# PhishDestroy domain threat record: blinkblink.eu

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/blinkblink.eu/
Machine-readable companion: https://phishdestroy.io/domain/blinkblink.eu/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-10 23:02:05 UTC
- Last availability or vendor check: 2026-10-22 10:32:12 UTC
- Stored record updated: 2026-10-22 16:07:29 UTC
- VirusTotal detections in the stored snapshot: 14/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored infrastructure

- Observed IP address: 5.83.210.1
- Registrar in stored WHOIS data: Domeneshop AS
- Last stored HTTP status: 307

## Evidence links

- URLScan report: https://urlscan.io/result/01a0e5df-b651-7466-a04b-de49ff5a6b28/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/blinkblink.eu
- Certificate Transparency search: https://crt.sh/?q=%25.blinkblink.eu
- Web Archive lookup: https://web.archive.org/web/*/https://blinkblink.eu/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
blinkblink.eu is a domain on the PhishDestroy blocklist. It has no confirmed scheme type yet, and no impersonated brand has been identified. PhishDestroy first saw it on 2026-10-11. On 2026-10-19 the site was still online and its content answered with a redirect, so the page visitors see may not be served by this domain itself.

How the scam works
The page title reads "blinkblink.eu is for sale", which looks like a parked domain listing, yet the domain sits on our blocklist and several security engines flag it. A live domain that redirects visitors elsewhere can send them to whatever destination the operator chooses, and that destination can change without notice. The practical risk is landing on a page that asks for logins, payment details or other sensitive input. Nothing seen so far ties it to a specific scheme, so anything it requests should be treated as untrusted.

Evidence
On 2026-10-12, VirusTotal showed 14 of 92 engines flagging the domain. They include BitDefender, ESET, G-Data, Forcepoint ThreatSeeker, alphaMountain.ai, Gridinsoft, CyRadar and the Vietnamese anti-scam project Chong Lua Dao. That is a minority of engines, but a meaningful one, because the flags come from unrelated vendors with independent detection pipelines. The domain also appears in 33 AlienVault OTX threat pulses, which means researchers have repeatedly tied it to reported malicious activity.

Infrastructure
The domain is registered through Domeneshop AS, a Norwegian registrar. It is hosted on The Constant Company, LLC network, a cloud provider, at a server located in the Netherlands. Its free, automated Let's Encrypt certificate means the padlock in the browser says nothing about who runs the site. The .eu name, European registrar and Dutch hosting give the domain a regionally legitimate look that a sale page alone would not need.

What to do
Do not follow the redirect or interact with any page it leads to. If you entered a password after landing there, change it, starting with any site where you reuse that password, and turn on two-factor authentication. If you entered card or banking details, contact your bank. Defenders should block blinkblink.eu at the DNS and proxy level, check logs for visits since 2026-10-11, and keep watching the domain, since its redirect target can change at any time.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a0e5df-b651-7466-a04b-de49ff5a6b28/
VirusTotal report: https://www.virustotal.com/gui/domain/blinkblink.eu
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=blinkblink.eu
Archived copy: https://web.archive.org/web/20180812073157/http://www.blinkblink.eu/
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 10:39:34 UTC

