# PhishDestroy domain threat record: easy-f.org Content language: English Canonical HTML report: https://phishdestroy.io/domain/easy-f.org/ Machine-readable companion: https://phishdestroy.io/domain/easy-f.org/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-10-24 15:39:35 UTC - Last availability or vendor check: 2026-10-24 15:39:35 UTC - Stored record updated: 2026-10-24 18:30:24 UTC - VirusTotal detections in the stored snapshot: 0/92 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: no stored flag ## Stored infrastructure - Observed IP address: 172.67.186.188 - Registrar in stored WHOIS data: NAMECHEAP INC - Registrar country in stored WHOIS data: US - Registration date in stored WHOIS data: 2026-05-11 18:03:39 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a16e90-6cfa-7267-b70f-da06f0d38a53/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/easy-f.org - Certificate Transparency search: https://crt.sh/?q=%25.easy-f.org - Web Archive lookup: https://web.archive.org/web/*/https://easy-f.org/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview PhishDestroy’s intake AI classified the site as malicious because the page presents itself as a financial trading platform offering crypto plans, a pattern typical of fraudulent investment schemes. The domain was first seen by PhishDestroy on 2026-10-24 when a fresh URLScan scan returned a malicious verdict. A fetch on that date returned HTTP 200 for the root page of easy-f.org, confirming the page was reachable at the time. How the scam works Fake trading platforms lure victims by promising high returns on crypto or other assets, then request deposits, personal data, or wallet connections to steal funds. They often mimic legitimate broker branding to create trust and pressure users into rapid action. Evidence URLScan recorded a malicious verdict with a 94‑score and phishing tags on 2026-10-24 (uuid 01a16c3a‑...), and a later scan of the /service/ path also flagged malicious by engine analysis on the same day. VirusTotal checked the domain on 2026-10-24 with 92 engines and reported zero malicious or suspicious detections. Google Safe Browsing did not flag the domain, external blocklists contained no entries, OTX listed five pulses referencing the domain, and PhishDestroy’s internal blocklist marks it as malicious. Infrastructure The domain was registered with NameCheap on 2026-05-11, giving it an age of 165 days at first sighting. Hosting is provided through Cloudflare, resolving to IP 172.67.186.188 (and a secondary A record 104.21.43.228), and the TLS certificate from Let’s Encrypt is valid until 2026-12-06. What to do Do not enter credentials, personal data, or financial information on the site; if any were submitted, change passwords and monitor accounts for unauthorized activity. Security teams should block the exact domain easy-f.org, log DNS queries for it, and add it to internal blocklists to prevent future access. No further remediation related to wallets is required based on the current evidence. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a16e90-6cfa-7267-b70f-da06f0d38a53/ Cloudflare Radar report: https://radar.cloudflare.com/scan/13245c89-c87f-4ef6-933b-2755d9d1a105 URLQuery report: https://urlquery.net/report/aa693cc9-7c3a-4d2a-9473-7afd7a2d0455 Stored capture screenshot: https://i.ibb.co/rK506D7f/b31da3ec8845.png Cloudflare Radar screenshot (2026-10-24T16:09:59Z): https://screenshots.phishdestroy.io/cf/13245c89-c87f-4ef6-933b-2755d9d1a105.png URLScan screenshot (2026-10-24T04:46:13Z): https://screenshots.phishdestroy.io/us/01a16c3a-9085-734d-a35a-1bc1247c7c9d.png URLScan capture report: https://urlscan.io/result/01a16c3a-9085-734d-a35a-1bc1247c7c9d/ URLScan screenshot (2026-10-24T15:42:47Z): https://screenshots.phishdestroy.io/us/01a16e93-a59a-7776-9a69-f4db4ad5a160.png URLScan capture report: https://urlscan.io/result/01a16e93-a59a-7776-9a69-f4db4ad5a160/ VirusTotal report: https://www.virustotal.com/gui/domain/easy-f.org Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=easy-f.org Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-24 16:10:59 UTC ## Stored page captures - Primary capture: https://i.ibb.co/rK506D7f/b31da3ec8845.png Captured: 2026-10-24 15:39:35 UTC - URLScan capture 1: https://screenshots.phishdestroy.io/01a16e90-6cfa-7267-b70f-da06f0d38a53.png Captured: 2026-10-24 15:39:35 UTC Source report: https://urlscan.io/result/01a16e90-6cfa-7267-b70f-da06f0d38a53/ - URLScan capture 2: https://urlscan.io/screenshots/01a16c3a-9085-734d-a35a-1bc1247c7c9d.png Captured: 2026-10-24 15:38:22 UTC Source report: https://urlscan.io/result/01a16e90-6cfa-7267-b70f-da06f0d38a53/ - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/13245c89-c87f-4ef6-933b-2755d9d1a105.png Captured: 2026-10-24 16:09:59 UTC Source report: https://radar.cloudflare.com/scan/13245c89-c87f-4ef6-933b-2755d9d1a105 SHA-256: de762a2f243423f1cd8662817b10dd210ec41103a6c9fd2ec439c7803dea0074 - URLScan · 2026-10-24: https://screenshots.phishdestroy.io/us/01a16c3a-9085-734d-a35a-1bc1247c7c9d.png Captured: 2026-10-24 04:46:13 UTC Source report: https://urlscan.io/result/01a16c3a-9085-734d-a35a-1bc1247c7c9d/ SHA-256: a7e8deed3d322da35dc3b1ed777d7c92cacd35dbac2c5c93c88ae3db56b63216 - URLScan · 2026-10-24: https://screenshots.phishdestroy.io/us/01a16e93-a59a-7776-9a69-f4db4ad5a160.png Captured: 2026-10-24 15:42:47 UTC Source report: https://urlscan.io/result/01a16e93-a59a-7776-9a69-f4db4ad5a160/ SHA-256: 748ba5cae5fb1a4c0b6b43082c7ec79ad68cf04085f4747f3042b7eb8a89cfaa ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-24T16:01:37Z", "uuid": "01a16e90-6cfa-7267-b70f-da06f0d38a53", "scanned_at": "2026-10-24T15:38:48Z", "final_url": "https://easy-f.org/service/", "status": 200, "ip": "172.67.186.188", "domains": [ "cdn.jsdelivr.net", "cdnjs.cloudflare.com", "ipapi.co", "fonts.gstatic.com", "fonts.googleapis.com" ], "ips": [ "104.26.9.44", "142.251.110.94", "142.251.14.95", "104.17.24.14", "151.101.193.229", "172.67.186.188" ], "asns": [ "13335", "15169", "54113" ], "countries": [ "US" ], "link_domains": [ "wa.me" ], "social": [ "https://wa.me/16478483297" ], "doc_hash": "a80119972de367d52fb71ab7c47d0fee08c042782cd3ed761aec1a9fe7aeea4d", "script_hashes": [ "2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8", "88b6de5159276f881f61a8f5f7a2851a9cfecc3c1f1f5cc374f931663ee9a9cc", "a32f766f2db51e03c7b2ca639b479f52e620b26004302a5408ad3c59ac9aeefa", "c992063f637336424b97021d69ec7cafdde1e0b60f44027b1ece44ce6b1026b9", "17b18307699b67e749b8eda9784d775fcf67142738da1eff34c33e04cac2ac08" ], "globals": [ "REDIRECT", "ALLOW_REGISTRATION", "PROMOCODE", "TERMS_AGREE", "simpleParallax", "gsapVersions", "Linear", "Power0", "Quad", "Power1", "Cubic", "Power2", "Quart", "Power3", "Quint", "Power4", "Strong", "Elastic", "Bounce", "Expo", "Circ", "Sine", "Back", "SteppedEase", "TweenLite", "TweenMax", "TimelineMax", "TimelineLite", "AttrPlugin", "EndArrayPlugin", "RoundPropsPlugin", "ModifiersPlugin", "SnapPlugin", "gsap", "CSSPlugin", "Observer", "ScrollTrigger", "TRADE_LINK", "calculatorAjax", "__core-js_shared__" ], "cookies": [ "language" ], "tls": { "san": [ "*.easy-f.org", "easy-f.org" ], "cipher": "AES_128_GCM", "issuer": "YE2", "subject": "easy-f.org", "protocol": "QUIC", "valid_to": "2026-12-06T01:28:05Z", "valid_from": "2026-09-07T01:28:06Z" }, "domain_age_days": 165, "apex_age_days": 165, "tls_age_days": 47, "tls_valid_days": 89, "requests": 47, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 94, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "cloudflare", "content-type": "text/html; charset=UTF-8", "x-powered-by": "PHP/8.3.35", "content-security-policy": "upgrade-insecure-requests" } }, "cf": { "v": 1, "fetched_at": "2026-10-24T16:10:15Z", "uuid": "13245c89-c87f-4ef6-933b-2755d9d1a105", "scanned_at": "2026-10-24T16:09:59Z", "final_url": "https://easy-f.org/cdn-cgi/phish-bypass", "status": 400, "history": [ { "url": "https://easy-f.org/", "status": 403 }, { "url": "https://easy-f.org/cdn-cgi/phish-bypass", "status": 400 } ], "dom_hash": "7fc99aa2d89e0695afe980fa5a4f6850d050e60e0805209b2ab086fa92f20e16", "doc_hash": "32fc365527f7af3f0c4da403cc38af0a76b3126d622684f2c4df062a71f90f1a", "domain_risks": [ "Brokerage & Investing", "Business & Economy" ], "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "easy-f.org", "type": "A", "value": "172.67.186.188" }, { "name": "easy-f.org", "type": "A", "value": "104.21.43.228" }, { "name": "easy-f.org", "type": "AAAA", "value": "2606:4700:3030::ac43:babc" }, { "name": "easy-f.org", "type": "AAAA", "value": "2606:4700:3033::6815:2be4" } ], "dnssec_valid": false, "ip": "172.67.186.188", "whois": { "registrar": "NameCheap, Inc.", "created": "2026-05-11T20:03:39Z", "updated": "2026-08-12T01:34:20Z", "expires": "2027-05-11T20:03:39Z", "nameservers": [ "margo.ns.cloudflare.com", "sneh.ns.cloudflare.com" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-24T16:09:55Z", "analysis_at": "2026-10-24T05:16:31Z", "stats": { "timeout": 0, "harmless": 54, "malicious": 0, "suspicious": 0, "undetected": 38 }, "reputation": 0, "registrar": "NAMECHEAP INC", "created": "2026-05-11T20:03:39Z", "expires": "2027-05-11T20:03:39Z", "updated": "2026-08-12T01:34:20Z", "first_seen": "2026-05-11T20:26:43Z", "dns": [ { "ttl": 300, "type": "AAAA", "value": "2606:4700:3030::ac43:babc" }, { "ttl": 300, "type": "A", "value": "172.67.186.188" }, { "ttl": 21600, "type": "NS", "value": "sneh.ns.cloudflare.com" }, { "ttl": 600, "type": "MX", "value": "mx3.zoho.eu", "priority": 50 }, { "ttl": 21600, "type": "NS", "value": "margo.ns.cloudflare.com" }, { "ttl": 600, "type": "MX", "value": "mx2.zoho.eu", "priority": 20 }, { "ttl": 600, "type": "MX", "value": "mx.zoho.eu", "priority": 10 }, { "ttl": 600, "type": "TXT", "value": "v=spf1 include:zohomail.eu ~all" }, { "ttl": 600, "type": "TXT", "value": "zoho-verification=zb75238780.zmverify.zoho.eu" }, { "ttl": 300, "type": "AAAA", "value": "2606:4700:3033::6815:2be4" }, { "ttl": 300, "type": "A", "value": "104.21.43.228" }, { "ttl": 1800, "type": "SOA", "rname": "dns.cloudflare.com", "value": "margo.ns.cloudflare.com" } ], "dns_at": "2026-10-24T05:21:53Z", "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c", "cert": { "san": [ "*.easy-f.org", "easy-f.org" ], "issuer": "Let's Encrypt / YE2", "serial": "5136c7d922b62e37d4b690bb17d6c817aec", "sha256": "be0f22e70d303639a20e41ec0b9a7e1aed820374f29040fabf63a06765cccc00", "subject": "easy-f.org", "valid_to": "2026-12-06T01:28:05Z", "valid_from": "2026-09-07T01:28:06Z" }, "whois": { "registrar": "NAMECHEAP INC", "registrar_iana_id": "1068", "registrar_url": "http://www.namecheap.com", "created": "2026-05-11T20:03:39Z", "updated": "1-01-01T00:00:00Z", "expires": "2027-05-11T20:03:39Z", "status": [ "clientTransferProhibited" ], "nameservers": [ "margo.ns.cloudflare.com", "sneh.ns.cloudflare.com" ], "dnssec": "unsigned" }, "rdap": { "status": [ "client transfer prohibited" ], "events": { "registration": "2026-05-11T20:03:39Z", "registrar expiration": "2027-05-11T20:03:39Z", "last update of RDAP database": "2026-10-17T06:10:18Z" } } }, "webcheck": { "v": 1, "fetched_at": "2026-10-24T16:10:28Z", "mail_config": { "mx": [ "mx.zoho.eu", "mx2.zoho.eu", "mx3.zoho.eu" ], "spf": "v=spf1 include:zohomail.eu ~all", "providers": [ "Zoho Mail" ], "spf_lookups": 2 }, "caa_records": { "domain": "easy-f.org" }, "block_lists": { "resolvers": 12, "blocked_count": 0 }, "robots_txt": { "agents": [ "*" ], "present": true }, "tls_connection": { "alpn": "h2", "cipher": "TLS_AES_256_GCM_SHA384", "protocol": "TLSv1.3", "versions": [ "TLSv1", "TLSv1.1", "TLSv1.2", "TLSv1.3" ], "authorized": true, "forward_secrecy": true }, "ports": { "open": [ 80, 443, 8080 ] }, "dns_server": { "ns": [ { "ip": "162.159.44.144", "host": "margo.ns.cloudflare.com" }, { "ip": "108.162.194.162", "host": "sneh.ns.cloudflare.com" } ], "zone": "easy-f.org" }, "location": { "ip": "2606:4700:3030::ac43:babc", "asn": "13335", "org": "Cloudflare, Inc.", "city": "Toronto", "country": "CA" }, "ssl": { "issuer": "Let's Encrypt / YE2", "subject": "easy-f.org" }, "dns": { "A": [ "104.21.43.228", "172.67.186.188" ], "MX": [ "{\"exchange\": \"mx3.zoho.eu\", \"priority\": 50}", "{\"exchange\": \"mx2.zoho.eu\", \"priority\": 20}", "{\"exchange\": \"mx.zoho.eu\", \"priority\": 10}" ], "NS": [ "sneh.ns.cloudflare.com", "margo.ns.cloudflare.com" ], "SOA": "{\"nsname\": \"margo.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2414265387, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}", "TXT": [ "zoho-verification=zb75238780.zmverify.zoho.eu", "v=spf1 include:zohomail.eu ~all" ], "AAAA": [ "2606:4700:3033::6815:2be4", "2606:4700:3030::ac43:babc" ] }, "dnssec": { "ds": false, "rrsig": false, "dnskey": false }, "hsts": { "message": "Site does not serve any HSTS headers." }, "http_security": { "xFrameOptions": "SAMEORIGIN", "referrerPolicy": "same-origin", "xXSSProtection": false, "permissionsPolicy": false, "xContentTypeOptions": false, "contentSecurityPolicy": false, "strictTransportPolicy": false, "crossOriginOpenerPolicy": false, "crossOriginEmbedderPolicy": false, "crossOriginResourcePolicy": false }, "firewall": { "waf": "Cloudflare", "has_waf": true }, "get_ip": { "ip": "2606:4700:3030::ac43:babc", "family": 6 }, "subdomains": { "count": 1, "subdomains": [ "www.easy-f.org" ] }, "whois": { "registrar": "NameCheap, Inc.", "created": "2026-05-11T20:03:39Z", "updated": "2026-08-12T01:34:20Z", "expires": "2027-05-11T20:03:39Z", "status": [ "clientTransferProhibited https://icann.org/epp" ], "nameservers": [ "margo.ns.cloudflare.com", "sneh.ns.cloudflare.com" ] }, "headers": { "headers": { "server": "cloudflare", "content-type": "text/html; charset=utf-8", "x-frame-options": "SAMEORIGIN", "referrer-policy": "same-origin" } } } } ```