# PhishDestroy domain threat record: ekotarla.com

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/ekotarla.com/
Machine-readable companion: https://phishdestroy.io/domain/ekotarla.com/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-25 16:09:08 UTC
- Last availability or vendor check: 2026-10-25 16:09:08 UTC
- Stored record updated: 2026-10-25 23:22:28 UTC
- VirusTotal detections in the stored snapshot: 15/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored infrastructure

- Observed IP address: 142.93.149.187
- Registrar in stored WHOIS data: Realtime Register B.V.
- Registration date in stored WHOIS data: 2026-02-15 07:20:07 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a173d1-4f99-723d-a4ff-12134b26a97d/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/ekotarla.com
- Certificate Transparency search: https://crt.sh/?q=%25.ekotarla.com
- Web Archive lookup: https://web.archive.org/web/*/https://ekotarla.com/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
PhishDestroy added ekotarla.com to its internal blocklist on 2026-10-25 under a trusted-auto rule. A page fetch on that date returned HTTP 204, indicating no content was delivered.

How the scam works
The listing reflects automated vendor detections that commonly associate domains with phishing or malware risks when no specific page context is captured. The exact technique cannot be confirmed from the recorded response.

Evidence
VirusTotal scanned the domain on 2026-10-20 and reported 15 detections from 92 engines, including 12 malicious and 3 suspicious labels from vendors such as BitDefender, ESET and Forcepoint ThreatSeeker. Google Safe Browsing checked on 2026-10-25 did not flag the domain. URLScan’s machine-learning engine gave a malicious score of 50 but an overall non-malicious verdict on 2026-10-25. Cloudflare Radar listed the domain as malicious for malware on 2026-10-25, and OTX recorded five pulses mentioning ekotarla.com.

Infrastructure
The domain was registered with Realtime Register B.V. on 2026-02-15 and is set to expire on 2027-02-15 under a client-transfer-prohibited status. On 2026-10-25 the recorded IP was 142.93.149.187, and the nameservers were ns1.hosting.com.tr and ns2.hosting.com.tr. The recorded TLS certificate was issued by Let’s Encrypt and valid from 2026-06-30 to 2026-09-28; DNSSEC was not enabled.

What to do
Visitors should avoid entering any credentials or downloading files from ekotarla.com. Security teams can block the domain at the firewall or proxy and monitor logs for connections to this exact address.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a173d1-4f99-723d-a4ff-12134b26a97d/
Cloudflare Radar report: https://radar.cloudflare.com/scan/741b8cdb-aa69-4d2b-a84b-7a426e5e0b7a
URLQuery report: https://urlquery.net/report/051c0020-79f4-46c3-8dbe-7bc9701b7691
Stored capture screenshot: https://i.ibb.co/8LHpBgpt/5b381495ee45.png
Cloudflare Radar screenshot (2026-10-25T16:43:50Z): https://screenshots.phishdestroy.io/cf/741b8cdb-aa69-4d2b-a84b-7a426e5e0b7a.png
URLQuery screenshot: https://screenshots.phishdestroy.io/uq/051c0020-79f4-46c3-8dbe-7bc9701b7691.png
VirusTotal report: https://www.virustotal.com/gui/domain/ekotarla.com
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=ekotarla.com
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-25 17:17:17 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/8LHpBgpt/5b381495ee45.png
  Captured: 2026-10-25 16:09:08 UTC
- URLScan capture: https://urlscan.io/screenshots/01a173d1-4f99-723d-a4ff-12134b26a97d.png
  Captured: 2026-10-25 16:09:08 UTC
  Source report: https://urlscan.io/result/01a173d1-4f99-723d-a4ff-12134b26a97d/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/741b8cdb-aa69-4d2b-a84b-7a426e5e0b7a.png
  Captured: 2026-10-25 16:43:50 UTC
  Source report: https://radar.cloudflare.com/scan/741b8cdb-aa69-4d2b-a84b-7a426e5e0b7a
  SHA-256: 96a59abe725d4e0d241f6bcaa63f73d50a1fe41cd70c4b2e013caaa89f707f1b
- URLQuery: https://screenshots.phishdestroy.io/uq/051c0020-79f4-46c3-8dbe-7bc9701b7691.png
  Source report: https://urlquery.net/report/051c0020-79f4-46c3-8dbe-7bc9701b7691
  SHA-256: 686a5210ecfc4c5eab472f59a452404adb15dc4abc519847fa55707065355a44