## Stored page captures

- Primary capture: https://urlscan.io/screenshots/01a0e5df-b651-7466-a04b-de49ff5a6b28.png
  Captured: 2026-10-10 23:02:05 UTC
- URLScan capture: https://screenshots.phishdestroy.io/01a0e5df-b651-7466-a04b-de49ff5a6b28.png
  Source report: https://urlscan.io/result/01a0e5df-b651-7466-a04b-de49ff5a6b28/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/966e3e51-ef13-423e-8a83-19ff7a613fee.png
  Captured: 2026-10-12 11:21:32 UTC
  Source report: https://radar.cloudflare.com/scan/966e3e51-ef13-423e-8a83-19ff7a613fee
  SHA-256: 335ae284596a49f319f2ba111cc93b983ede89d2b762e4e173aae8202716c408
- URLScan · 2026-10-10: https://screenshots.phishdestroy.io/us/01a12825-c2a7-73db-bd85-3ca1c9b0ba02.png
  Captured: 2026-10-10 23:28:52 UTC
  Source report: https://urlscan.io/result/01a12825-c2a7-73db-bd85-3ca1c9b0ba02/
  SHA-256: abe2457f3eb115973027d6bb93ff449485f7fe4823805194d500102ba53fe86d
- URLScan · 2026-10-10: https://screenshots.phishdestroy.io/us/01a1282e-6f35-74be-9a56-ca8ae809aa01.png
  Captured: 2026-10-10 23:38:40 UTC
  Source report: https://urlscan.io/result/01a1282e-6f35-74be-9a56-ca8ae809aa01/
  SHA-256: abe2457f3eb115973027d6bb93ff449485f7fe4823805194d500102ba53fe86d

