        "cert": {
            "san": [
                "zukunfttreuhand.de"
            ],
            "issuer": "Let's Encrypt / YE1",
            "serial": "575e6e92da1d3837d70c2f28bcd9979a2c2",
            "sha256": "ae38b7688a06027c7a6e5bfe7a24c15742dea49591190d1b8673f0a2c05a7c67",
            "subject": "zukunfttreuhand.de",
            "valid_to": "2026-11-29T17:58:58Z",
            "valid_from": "2026-08-31T17:58:59Z"
        },
        "rdap": {
            "status": [
                "active"
            ],
            "events": {
                "last changed": "2026-08-31T17:03:31Z"
            }
        }
    }
}
```