# PhishDestroy domain threat record: zyncrogeldtradetrade.de Content language: English Canonical HTML report: https://phishdestroy.io/domain/zyncrogeldtradetrade.de/ Machine-readable companion: https://phishdestroy.io/domain/zyncrogeldtradetrade.de/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-10-09 03:02:35 UTC - Last availability or vendor check: 2026-10-22 10:38:08 UTC - Stored record updated: 2026-10-22 16:07:29 UTC - VirusTotal detections in the stored snapshot: 17/92 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: no stored flag ## Stored classification - Targeted brand: zelle ## Stored infrastructure - Observed IP address: 158.94.210.119 - Registrar in stored WHOIS data: REGISTRAR_NOT_FOUND - Last stored HTTP status: 200 ## Evidence links - URLScan report: https://urlscan.io/result/01a11ec9-63cc-775f-b6c3-b8c9d5a8a84a/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/zyncrogeldtradetrade.de - Certificate Transparency search: https://crt.sh/?q=%25.zyncrogeldtradetrade.de - Web Archive lookup: https://web.archive.org/web/*/https://zyncrogeldtradetrade.de/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview zyncrogeldtradetrade.de is an impersonation phishing page that presents itself as "Zyncrogeldtrade – Vertrauenswürdige KI-Handelsplattform", a supposedly trustworthy AI trading platform. The German-language title and the .de domain point at German-speaking retail investors drawn in by promises of automated profits. The doubled "trade" in the domain name is a lookalike pattern built to catch people searching for the brand. PhishDestroy first flagged it on 2026-10-09, and the site was still live with its content intact on 2026-10-19. How the scam works Sites in this scheme pitch an AI trading bot that supposedly earns steady returns, then collect a name, email and phone number through a sign-up form. Victims are usually called by so-called account managers who push a first deposit, then larger ones, while a dashboard shows invented gains. When the victim tries to withdraw, new taxes, fees or verification payments appear, and the money is never returned. Victims lose their deposits, often their identity documents, and sometimes control of their computer if they are talked into installing remote-access software. Evidence 17 of 92 VirusTotal engines flag the domain as of 2026-10-09. That is a solid minority verdict from separate vendors, including alphaMountain.ai, BitDefender, Chong Lua Dao, CRDF, CyRadar, DNS8, ESET and Forcepoint ThreatSeeker. The domain also appears in three AlienVault OTX threat pulses, so other researchers have tracked it independently. It is listed on the PhishDestroy blocklist. Infrastructure The site resolves to 158.94.210.119 on AS202412 Omegatech LTD, hosted in the Netherlands. That is far from the German audience the page addresses, which is common for this kind of throwaway trading front. Its Let's Encrypt (YE2) certificate puts a padlock in the browser, but the padlock only means the connection is encrypted and says nothing about whether the operator is legitimate. What to do Do not deposit anything, and do not pay any "withdrawal fee" or "tax" to get money back, because those payments only feed the scam. If you already paid, contact your bank or card issuer right away to dispute or recall the transfers, and report the case to the police. If you shared ID documents, watch for identity misuse. Uninstall any remote-access tool a "broker" asked you to install, change passwords used on that computer, and expect follow-up calls from fake recovery services. Defenders should block the domain and its hosting IP, and flag inbound traffic or ads mentioning Zyncrogeldtrade. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a11ec9-63cc-775f-b6c3-b8c9d5a8a84a/ VirusTotal report: https://www.virustotal.com/gui/domain/zyncrogeldtradetrade.de Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=zyncrogeldtradetrade.de Archived copy: https://web.archive.org/web/20261009230551/https://zyncrogeldtradetrade.de/ Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-19 09:28:36 UTC ## Stored page captures - Primary capture: https://i.ibb.co/jPfNz9L5/a9f78fee8465.png Captured: 2026-10-09 03:52:57 UTC - URLScan capture 1: https://screenshots.phishdestroy.io/01a11ec9-63cc-775f-b6c3-b8c9d5a8a84a.png Captured: 2026-10-09 03:52:57 UTC Source report: https://urlscan.io/result/01a11ec9-63cc-775f-b6c3-b8c9d5a8a84a/ - URLScan capture 2: https://urlscan.io/screenshots/019f8b78-2802-72ac-82d1-dce265d46746.png Captured: 2026-10-09 03:02:35 UTC Source report: https://urlscan.io/result/01a11ec9-63cc-775f-b6c3-b8c9d5a8a84a/ - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/2c2bc88c-3abd-4506-a408-8c5cec479608.png Captured: 2026-10-09 03:07:09 UTC Source report: https://radar.cloudflare.com/scan/2c2bc88c-3abd-4506-a408-8c5cec479608 SHA-256: 33624d34ba2fdfd7cb17f05ba9eee466083268d5446fdfaaf77ca77c9f807c3b - URLQuery: https://screenshots.phishdestroy.io/uq/24e5f0bd-8867-41cd-9df3-574cb492c734.png Source report: https://urlquery.net/report/24e5f0bd-8867-41cd-9df3-574cb492c734 SHA-256: 927b8eed969f2cd4da7a4213355ba9b19717e0a3127e45ba7e8e6ddf6d0ad452 - URLScan · 2026-07-23: https://screenshots.phishdestroy.io/us/019f8e6b-0a39-76b5-b004-b63e2820d11d.png Captured: 2026-07-23 10:00:13 UTC Source report: https://urlscan.io/result/019f8e6b-0a39-76b5-b004-b63e2820d11d/ SHA-256: d4c6bb916f19f00698aba8b7572ce04e7d09484ef25c5dfb80a3acbc9fbb2458 - URLScan · 2026-08-05: https://screenshots.phishdestroy.io/us/019fd1b7-e7d7-73ec-a1c8-882b78ce1119.png Captured: 2026-08-05 11:38:45 UTC Source report: https://urlscan.io/result/019fd1b7-e7d7-73ec-a1c8-882b78ce1119/ SHA-256: 242a072b21d995ca75555775b5fec75ebac8c34cce94156f9bf3113293aa654f - URLScan · 2026-08-05: https://screenshots.phishdestroy.io/us/019fd2c0-92c5-72ac-9f77-c23e563e77c9.png Captured: 2026-08-05 16:27:56 UTC Source report: https://urlscan.io/result/019fd2c0-92c5-72ac-9f77-c23e563e77c9/ SHA-256: ba1927460a157eb11c7b4d04749dae764c0a54e12f62f0c3298f2f1129f3b328 - URLScan · 2026-10-09: https://screenshots.phishdestroy.io/us/01a11ea7-b34d-7634-832f-0a6a9b11bb9d.png Captured: 2026-10-09 03:14:36 UTC Source report: https://urlscan.io/result/01a11ea7-b34d-7634-832f-0a6a9b11bb9d/ SHA-256: 770a0c6234523b7da8123b988ebb8d21d71c9075778b8408f59e4bb139b782bf - URLScan · 2026-10-09: https://screenshots.phishdestroy.io/us/01a11eaa-95ad-765d-8981-961c844aa987.png Captured: 2026-10-09 03:17:44 UTC Source report: https://urlscan.io/result/01a11eaa-95ad-765d-8981-961c844aa987/ SHA-256: 2340e6b6385fccaefa0d6e83824a9490951338d1f43ae1e26ca36819b56fe25b - URLScan · 2026-10-09: https://screenshots.phishdestroy.io/us/01a11ec3-3328-7318-977f-e2871535f898.png Captured: 2026-10-09 03:44:39 UTC Source report: https://urlscan.io/result/01a11ec3-3328-7318-977f-e2871535f898/ SHA-256: 2340e6b6385fccaefa0d6e83824a9490951338d1f43ae1e26ca36819b56fe25b ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-20T18:37:45Z", "uuid": "01a11ec9-63cc-775f-b6c3-b8c9d5a8a84a", "scanned_at": "2026-10-09T03:51:34Z", "final_url": "https://zyncrogeldtradetrade.de/", "status": 