# PhishDestroy domain threat record: enviro-safe.co Content language: English Canonical HTML report: https://phishdestroy.io/domain/enviro-safe.co/ Machine-readable companion: https://phishdestroy.io/domain/enviro-safe.co/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-09-07 20:26:28 UTC - Last availability or vendor check: 2026-10-22 10:32:37 UTC - Stored record updated: 2026-10-22 16:07:29 UTC - VirusTotal detections in the stored snapshot: 16/89 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: no stored flag ## Stored infrastructure - Observed IP address: 192.185.14.170 - Registrar in stored WHOIS data: Wild West Domains, Inc. - Registrar country in stored WHOIS data: Unknown - Last stored HTTP status: 200 - Registration date (registry RDAP, enviro-safe.co): 2012-03-05 19:50:23 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a07d8b-8246-7458-9eae-501f9dcae1cb/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/enviro-safe.co - Certificate Transparency search: https://crt.sh/?q=%25.enviro-safe.co - Web Archive lookup: https://web.archive.org/web/*/https://enviro-safe.co/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview enviro-safe.co is classified by PhishDestroy as an impersonation phishing page. It presents itself as a legitimate site to win the trust of visitors and extract their information. PhishDestroy first flagged it on 2026-09-07. As of 2026-10-19 the domain was still online and serving content. How the scam works Impersonation pages copy the look, wording and branding of a site people already trust. Visitors who arrive through a search result, ad, email or message believe they are on the real service, then enter credentials, personal details or payment information that go straight to the operators. Victims can lose account access, money and identity data that may be reused in later fraud. The page title currently reads "Not Acceptable!", which looks like a server error message, while our classification is impersonation phishing. Evidence On 2026-09-11, 16 of 89 VirusTotal engines flagged the domain. The flagging vendors included Criminal IP, alphaMountain.ai, BitDefender, Chong Lua Dao, CyRadar, ESET, Emsisoft and Forcepoint ThreatSeeker. That is a meaningful spread of independent vendors, though most engines had not yet caught up. The domain also appears in 33 AlienVault OTX threat pulses, which shows it has been tracked repeatedly across the threat-intelligence community. It is listed on the PhishDestroy blocklist. Infrastructure The domain was registered on 2012-03-05 through Wild West Domains, Inc., more than fourteen years before PhishDestroy detected it. That makes it an aged domain rather than a throwaway registration, and filters that rely on domain age may treat it as trustworthy. It resolves to 192.185.14.170 on a network attributed to Oracle Corporation in the United States. What to do If you entered a username or password on enviro-safe.co, change that password right away on the real service and on any other account that uses the same one. Then turn on two-factor authentication and review recent logins for unfamiliar activity. If you submitted card or bank details, contact your bank to block the card and dispute any charges you did not make. Expect follow-up phishing that uses whatever personal data you shared. Security teams should block the domain and its IP at the DNS, proxy and email gateway level. They should also search logs for past visits to identify users who may need credential resets. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a07d8b-8246-7458-9eae-501f9dcae1cb/ VirusTotal report: https://www.virustotal.com/gui/domain/enviro-safe.co Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=enviro-safe.co Archived copy: https://web.archive.org/web/20250322022757/http://enviro-safe.co/ Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-19 09:47:46 UTC ## Stored page captures - Primary capture: https://i.ibb.co/BVmwDYbG/1b2a19846013.png Captured: 2026-09-07 20:26:28 UTC - URLScan capture: https://screenshots.phishdestroy.io/01a07d8b-8246-7458-9eae-501f9dcae1cb.png Captured: 2026-09-07 20:26:28 UTC Source report: https://urlscan.io/result/01a07d8b-8246-7458-9eae-501f9dcae1cb/ - URLQuery: https://screenshots.phishdestroy.io/uq/a29000b9-352d-491b-9337-05c79fe0daf9.png Captured: 2026-09-07 20:44:38 UTC Source report: https://urlquery.net/report/a29000b9-352d-491b-9337-05c79fe0daf9 SHA-256: 5185a96ae7e9a0fa63c6b6cd6d51ff737c0b62b4e101a696d235828ed478b785 - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/807eddce-1b17-423f-8118-2385750fbe00.png Captured: 2026-09-07 21:05:33 UTC Source report: https://radar.cloudflare.com/scan/807eddce-1b17-423f-8118-2385750fbe00 SHA-256: 833a8ca279a927b749432b5f50e920c467c3ad915feb966d2a93228368dda970 - URLScan ยท 2026-09-07: https://screenshots.phishdestroy.io/us/01a07d80-bc82-7707-b015-35cbea18c80e.png Captured: 2026-09-07 20:13:11 UTC Source report: https://urlscan.io/result/01a07d80-bc82-7707-b015-35cbea18c80e/ SHA-256: d69d6b24e24899906cacdff8f065bfa82297e794f3b513799ae21368861db0e3 ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-21T02:28:42Z", "uuid": "01a07d8b-8246-7458-9eae-501f9dcae1cb", "scanned_at": "2026-09-07T20:24:57Z", "final_url": "https://k-o.live/zRg0r5", "status": 200, "redirected": "off-domain", "redirects": [ { "to": "https://enviro-safe.co/", "from": "http://enviro-safe.co/", "status": 307 }, { "to": "http://k-o.live/zRg0r5", "from": "https://enviro-safe.co/" }, { "to": "https://k-o.live/zRg0r5", "from": "http://k-o.live/zRg0r5", "status": 307 } ], "ip": "103.224.182.251", "ptr": "lb-182-251.above.com", "domains": [ "assets.abovedomains.com", "i.imgur.com", "enviro-safe.co" ], "ips": [ "37.19.207.38", "199.232.196.193", "103.224.182.251", "192.185.14.170" ], "asns": [ "60068", "54113", "133618", "31898" ], "countries": [ "US" ], "link_domains": [ "www.above.com" ], "doc_hash": "ad5ee54bd02b36f292ad63323a3db6d516e6daa0a635fc882ec4b42305b65197", "tls": { "san": [ "*.enviro-safe.co", "enviro-safe.co" ], "cipher": "AES_256_GCM", "issuer": "YR1", "subject": "enviro-safe.co", "protocol": "TLS 1.3", "valid_to": "2026-10-22T01:17:21Z", "valid_from": "2026-07-24T01:17:22Z" }, "domain_age_days": 1105, "apex_age_days": 1105, "tls_age_days": 3, "tls_valid_days": 89, "requests": 5, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 16, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "Apache", "content-type": "text/html" } }, "cf": { "v": 1, "fetched_at": "2026-10-21T03:57:59Z", "uuid": "807eddce-1b17-423f-8118-2385750fbe00", "scanned_at": "2026-09-07T21:05:33Z", "final_url": "https://enviro-safe.co/", "status": 200, "history": [ { "url": "https://enviro-safe.co/", "status": 200 } ], "dom_hash": "46a6e2bc64080b33dd285e66951a51b97fb527a02188420720bfe1c1e78e862d", "doc_hash": "ad5ee54bd02b36f292ad63323a3db6d516e6daa0a635fc882ec4b42305b65197", "domain_risks": [ "Business", "Business & Economy" ], "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "enviro-safe.co", "type": "A", "value": "192.185.14.170" } ], "dnssec_valid": false, "ip": "192.185.14.170" } } ```