# PhishDestroy domain threat record: fe.echo-test.uk Content language: English Canonical HTML report: https://phishdestroy.io/domain/fe.echo-test.uk/ Machine-readable companion: https://phishdestroy.io/domain/fe.echo-test.uk/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-10-11 11:19:07 UTC - Last availability or vendor check: 2026-10-22 10:38:20 UTC - Stored record updated: 2026-10-22 16:07:29 UTC - VirusTotal detections in the stored snapshot: 4/92 - Independent public blocklist matches in the stored snapshot: 2 - Matching public blocklists: MetaMask, SEAL - Google Safe Browsing stored result: no stored flag ## Stored classification - Targeted brand: MetaMask ## Stored infrastructure - Observed IP address: 95.154.198.137 - Registrar in stored WHOIS data: 123-Reg Limited t/a 123-reg - Last stored HTTP status: 301 - Registration date in stored WHOIS data: 2025-11-19 13:59:08 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a12aae-44b7-769a-b57d-1d5e118b4b9d/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/fe.echo-test.uk - Certificate Transparency search: https://crt.sh/?q=%25.fe.echo-test.uk - Web Archive lookup: https://web.archive.org/web/*/https://fe.echo-test.uk/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview fe.echo-test.uk is an impersonation phishing page that presents itself under the name "Echo" to pass as a legitimate service. Wallet-provider and security-alliance blocklists have flagged it, so its likely targets are crypto users who expect to find Echo there. PhishDestroy first detected it on 2026-10-11. On 2026-10-19 the site was still online and serving its content. How the scam works Impersonation pages like this copy the name and look of a known service, here branded "Echo", so visitors believe they are on the real thing. The visitor is then pushed into an action that hands control to the operator. That can mean typing login details, a recovery phrase or a private key, connecting a wallet, or signing a transaction or approval. Credentials let attackers take over accounts. A seed phrase or a malicious signature lets them move funds out of the wallet, and crypto transfers of this kind cannot be reversed. Evidence MetaMask and SEAL both list the domain alongside PhishDestroy, which means several groups focused on crypto threats reached the same verdict on their own. VirusTotal coverage is still thin. As of 2026-10-16, 4 of 92 engines flagged it: alphaMountain.ai, Forcepoint ThreatSeeker, Gridinsoft and SOCRadar. Because of that low count, many browsers and security tools may not warn visitors yet. Infrastructure The domain was registered on 2025-11-19 through 123-Reg Limited (t/a 123-reg), almost eleven months before PhishDestroy detected it. That gap suggests the domain was set up well in advance or used quietly before it was exposed. The "fe" subdomain on a name containing "test" fits a staging-style host rather than a brand's real site. It runs on the IOMART Cloud Services network in Great Britain, and its free Let's Encrypt certificate only means the padlock icon proves nothing about who runs the site. What to do Do not connect a wallet to this site or type any phrase or password into it. If you connected a wallet or signed anything there, review and revoke token approvals for that address, then move remaining assets to a new wallet whose seed phrase has never been entered online. If you entered a seed phrase or private key, treat that wallet as fully compromised. If you entered a password, change it everywhere you reused it and turn on app-based 2FA. Defenders should block the domain and its subdomains, check logs for any visits, and report it to the hosting network and the registrar. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a12aae-44b7-769a-b57d-1d5e118b4b9d/ VirusTotal report: https://www.virustotal.com/gui/domain/fe.echo-test.uk Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=fe.echo-test.uk Archived copy: https://web.archive.org/web/20261011112352/https://fe.echo-test.uk/ Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-19 09:26:40 UTC ## Stored page captures - Primary capture: https://urlscan.io/screenshots/01a12aae-44b7-769a-b57d-1d5e118b4b9d.png Captured: 2026-10-11 11:19:07 UTC - URLScan capture: https://screenshots.phishdestroy.io/01a12aae-44b7-769a-b57d-1d5e118b4b9d.png Captured: 2026-10-11 11:19:07 UTC Source report: https://urlscan.io/result/01a12aae-44b7-769a-b57d-1d5e118b4b9d/ - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/d4c55a1f-db67-4de0-8395-3a6628c17df7.png Captured: 2026-10-12 10:16:16 UTC Source report: https://radar.cloudflare.com/scan/d4c55a1f-db67-4de0-8395-3a6628c17df7 SHA-256: 7d997d12d751fa3dcef4634a06eb37294a1d4be7577774be573db9167c0fd7ae - URLQuery: https://screenshots.phishdestroy.io/uq/0257213f-9e57-4b27-9ec6-aa3bcdd984cd.png Source report: https://urlquery.net/report/0257213f-9e57-4b27-9ec6-aa3bcdd984cd SHA-256: 2c8742f58c5895cda50fe743c6eeb315956d8efe95f14893626fa03097812f1f - URLScan ยท 2026-10-11: https://screenshots.phishdestroy.io/us/01a12ab2-de05-73ee-9d74-96dd9398d928.png Captured: 2026-10-11 11:22:13 UTC Source report: https://urlscan.io/result/01a12ab2-de05-73ee-9d74-96dd9398d928/ SHA-256: 2d0a030bbc1c05155b2c00007f366a1d15e9662228c50c454fb72c27a9efb949 ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-20T17:53:30Z", "uuid": "01a12aae-44b7-769a-b57d-1d5e118b4b9d", "scanned_at": "2026-10-11T11:17:27Z", "final_url": "https://fe.echo-test.uk/", "status": 200, "redirected": "https-only", "redirects": [ { "to": "https://fe.echo-test.uk/", "from": "http://fe.echo-test.uk/", "status": 307 } ], "ip": "95.154.198.137", "domains": [ "fonts.gstatic.com", "fonts.googleapis.com", "be.echo-test.uk" ], "ips": [ "172.217.222.94", "172.253.63.95", "95.154.198.137" ], "asns": [ "15169", "20860" ], "countries": [ "US", "GB" ], "doc_hash": "3a54d7b7eb5be10357ca2e880a24bdd2845c9699f4fd4e50972375b25490e722", "script_hashes": [ "82233e7c65776d17ddaa66ecde6b52f3d5648e494e98074f1efcd6a07ac399d7" ], "globals": [ "__reactRouterVersion", "__framePainter" ], "cookies": [ "XSRF-TOKEN", "projectecho-session" ], "tls": { "san": [ "echo-test.uk", "fe.echo-test.uk", "www.echo-test.uk" ], "cipher": "AES_128_GCM", "issuer": "YE1", "subject": "echo-test.uk", "protocol": "TLS 1.3", "valid_to": "2026-12-10T10:53:44Z", "valid_from": "2026-09-11T10:53:45Z" }, "domain_age_days": 317, "apex_age_days": 325, "tls_age_days": 30, "tls_valid_days": 89, "requests": 13, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 95, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "nginx/1.20.1", "content-type": "text/html" } }, "cf": { "v": 1, "fetched_at": "2026-10-20T18:43:54Z", "uuid": "d4c55a1f-db67-4de0-8395-3a6628c17df7", "scanned_at": "2026-10-12T10:16:16Z", "final_url": "https://fe.echo-test.uk/", "status": 200, "history": [ { "url": "https://fe.echo-test.uk/", "status": 200 } ], "dom_hash": "84488142a51e293317e0ba8a45ed03a42388529549c37359db813e2496f62b2b", "doc_hash": "3a54d7b7eb5be10357ca2e880a24bdd2845c9699f4fd4e50972375b25490e722", "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "be.echo-test.uk", "type": "A", "value": "95.154.198.137" }, { "name": "fe.echo-test.uk", "type": "A", "value": "95.154.198.137" } ], "dnssec_valid": false, "ip": "95.154.198.137", "whois": { "registrar": "123-Reg Limited t/a 123-reg", "created": "2025-11-19T14:59:08Z", "updated": "2025-11-19T15:07:10Z", "expires": "2027-11-19T14:59:08Z", "nameservers": [ "julissa.ns.cloudflare.com.", "rex.ns.cloudflare.com." ] } }, "vt": { "v": 1, "fetched_at": "2026-10-21T02:36:48Z", "analysis_at": "2026-10-20T02:00:15Z", "stats": { "timeout": 0, "harmless": 55, "malicious": 2, "suspicious": 2, "undetected": 33 }, "detections": { "SOCRadar": "suspicious", "Gridinsoft": "suspicious", "alphaMountain.ai": "phishing", "Forcepoint ThreatSeeker": "phishing" }, "reputation": 0, "categories": { "alphaMountain.ai": "Phishing (alphaMountain.ai)", "Forcepoint ThreatSeeker": "phishing and other frauds" }, "created": "2025-11-19T00:00:00Z", "updated": "2025-11-19T00:00:00Z", "first_seen": "2025-11-27T16:23:26Z", "dns": [ { "ttl": 300, "type": "A", "value": "95.154.198.137" } ], "dns_at": "2026-10-20T02:00:29Z", "jarm": "27d40d40d00040d00042d43d0000004ac24e77d76646867f0f6a0c6d9b9bb0", "cert": { "san": [ "echo-test.uk", "fe.echo-test.uk", "www.echo-test.uk" ], "issuer": "Let's Encrypt / YE1", "serial": "674b264424cc677055960ad82b51af85cfe", "sha256": "9c180a0c050c095f028834292c100ae52c1d9a36bdb920285c8ea09817773276", "subject": "echo-test.uk", "valid_to": "2026-12-10T10:53:44Z", "valid_from": "2026-09-11T10:53:45Z" }, "whois": [] } } ```