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-25T16:22:42Z",
        "uuid": "01a173d1-4f99-723d-a4ff-12134b26a97d",
        "scanned_at": "2026-10-25T16:08:51Z",
        "final_url": "http://ekotarla.com/",
        "status": 204,
        "ip": "142.93.149.187",
        "ips": [
            "142.93.149.187"
        ],
        "asns": [
            "14061"
        ],
        "countries": [
            "CA"
        ],
        "globals": [
            "assert",
            "getRequiredElement",
            "P",
            "S",
            "getRandomNum",
            "getTimeStamp",
            "Dimensions",
            "Config$2",
            "getGlobalConfig",
            "setGlobalConfig",
            "Config$1",
            "Config",
            "setMaxGapCoefficient",
            "setMaxObstacleLength",
            "Status",
            "A11yStrings",
            "RunnerClasses",
            "RunnerSounds",
            "RunnerEvents",
            "updateCanvasScaling",
            "getA11yString",
            "vibrate",
            "createCanvas",
            "decodeBase64ToArrayBuffer",
            "createAdjustedCollisionBox",
            "drawCollisionBoxes",
            "boxCompare",
            "toggleHelpBox",
            "diagnoseErrors",
            "portalSignin",
            "updateForDnsProbe",
            "getMainFrameErrorCssClass",
            "getMainFrameErrorIconCssClass",
            "getSubFrameErrorIconCssClass",
            "shouldShowSuggestionsSummaryList",
            "getSuggestionsSummaryItemCssClass",
            "reloadButtonClick",
            "downloadButtonClick",
            "detailsButtonClick",
            "setAutoFetchState"
        ],
        "domain_age_days": 251,
        "apex_age_days": 251,
        "requests": 1,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 50,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "nginx"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-25T17:16:48Z",
        "uuid": "741b8cdb-aa69-4d2b-a84b-7a426e5e0b7a",
        "scanned_at": "2026-10-25T16:43:50Z",
        "final_url": "https://ekotarla.com/",
        "history": [
            {
                "url": "https://ekotarla.com/",
                "status": 0
            }
        ],
        "dom_hash": "433a5e367a2aeb4769756ee4cc70d4ffb3e81ed2c2fddf9de5834d9d14dd2a4d",
        "domain_risks": [
            "Malware",
            "Security threats",
            "CIPA Filter",
            "CIPA"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "ekotarla.com",
                "type": "A",
                "value": "142.93.149.187"
            }
        ],
        "dnssec_valid": false,
        "verdict": {
            "tags": [
                "malware"
            ],
            "malicious": true,
            "categories": [
                "malware"
            ]
        },
        "whois": {
            "registrar": "Realtime Register B.V.",
            "created": "2026-02-15T08:20:07Z",
            "updated": "2026-02-15T08:20:08Z",
            "expires": "2027-02-15T08:20:07Z",
            "nameservers": [
                "ns1.hosting.com.tr",
                "ns2.hosting.com.tr"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-25T17:13:44Z",
        "analysis_at": "2026-10-20T03:49:46Z",
        "stats": {
            "timeout": 0,
            "harmless": 44,
            "malicious": 12,
            "suspicious": 3,
            "undetected": 33
        },
        "detections": {
            "DNS8": "suspicious",
            "ESET": "suspicious",
            "VIPRE": "phishing",
            "G-Data": "phishing",
            "Lionic": "phishing",
            "Sophos": "phishing",
            "Webroot": "malicious",
            "Fortinet": "phishing",
            "SOCRadar": "phishing",
            "Kaspersky": "phishing",
            "Gridinsoft": "suspicious",
            "BitDefender": "phishing",
            "Chong Lua Dao": "malicious",
            "alphaMountain.ai": "phishing",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "created": "2026-02-15T00:00:00Z",
        "updated": "2026-02-15T00:00:00Z",
        "first_seen": "2026-02-18T16:06:48Z",
        "dns": [
            {
                "ttl": 900,
                "type": "NS",
                "value": "ns1.hosting.com.tr"
            },
