# PhishDestroy domain threat record: ecloud4u.eu

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/ecloud4u.eu/
Machine-readable companion: https://phishdestroy.io/domain/ecloud4u.eu/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-11 11:45:58 UTC
- Last availability or vendor check: 2026-10-22 10:00:25 UTC
- Stored record updated: 2026-10-22 16:07:29 UTC
- VirusTotal detections in the stored snapshot: 17/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: microsoft

## Stored infrastructure

- Observed IP address: 20.215.12.1
- Registrar in stored WHOIS data: cyber_Folks S.A.
- Last stored HTTP status: 200

## Evidence links

- URLScan report: https://urlscan.io/result/01a0ce24-fc74-71ae-8a71-fff283bbae27/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/ecloud4u.eu
- Certificate Transparency search: https://crt.sh/?q=%25.ecloud4u.eu
- Web Archive lookup: https://web.archive.org/web/*/https://ecloud4u.eu/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
ecloud4u.eu is an impersonation phishing page. Its name evokes a European cloud service, and it is aimed at people who expect a familiar login or account portal. PhishDestroy first flagged it on 2026-10-11. As of 2026-10-19 the site was still online and serving its content, so anyone who receives a link to it can still reach it.

How the scam works
Impersonation pages copy the look and wording of a service the victim already trusts, then ask for a sign-in, account verification or payment details. Whatever is typed in goes to the operators, who can use it to take over the real account, reuse the password elsewhere or resell the data. The page title reads only "E3" and names no brand, while our classification is based on the site imitating a legitimate service. Victims typically arrive through emails or messages that warn about storage, billing or an account problem.

Evidence
On 2026-10-16, 17 of 92 VirusTotal engines flagged the domain as malicious. That is a meaningful minority from established vendors, including BitDefender, ESET, Fortinet, G-Data, Forcepoint ThreatSeeker, alphaMountain.ai, CRDF and CyRadar. The domain also appears in five AlienVault OTX threat pulses, which means other researchers have tracked it independently. It is listed on the PhishDestroy blocklist.

Infrastructure
The domain is registered through cyber_Folks S.A., a Polish registrar. It is hosted on Microsoft Corporation's network in Poland, so the site runs on mainstream cloud infrastructure rather than an obscure host, and IP reputation alone may not block it. It carries a valid certificate from DigiCert's GeoTrust TLS RSA CA G1. A padlock in the address bar therefore says nothing about whether the site is honest.

What to do
If you entered a password on ecloud4u.eu, change it right away on the genuine service and on any other account that uses the same password. Then turn on two-factor authentication and review recent sign-ins and active sessions. If you supplied card or banking details, contact your bank to block the card and dispute any charges. Treat any follow-up messages that reference your account with suspicion. Defenders should block the domain at DNS, proxy and mail gateways, and search logs for users who visited or submitted forms after 2026-10-11. They should also report the site to the hosting provider and registrar for takedown.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a0ce24-fc74-71ae-8a71-fff283bbae27/
VirusTotal report: https://www.virustotal.com/gui/domain/ecloud4u.eu
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=ecloud4u.eu
Archived copy: https://web.archive.org/web/20261011114837/https://ecloud4u.eu/
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 09:26:37 UTC

## Stored page captures

- Primary capture: https://urlscan.io/screenshots/01a0ce24-fc74-71ae-8a71-fff283bbae27.png
  Captured: 2026-10-11 11:45:58 UTC
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/b9025140-160c-49c9-9290-5d9d9f977bc1.png
  Captured: 2026-10-12 09:58:42 UTC
  Source report: https://radar.cloudflare.com/scan/b9025140-160c-49c9-9290-5d9d9f977bc1
  SHA-256: d4c3a008f39530b9b486763469645cdd8d7f40bb5fc185848c9f04bd7fad5c74
- URLScan · 2026-09-17: https://screenshots.phishdestroy.io/us/01a0ace0-b485-7739-b057-9eaea9b9c6ed.png
  Captured: 2026-09-17 01:00:10 UTC
  Source report: https://urlscan.io/result/01a0ace0-b485-7739-b057-9eaea9b9c6ed/
  SHA-256: d7df9e8a4d086776d9669e9106592bda96f69a730b490983328a1f3c5c4205d4
- URLScan · 2026-09-20: https://screenshots.phishdestroy.io/us/01a0bce0-38fd-7353-acbc-73e6e587c8a0.png
  Captured: 2026-09-20 03:33:33 UTC
  Source report: https://urlscan.io/result/01a0bce0-38fd-7353-acbc-73e6e587c8a0/
  SHA-256: ca5442e43a3f2298db463884cd7a491d81438b3505b242fe86428218c77671bc
- URLScan · 2026-10-11: https://screenshots.phishdestroy.io/us/01a12ac9-5df1-7164-a64f-de97810b0358.png
  Captured: 2026-10-11 11:47:03 UTC
  Source report: https://urlscan.io/result/01a12ac9-5df1-7164-a64f-de97810b0358/
  SHA-256: a7368d7a8a3ae3f2082ce8b82136f9557a97d563adf50885d02d1095fd8246dc