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-20T17:52:19Z",
        "uuid": "01a0e5df-b651-7466-a04b-de49ff5a6b28",
        "scanned_at": "2026-09-28T02:37:27Z",
        "final_url": "https://blinkblink.eu/en-gb",
        "status": 200,
        "redirected": "same-domain",
        "redirects": [
            {
                "to": "https://blinkblink.eu/",
                "from": "http://blinkblink.eu/",
                "status": 307
            },
            {
                "to": "https://blinkblink.eu/en-gb",
                "from": "https://blinkblink.eu/",
                "status": 307
            }
        ],
        "ip": "5.83.210.1",
        "domains": [
            "buy.nameshift.com",
            "stats.nameshift.com",
            "cf.api.nameshift.com",
            "cf.stats.nameshift.com",
            "avatar.r2.nmshft.nl"
        ],
        "ips": [
            "66.241.125.170",
            "172.67.69.25",
            "104.26.11.146",
            "104.26.10.146",
            "5.83.210.1"
        ],
        "asns": [
            "40509",
            "13335",
            "20473"
        ],
        "countries": [
            "US",
            "GB"
        ],
        "link_domains": [
            "nameshift.com"
        ],
        "doc_hash": "dd7a0ca4d8ac0c05eec3da567f70b4190f5bdd67e6ce18395e01c76d70bfd1a1",
        "globals": [
            "requestResize",
            "__sveltekit_we07qz",
            "__svelte",
            "__nameshiftUmamiBeforeSend",
            "umami"
        ],
        "cookies": [
            "locale"
        ],
        "tls": {
            "san": [
                "deverleiders.nl",
                "www.benis.ch",
                "www.ayia.eu",
                "blinkblink.eu",
                "www.blinkblink.eu",
                "brokerplus.eu",
                "www.goldenshark.eu",
                "imservice.eu",
                "www.imservice.eu",
                "infohome.eu"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "WR1",
            "subject": "deverleiders.nl",
            "protocol": "TLS 1.3",
            "valid_to": "2026-10-12T21:13:55Z",
            "valid_from": "2026-07-14T21:13:56Z"
        },
        "domain_age_days": 2993,
        "apex_age_days": 2993,
        "tls_age_days": 75,
        "tls_valid_days": 89,
        "requests": 51,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": -35,
                "malicious": false
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "content-type": "text/html; charset=utf-8",
            "strict-transport-security": "max-age=31536000; includeSubDomains",
            "x-frame-options": "SAMEORIGIN",
            "x-content-type-options": "nosniff",
            "referrer-policy": "same-origin"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-20T18:03:14Z",
        "uuid": "966e3e51-ef13-423e-8a83-19ff7a613fee",
        "scanned_at": "2026-10-12T11:21:32Z",
        "final_url": "https://blinkblink.eu/en-us",
        "status": 200,
        "redirected": "same-domain",
        "history": [
            {
                "url": "https://blinkblink.eu/",
                "status": 307
            },
            {
                "url": "https://blinkblink.eu/en-us",
                "status": 200
            }
        ],
        "dom_hash": "214b86629731eb47c7f94403bd0d8de4443d29af9c9c36041a76f0d58abdbd06",
        "doc_hash": "f1a6470fe91bd39200cacf0aacfb9cfafc15dbee0e80049be3e05d97361f7a4b",
        "domain_risks": [
            "Parked & For Sale Domains",
            "Security Risks"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "blinkblink.eu",
                "type": "A",
                "value": "5.83.210.1"
            },
            {
                "name": "blinkblink.eu",
                "type": "AAAA",
                "value": "2a0e:4001:11::1"
            }
        ],
        "dnssec_valid": false,
        "ip": "5.83.210.1",
        "whois": {
            "registrar": "Domeneshop AS",
            "nameservers": [
                "ns2.nameshift.com",
                "6v15sj.ns3.nameshift.com",
                "ns1.nameshift.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-21T00:29:05Z",
        "analysis_at": "2026-10-03T13:49:27Z",
        "stats": {
            "timeout": 0,
            "harmless": 46,
            "malicious": 13,
            "suspicious": 0,
            "undetected": 33
        },
        "detections": {
            "ESET": "phishing",
            "VIPRE": "phishing",
            "G-Data": "phishing",
            "Lionic": "phishing",
            "Sophos": "phishing",
            "CyRadar": "phishing",
            "Kaspersky": "phishing",
            "Seclookup": "malicious",
            "Gridinsoft": "malicious",
            "BitDefender": "phishing",
            "Chong Lua Dao": "malicious",
            "alphaMountain.ai": "phishing",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "categories": {
            "alphaMountain.ai": "Phishing (alphaMountain.ai)"
        },
        "first_seen": "2023-10-05T13:10:46Z",
        "dns": [
            {
                "ttl": 1086,
                "type": "CAA",
                "value": ";"
            },
            {
                "ttl": 1800,
                "type": "TXT",
                "value": "v=spf1 -all"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "ns2.nameshift.com"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "6v15sj.ns3.nameshift.com"
            },
            {
                "ttl": 1800,
                "type": "MX",
                "priority": 0
            },
            {
                "ttl": 1086,
                "type": "CAA",
                "value": ";"
            },
            {
                "ttl": 1086,
                "type": "CAA",
                "value": "letsencrypt.org;validationmethods=http-01,dns-01"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "ns1.nameshift.com"
            },
            {
                "ttl": 1800,
                "type": "A",
                "value": "5.83.210.1"
            },
            {
                "ttl": 1800,
                "type": "SOA",
                "rname": "hostmaster.nameshift.com",
                "value": "ns1.nameshift.com"
            },
            {
                "ttl": 1800,
                "type": "AAAA",
                "value": "2a0e:4001:11::1"
            },
            {
                "ttl": 1086,
                "type": "CAA",
                "value": ";"
            },
            {
                "ttl": 1086,
                "type": "CAA",
                "value": "pki.goog;validationmethods=http-01,dns-01"
            }
        ],
        "dns_at": "2026-10-03T13:49:55Z",
        "jarm": "40d40d40d00000000043d43d00043d6aff5ab0f4fc31897186312c9e639319",
        "cert": {
            "san": [
                "digify.eu",
                "springkussensverhuur.nl",
                "hendyman.nl",
                "viskas.eu",
                "guardsfromabove.nl",
                "www.guardsfromabove.nl",
                "ecorecycling.org.uk",
                "www.ecorecycling.org.uk",
                "www.ayia.eu",
                "blinkblink.eu"
            ],
            "issuer": "Google Trust Services / WR1",
            "serial": "bcce027ec024a5b21907aabd5b05659d",
            "sha256": "68511d974b20444ed45614ff963a5a2e46b85acb127af0195fcd9daea5c3448e",
            "subject": "digify.eu",
            "valid_to": "2026-10-11T04:55:48Z",
            "valid_from": "2026-07-13T04:55:49Z"
        }
    }
}
```