            {
                "ttl": 900,
                "type": "MX",
                "value": "ekotarla.com",
                "priority": 0
            },
            {
                "ttl": 900,
                "type": "SOA",
                "rname": "noc.hosting.com.tr",
                "value": "ns1.hosting.com.tr"
            },
            {
                "ttl": 900,
                "type": "NS",
                "value": "ns2.hosting.com.tr"
            },
            {
                "ttl": 900,
                "type": "TXT",
                "value": "v=spf1 ip4:77.245.159.85 include:_spf.hosting.com.tr -all"
            },
            {
                "ttl": 900,
                "type": "A",
                "value": "142.93.149.187"
            }
        ],
        "dns_at": "2026-10-20T03:56:10Z",
        "jarm": "28d28d28d00028d00042d42d000000e1ea2a807a629b496b664cf07ad7c08d",
        "cert": {
            "san": [
                "ekotarla.com"
            ],
            "issuer": "Let's Encrypt / YE1",
            "serial": "5992dc69fe5327fc72da25681289dafa63a",
            "sha256": "b804d0e0c1b746ff6f947b2875efdb290f4bb341b526a24c99c21cced27043c8",
            "subject": "ekotarla.com",
            "valid_to": "2026-09-28T10:22:24Z",
            "valid_from": "2026-06-30T10:22:25Z"
        },
        "whois": [],
        "rdap": {
            "status": [
                "client transfer prohibited"
            ],
            "events": {
                "expiration": "2027-02-15T08:20:07Z",
                "last changed": "2026-02-20T08:20:07Z",
                "registration": "2026-02-15T08:20:07Z",
                "registrar expiration": "2027-02-15T08:20:07Z",
                "last update of RDAP database": "2026-10-19T03:50:42Z"
            },
            "registrar": "REALTIME REGISTER B.V.",
            "registrar_iana_id": "839"
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-25T16:45:07Z",
        "mail_config": {
            "mx": [
                "ekotarla.com"
            ],
            "spf": "v=spf1 ip4:77.245.159.85 include:_spf.hosting.com.tr -all",
            "dkim": [
                "default"
            ],
            "dmarc": true,
            "dkim_bits": 2048,
            "spf_lookups": 1
        },
        "caa_records": {
            "domain": "ekotarla.com"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_by": [
                "CloudFlare Family"
            ],
            "blocked_count": 1
        },
        "ports": {
            "open": [
                25,
                80
            ]
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "77.245.156.176",
                    "host": "ns1.hosting.com.tr"
                },
                {
                    "ip": "104.247.178.109",
                    "host": "ns2.hosting.com.tr"
                }
            ],
            "zone": "ekotarla.com"
        },
        "location": {
            "ip": "142.93.149.187",
            "asn": "14061",
            "org": "DigitalOcean, LLC",
            "city": "Toronto",
            "country": "CA"
        },
        "dns": {
            "A": [
                "142.93.149.187"
            ],
            "MX": [
                "{\"exchange\": \"ekotarla.com\", \"priority\": 0}"
            ],
            "NS": [
                "ns1.hosting.com.tr",
                "ns2.hosting.com.tr"
            ],
            "SOA": "{\"nsname\": \"ns1.hosting.com.tr\", \"hostmaster\": \"noc.hosting.com.tr\", \"serial\": 2022020802, \"refresh\": 10800, \"retry\": 3600, \"expire\": 604800, \"minttl\": 300}",
            "TXT": [
                "v=spf1 ip4:77.245.159.85 include:_spf.hosting.com.tr -all"
            ]
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "get_ip": {
            "ip": "142.93.149.187",
            "family": 4
        },
        "whois": {
            "registrar": "Realtime Register B.V.",
            "created": "2026-02-15T08:20:07Z",
            "updated": "2026-02-15T08:20:08Z",
            "expires": "2027-02-15T08:20:07Z",
            "status": [
                "clientTransferProhibited https://icann.org/epp"
            ],
            "nameservers": [
                "ns1.hosting.com.tr",
                "ns2.hosting.com.tr"
            ]
        }
    }
}
```