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-20T17:52:44Z",
        "uuid": "01a0ce24-fc74-71ae-8a71-fff283bbae27",
        "scanned_at": "2026-09-23T12:02:32Z",
        "final_url": "https://ecloud4u.eu/",
        "status": 200,
        "ip": "20.215.12.1",
        "domains": [
            "www.youtube.com",
            "jnn-pa.googleapis.com",
            "googleads.g.doubleclick.net",
            "www.gstatic.com",
            "yt3.ggpht.com",
            "i.ytimg.com",
            "www.google.com",
            "static.doubleclick.net",
            "fonts.gstatic.com"
        ],
        "ips": [
            "172.217.119.4",
            "173.194.204.94",
            "142.251.179.132",
            "172.253.62.119",
            "142.251.152.119",
            "209.85.144.149",
            "173.194.68.157",
            "142.251.16.94",
            "142.251.154.4",
            "20.215.12.1"
        ],
        "asns": [
            "15169",
            "8075"
        ],
        "countries": [
            "US",
            "PL"
        ],
        "doc_hash": "99e88917f5bf22c2b48fedafdb9e836c5855521db8bc46ca0f82ff214775779c",
        "script_hashes": [
            "ee84c928df35612bf49b68713cf7063307f12709631f4b4710abe06d6bc7d7a2"
        ],
        "globals": [
            "loadPage",
            "loadFooter",
            "loadNav",
            "loadHead",
            "calculateYearsSince",
            "loadSite",
            "cultureInfo",
            "dateString",
            "domain"
        ],
        "cookies": [
            "__Secure-YNID",
            "YSC",
            "VISITOR_INFO1_LIVE",
            "VISITOR_PRIVACY_METADATA",
            "__Secure-ROLLOUT_TOKEN"
        ],
        "tls": {
            "san": [
                "ecloud4u.eu"
            ],
            "cipher": "AES_256_GCM",
            "issuer": "GeoTrust TLS RSA CA G1",
            "subject": "ecloud4u.eu",
            "protocol": "TLS 1.3",
            "valid_to": "2026-12-05T23:59:59Z",
            "valid_from": "2026-06-05T00:00:00Z"
        },
        "domain_age_days": 421,
        "apex_age_days": 421,
        "tls_age_days": 110,
        "tls_valid_days": 183,
        "requests": 30,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": -58,
                "malicious": false
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "nginx/1.28.0",
            "content-type": "text/html"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-20T18:03:24Z",
        "uuid": "b9025140-160c-49c9-9290-5d9d9f977bc1",
        "scanned_at": "2026-10-12T09:58:42Z",
        "final_url": "https://ecloud4u.eu/",
        "status": 200,
        "history": [
            {
                "url": "https://ecloud4u.eu/",
                "status": 200
            }
        ],
        "dom_hash": "f95849c98095548bf296ff590f8563ee0ca69947709a36b638353033d65ba5df",
        "doc_hash": "99e88917f5bf22c2b48fedafdb9e836c5855521db8bc46ca0f82ff214775779c",
        "domain_risks": [
            "Phishing",
            "Security threats",
            "CIPA Filter",
            "CIPA"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "ecloud4u.eu",
                "type": "A",
                "value": "20.215.12.1"
            }
        ],
        "dnssec_valid": false,
        "ip": "20.215.12.1",
        "verdict": {
            "tags": [
                "phishing"
            ],
            "malicious": true,
            "categories": [
                "phishing"
            ]
        },
        "whois": {
            "registrar": "cyber_Folks S.A.",
            "nameservers": [
                "ns1-03.azure-dns.com",
                "ns4-03.azure-dns.info",
                "ns2-03.azure-dns.net",
                "ns3-03.azure-dns.org"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-21T00:29:24Z",
        "analysis_at": "2026-10-16T02:00:14Z",
        "stats": {
            "timeout": 0,
            "harmless": 43,
            "malicious": 17,
            "suspicious": 0,
            "undetected": 32
        },
        "detections": {
            "CRDF": "malicious",
            "ESET": "phishing",
            "VIPRE": "phishing",
            "G-Data": "phishing",
            "Lionic": "phishing",
            "Sophos": "phishing",
            "CyRadar": "phishing",
            "Fortinet": "phishing",
            "SOCRadar": "phishing",
            "URLQuery": "malicious",
            "Kaspersky": "phishing",
            "LevelBlue": "phishing",
            "Seclookup": "malicious",
            "Gridinsoft": "phishing",
            "BitDefender": "phishing",
            "alphaMountain.ai": "phishing",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "categories": {
            "Google": "technology",
            "Sophos": "phishing and fraud",
            "alphaMountain.ai": "Phishing (alphaMountain.ai)"
        },
        "first_seen": "2026-06-05T09:53:10Z",
        "dns": [
            {
                "ttl": 21600,
                "type": "NS",
                "value": "ns3-03.azure-dns.org"
            },
            {
                "ttl": 3600,
                "type": "TXT",
                "value": "v=spf1 include:spf.protection.outlook.com -all"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "ns2-03.azure-dns.net"
            },
            {
                "ttl": 3600,
                "type": "TXT",
                "value": "MS=34102425"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "ns1-03.azure-dns.com"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "ns4-03.azure-dns.info"
            },
            {
                "ttl": 3600,
                "type": "MX",
                "value": "ecloud4u-eu.mail.protection.outlook.com",
                "priority": 0
            },
            {
                "ttl": 3600,
                "type": "A",
                "value": "20.215.12.1"
            },
            {
                "ttl": 3600,
                "type": "SOA",
                "rname": "azuredns-hostmaster.microsoft.com",
                "value": "ns1-03.azure-dns.com"
            }
        ],
        "dns_at": "2026-10-16T02:03:03Z",
        "jarm": "2ad2ad00000000000042d42d00042da9006a0dbf6f6785a41d588d6e6fd492",
        "cert": {
            "san": [
                "ecloud4u.eu"
            ],
            "issuer": "DigiCert Inc / GeoTrust TLS RSA CA G1",
            "serial": "ca2fb841d4d1913d78342951fc532ca",
            "sha256": "e29d120eef1fc5c650b7fea9011c1ef5912595848071151ea8b9322cf83531e6",
            "subject": "ecloud4u.eu",
            "valid_to": "2027-03-27T23:59:59Z",
            "valid_from": "2026-09-27T00:00:00Z"
        }
    }
}
```