# PhishDestroy domain threat record: groveandmerchant.eu

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/groveandmerchant.eu/
Machine-readable companion: https://phishdestroy.io/domain/groveandmerchant.eu/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-27 23:39:09 UTC
- Last availability or vendor check: 2026-10-28 00:00:09 UTC
- Stored record updated: 2026-10-28 00:16:49 UTC
- VirusTotal detections in the stored snapshot: 16/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored infrastructure

- Observed IP address: 213.109.192.154
- Registrar in stored WHOIS data: Namecheap, Inc

## Evidence links

- URLScan report: https://urlscan.io/result/01a17fcc-c04d-7658-afe9-f33cf6e7ed03/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/groveandmerchant.eu
- Certificate Transparency search: https://crt.sh/?q=%25.groveandmerchant.eu
- Web Archive lookup: https://web.archive.org/web/*/https://groveandmerchant.eu/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
PhishDestroy listed groveandmerchant.eu as a suspicious domain based on a trusted internal report. The recorded page title is "Welcome to AutoSMTP.com Ultimate Email Marketing Solution". The domain was first seen by PhishDestroy on 2026-10-28, when an HTTP 200 response was returned after a 307 redirect to HTTPS.

How the scam works
No specific malicious behavior was observed on the captured page. Domains that receive similar security‑engine detections are commonly used to host phishing pages, deliver malware, or harvest credentials, but the present evidence does not confirm any particular technique.

Evidence
VirusTotal analysis on 2026-10-23 reported 16 detections from 92 engines, including 13 malicious and 3 suspicious labels from vendors such as BitDefender, ESET and Fortinet. Google Safe Browsing checked on 2026-10-28 returned no flag. urlscan.io captured on 2026-10-28 gave a malicious engine score of 88 but an overall non‑malicious verdict. Cloudflare Radar on 2026-10-28 marked the domain as malicious under the "malware" category. OTX listed three pulses as of 2026-10-28. PhishDestroy’s internal blocklist flags the domain, while external blocklists showed zero hits on the same date.

Infrastructure
The domain is registered with Namecheap, Inc. The recorded IP address is 213.109.192.154, associated with BlueVPS OU in Italy. TLS is provided by a Let’s Encrypt certificate valid from 2026-05-21 to 2026-08-19, and DNSSEC is not enabled. DNS records include an A record, standard NS and MX records, and an SPF TXT record; the domain age is 159 days. Open ports observed include 22, 25, 53, 80, 110, 143, 443, 993, 995 and 3306.

What to do
Visitors should avoid entering any credentials or downloading files from this site and should change passwords if they suspect they have been entered. Security teams should block groveandmerchant.eu at the network perimeter and monitor outbound traffic for connections to the recorded IP address. Apply web‑filtering or DNS‑blocking rules specifically for this domain.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a17fcc-c04d-7658-afe9-f33cf6e7ed03/
Cloudflare Radar report: https://radar.cloudflare.com/scan/5f1c17fd-9667-4f53-9614-21999c723bea
Stored capture screenshot: https://urlscan.io/screenshots/01a17fcc-c04d-7658-afe9-f33cf6e7ed03.png
Cloudflare Radar screenshot (2026-10-27T23:41:57Z): https://screenshots.phishdestroy.io/cf/5f1c17fd-9667-4f53-9614-21999c723bea.png
VirusTotal report: https://www.virustotal.com/gui/domain/groveandmerchant.eu
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=groveandmerchant.eu
Archived copy: https://web.archive.org/web/20261027234324/https://groveandmerchant.eu/
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-28 00:14:33 UTC

