# PhishDestroy domain threat record: evurbroikacy.pro Content language: English Canonical HTML report: https://phishdestroy.io/domain/evurbroikacy.pro/ Machine-readable companion: https://phishdestroy.io/domain/evurbroikacy.pro/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: unknown - First observed by PhishDestroy: 2026-10-26 00:24:58 UTC - Stored record updated: 2026-10-26 02:50:55 UTC - VirusTotal detections in the stored snapshot: 14/92 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: no stored flag ## Stored infrastructure - Observed IP address: 185.7.78.66 - Registrar in stored WHOIS data: NameCheap, Inc. - Registration date in stored WHOIS data: 2026-09-03 16:07:54 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a06bcf-c92f-71bf-bc50-33122800f753/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/evurbroikacy.pro - Certificate Transparency search: https://crt.sh/?q=%25.evurbroikacy.pro - Web Archive lookup: https://web.archive.org/web/*/https://evurbroikacy.pro/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview PhishDestroy added evurbroikacy.pro to its internal blocklist on 2026-10-26 after an intake review flagged the domain based on multiple vendor detections. The domain was first observed by PhishDestroy on 2026-10-26, with a HTTP 200 response captured by urlscan on 2026-09-04. How the scam works The detections indicate the site may be used for phishing or malware distribution, but no concrete malicious payload or credential‑collection form was observed in the captured page. The listing reflects a general risk associated with domains that attract multiple vendor warnings. Evidence VirusTotal scanned the domain on 2026-10-24, finding 14 detections from 92 engines, of which 11 were labeled malicious and 3 suspicious. Google Safe Browsing checked on 2026-10-26 and did not flag the domain. urlscan captured a HTTPS page on 2026-09-04 that returned HTTP 200; its overall verdict was clean but its engine score marked the site as malicious. Cloudflare Radar on 2026-10-26 flagged the domain as malware‑related, OTX listed one pulse, and PhishDestroy’s internal blocklist includes the domain while external blocklists reported no hits on the check date. Infrastructure The domain was registered on 2026-09-03 through NameCheap, Inc., with a client‑transfer‑prohibited status. The domain was observed to resolve to IP 185.7.78.66, which the RDAP record listed under ASN 43350 (Nforce Entertainment) in the Netherlands, and its DNS was served by Cloudflare nameservers magali.ns.cloudflare.com and frank.ns.cloudflare.com. A TLS 1.3 certificate issued by Let’s Encrypt was recorded for evurbroikacy.pro, valid from 2026-09-03 to 2026-12-02, and ports 22, 80 and 443 were observed open during the scan. What to do Visitors should avoid entering credentials or downloading files; if any personal data was submitted, change the associated passwords immediately. Administrators should block evurbroikacy.pro at the network perimeter and monitor DNS and connection logs for traffic to the recorded IP. No wallet‑related remediation is applicable based on the current evidence. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a06bcf-c92f-71bf-bc50-33122800f753/ Cloudflare Radar report: https://radar.cloudflare.com/scan/b310f547-5c49-464f-a46c-8366602c78e1 Stored capture screenshot: https://urlscan.io/screenshots/01a06bcf-c92f-71bf-bc50-33122800f753.png Cloudflare Radar screenshot (2026-10-26T00:27:31Z): https://screenshots.phishdestroy.io/cf/b310f547-5c49-464f-a46c-8366602c78e1.png VirusTotal report: https://www.virustotal.com/gui/domain/evurbroikacy.pro Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=evurbroikacy.pro Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-26 00:29:37 UTC ## Stored page captures - Primary capture: https://urlscan.io/screenshots/01a06bcf-c92f-71bf-bc50-33122800f753.png Captured: 2026-10-26 00:24:58 UTC - URLScan capture: https://screenshots.phishdestroy.io/01a06bcf-c92f-71bf-bc50-33122800f753.png Source report: https://urlscan.io/result/01a06bcf-c92f-71bf-bc50-33122800f753/ - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/b310f547-5c49-464f-a46c-8366602c78e1.png Captured: 2026-10-26 00:27:31 UTC Source report: https://radar.cloudflare.com/scan/b310f547-5c49-464f-a46c-8366602c78e1 SHA-256: a5db7ab655d3900bfb2bf44f8483ca7ce06fc6f795376f14b777be50f1f0af62 - URLScan · 2026-09-03: https://screenshots.phishdestroy.io/us/01a06949-86c3-767e-a30c-efccdf6c6983.png Captured: 2026-09-03 22:00:27 UTC Source report: https://urlscan.io/result/01a06949-86c3-767e-a30c-efccdf6c6983/ SHA-256: df3ce695eeda95f111b61246eece94247a44e1cee863fd5d0198a9abfe6c9599 ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-26T00:28:49Z", "uuid": "01a06bcf-c92f-71bf-bc50-33122800f753", "scanned_at": "2026-09-04T09:46:21Z", "final_url": "https://evurbroikacy.pro/", "status": 200, "redirected": "https-only", "ip": "185.7.78.66", "ips": [ "185.7.78.66" ], "asns": [ "43350" ], "countries": [ "NL" ], "doc_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "tls": { "san": [ "evurbroikacy.pro" ], "cipher": "CHACHA20_POLY1305", "issuer": "YE2", "subject": "evurbroikacy.pro", "protocol": "TLS 1.3", "valid_to": "2026-12-02T19:09:09Z", "valid_from": "2026-09-03T19:09:10Z" }, "domain_age_days": 0, "apex_age_days": 0, "tls_age_days": 0, "tls_valid_days": 89, "requests": 2, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 94, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": [] }, "cf": { "v": 1, "fetched_at": "2026-10-26T00:28:51Z", "uuid": "b310f547-5c49-464f-a46c-8366602c78e1", "scanned_at": "2026-10-26T00:27:31Z", "final_url": "https://evurbroikacy.pro/", "history": [ { "url": "https://evurbroikacy.pro/", "status": 0 } ], "dom_hash": "94bfc7c24186e5b245b5675859fb84b248547086370961e5637590177432b219", "domain_risks": [ "Malware", "Security threats", "CIPA Filter", "CIPA" ], "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "evurbroikacy.pro", "type": "A", "value": "185.7.78.66" } ], "dnssec_valid": false, "verdict": { "tags": [ "malware" ], "malicious": true, "categories": [ "malware" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-26T00:26:13Z", "analysis_at": "2026-10-24T12:20:51Z", "stats": { "timeout": 0, "harmless": 45, "malicious": 11, "suspicious": 3, "undetected": 33 }, "detections": { "CRDF": "malicious", "ESET": "suspicious", "VIPRE": "phishing", "G-Data": "phishing", "Lionic": "phishing", "Sophos": "phishing", "Fortinet": "phishing", "SOCRadar": "phishing", "Kaspersky": "phishing", "LevelBlue": "suspicious", "Gridinsoft": "suspicious", "BitDefender": "phishing", "alphaMountain.ai": "phishing", "Forcepoint ThreatSeeker": "phishing" }, "reputation": 0, "tags": [ "dga" ], "first_seen": "2026-09-03T19:32:51Z", "dns": [ { "ttl": 21600, "type": "NS", "value": "frank.ns.cloudflare.com" }, { "ttl": 1800, "type": "SOA", "rname": "dns.cloudflare.com", "value": "frank.ns.cloudflare.com" }, { "ttl": 21600, "type": "NS", "value": "magali.ns.cloudflare.com" }, { "ttl": 60, "type": "A", "value": "185.7.78.66" } ], "dns_at": "2026-10-24T12:26:12Z", "jarm": "40d40d40d00000000043d43d00043d6aff5ab0f4fc31897186312c9e639319", "cert": { "san": [ "evurbroikacy.pro" ], "issuer": "Let's Encrypt / YE2", "serial": "51ca87b5e8c1c438eeea93ceda92d1ac4f6", "sha256": "e61ed14a854dd7a4bcc351949dd187cad9f2c23645c461ae74d5d2f8d1101414", "subject": "evurbroikacy.pro", "valid_to": "2026-12-02T19:09:09Z", "valid_from": "2026-09-03T19:09:10Z" }, "rdap": { "status": [ "client transfer prohibited" ], "events": { "registration": "2026-09-03T18:07:54Z", "registrar expiration": "2027-09-03T18:07:54Z", "last update of RDAP database": "2026-10-24T12:26:12Z" }, "registrar": "NAMECHEAP INC", "registrar_iana_id": "1068" } }, "webcheck": { "v": 1, "fetched_at": "2026-10-26T00:29:12Z", "mail_config": { "spf_lookups": 0 }, "caa_records": { "domain": "evurbroikacy.pro" }, "block_lists": { "resolvers": 12, "blocked_by": [ "CloudFlare Family" ], "blocked_count": 1 }, "ports": { "open": [ 22, 80, 443 ] }, "dns_server": { "ns": [ { "ip": "173.245.59.166", "host": "frank.ns.cloudflare.com" }, { "ip": "162.159.38.29", "host": "magali.ns.cloudflare.com" } ], "zone": "evurbroikacy.pro" }, "location": { "ip": "185.7.78.66", "asn": "43350", "org": "Nforce Entertainment", "city": "Roosendaal", "country": "NL" }, "dns": { "A": [ "185.7.78.66" ], "NS": [ "magali.ns.cloudflare.com", "frank.ns.cloudflare.com" ], "SOA": "{\"nsname\": \"frank.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2414134286, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}" }, "dnssec": { "ds": false, "rrsig": false, "dnskey": false }, "get_ip": { "ip": "185.7.78.66", "family": 4 } } } ```