200, "redirected": "https-only", "redirects": [ { "to": "https://zyncrogeldtradetrade.de/", "from": "http://zyncrogeldtradetrade.de/", "status": 307 } ], "ip": "158.94.210.119", "ips": [ "158.94.210.119" ], "asns": [ "202412" ], "countries": [ "NL" ], "doc_hash": "b5a212282a072a3f2add645c63983e28f21d529fe972a26acb4538bd1019a323", "script_hashes": [ "8aa5f8f647356dcd4fc5dbbe0efd5bc0e8da74026bc61e24636e2e1f5749b0ce" ], "globals": [ "__dclq", "__dclOrig", "__dclFlush", "__smsCheckBeforeSubmit", "__isSmsEnabled", "__isSmsVerified", "intlTelInput", "langSwitcher", "langBtn", "navToggle", "navMobile", "triggers" ], "tls": { "san": [ "zyncrogeldtradetrade.de" ], "cipher": "AES_128_GCM", "issuer": "YE2", "subject": "zyncrogeldtradetrade.de", "protocol": "TLS 1.3", "valid_to": "2026-11-26T02:32:48Z", "valid_from": "2026-08-28T02:32:49Z" }, "domain_age_days": 178, "apex_age_days": 178, "tls_age_days": 42, "tls_valid_days": 89, "requests": 5, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 89, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "content-type": "text/html; charset=utf-8", "x-content-type-options": "nosniff" } }, "cf": { "v": 1, "fetched_at": "2026-10-20T18:47:33Z", "uuid": "2c2bc88c-3abd-4506-a408-8c5cec479608", "scanned_at": "2026-10-09T03:07:09Z", "final_url": "https://zyncrogeldtradetrade.de/", "status": 200, "history": [ { "url": "https://zyncrogeldtradetrade.de/", "status": 200 } ], "dom_hash": "a372810f01a7cfe317ecde2199ac7e1591fbc585cfd6238e8d318de172882d2b", "doc_hash": "51036f1f58bd4f411b3b153cb79ec0f11384f95d5cb6f00ffaf5101874f93aa5", "url_risks": [ "Scam" ], "domain_risks": [ "Malware", "Security threats", "Scam", "CIPA Filter", "CIPA" ], "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "zyncrogeldtradetrade.de", "type": "A", "value": "158.94.210.119" } ], "dnssec_valid": false, "ip": "158.94.210.119", "verdict": { "tags": [ "malware" ], "malicious": true, "categories": [ "malware" ] }, "whois": { "updated": "2026-08-31T18:28:15Z", "nameservers": [ "ns1.dyna-ns.net", "ns2.dyna-ns.net" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-21T04:41:30Z", "analysis_at": "2026-10-19T03:45:49Z", "stats": { "timeout": 0, "harmless": 43, "malicious": 15, "suspicious": 3, "undetected": 31 }, "detections": { "CRDF": "malicious", "DNS8": "suspicious", "ESET": "suspicious", "VIPRE": "phishing", "G-Data": "phishing", "Lionic": "phishing", "Sophos": "phishing", "CyRadar": "phishing", "Fortinet": "phishing", "Netcraft": "malicious", "SOCRadar": "phishing", "Kaspersky": "phishing", "Seclookup": "malicious", "Gridinsoft": "suspicious", "BitDefender": "phishing", "Chong Lua Dao": "malicious", "alphaMountain.ai": "phishing", "Forcepoint ThreatSeeker": "phishing" }, "reputation": 0, "first_seen": "2026-04-13T21:22:05Z", "dns": [ { "ttl": 300, "type": "SOA", "rname": "hostmaster.zyncrogeldtradetrade.de", "value": "ns1.dyna-ns.net" }, { "ttl": 300, "type": "NS", "value": "ns1.dyna-ns.net" }, { "ttl": 300, "type": "A", "value": "158.94.210.119" }, { "ttl": 300, "type": "NS", "value": "ns2.dyna-ns.net" } ], "dns_at": "2026-10-19T03:51:08Z", "jarm": "40d40d40d00000000043d43d00043d6aff5ab0f4fc31897186312c9e639319", "cert": { "san": [ "zyncrogeldtradetrade.de" ], "issuer": "Let's Encrypt / YE2", "serial": "66d411b08a3c9c820e4fcbb43fac3c232d5", "sha256": "e884be8a226aa0748b47f86c9c3f11297eb2f013ef5058c2cf764e5f1cd0f654", "subject": "zyncrogeldtradetrade.de", "valid_to": "2026-11-26T02:32:48Z", "valid_from": "2026-08-28T02:32:49Z" }, "rdap": { "status": [ "active" ], "events": { "last changed": "2026-08-31T18:28:15Z" } } } } ```