## Stored page captures

- Primary capture: https://urlscan.io/screenshots/01a17fcc-c04d-7658-afe9-f33cf6e7ed03.png
  Captured: 2026-10-28 00:00:09 UTC
- URLScan capture 1: https://screenshots.phishdestroy.io/01a17fcc-c04d-7658-afe9-f33cf6e7ed03.png
  Captured: 2026-10-28 00:00:09 UTC
  Source report: https://urlscan.io/result/01a17fcc-c04d-7658-afe9-f33cf6e7ed03/
- URLScan capture 2: https://urlscan.io/screenshots/019e91e7-29f8-748d-9a42-fa181c6eb4bb.png
  Captured: 2026-10-27 23:39:09 UTC
  Source report: https://urlscan.io/result/01a17fcc-c04d-7658-afe9-f33cf6e7ed03/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/5f1c17fd-9667-4f53-9614-21999c723bea.png
  Captured: 2026-10-27 23:41:57 UTC
  Source report: https://radar.cloudflare.com/scan/5f1c17fd-9667-4f53-9614-21999c723bea
  SHA-256: a5db7ab655d3900bfb2bf44f8483ca7ce06fc6f795376f14b777be50f1f0af62
- URLQuery: https://screenshots.phishdestroy.io/uq/3289dad4-c10f-4974-9305-5e5fa1c061c4.png
  Source report: https://urlquery.net/report/3289dad4-c10f-4974-9305-5e5fa1c061c4
  SHA-256: c2966c79a21194c6b1944084441f513b6c1521e77a6729c8df6f4b1d51ede0a7

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-28T00:13:32Z",
        "uuid": "01a17fcc-c04d-7658-afe9-f33cf6e7ed03",
        "scanned_at": "2026-10-27T23:58:12Z",
        "final_url": "https://groveandmerchant.eu/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://groveandmerchant.eu/",
                "from": "http://groveandmerchant.eu/",
                "status": 307
            }
        ],
        "ip": "213.109.192.154",
        "ptr": "mta0.rhoaspens.com",
        "domains": [
            "www.lyfemarketing.com"
        ],
        "ips": [
            "104.26.12.201",
            "213.109.192.154"
        ],
        "asns": [
            "13335",
            "62005"
        ],
        "countries": [
            "IT"
        ],
        "doc_hash": "9ee276088e9f2a3b66b5bc9b7d383f36bd753a0327b42a3d817513883ec346ce",
        "tls": {
            "cipher": "AES_128_GCM",
            "issuer": "rhoaspens.com",
            "subject": "rhoaspens.com",
            "protocol": "TLS 1.2",
            "valid_to": "2027-10-26T03:06:18Z",
            "valid_from": "2026-10-26T03:06:18Z"
        },
        "domain_age_days": 159,
        "apex_age_days": 159,
        "tls_age_days": 1,
        "tls_valid_days": 365,
        "requests": 6,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 88,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.2.34",
            "content-type": "text/html; charset=UTF-8"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-27T23:43:00Z",
        "uuid": "5f1c17fd-9667-4f53-9614-21999c723bea",
        "scanned_at": "2026-10-27T23:41:57Z",
        "final_url": "https://groveandmerchant.eu/",
        "history": [
            {
                "url": "https://groveandmerchant.eu/",
                "status": 0
            }
        ],
        "domain_risks": [
            "Malware",
            "Security threats",
            "CIPA Filter",
            "CIPA"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "groveandmerchant.eu",
                "type": "A",
                "value": "213.109.192.154"
            }
        ],
        "dnssec_valid": false,
        "verdict": {
            "tags": [
                "malware"
            ],
            "malicious": true,
            "categories": [
                "malware"
            ]
        },
        "whois": {
            "registrar": "Namecheap, Inc",
            "nameservers": [
                "dns2.registrar-servers.com",
                "dns1.registrar-servers.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-28T00:12:07Z",
        "analysis_at": "2026-10-23T12:17:55Z",
        "stats": {
            "timeout": 0,
            "harmless": 44,
            "malicious": 13,
            "suspicious": 3,
            "undetected": 32
        },
        "detections": {
            "DNS8": "suspicious",
            "ESET": "suspicious",
            "VIPRE": "phishing",
            "G-Data": "phishing",
            "Lionic": "phishing",
            "Sophos": "phishing",
            "CyRadar": "phishing",
            "Webroot": "malicious",
            "Fortinet": "phishing",
            "SOCRadar": "phishing",
            "Kaspersky": "phishing",
            "Seclookup": "malicious",
            "Gridinsoft": "suspicious",
            "BitDefender": "phishing",
            "alphaMountain.ai": "phishing",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "first_seen": "2026-05-21T20:09:53Z",
        "dns": [
            {
                "ttl": 60,
                "type": "A",
                "value": "213.109.192.154"
            },
            {
                "ttl": 1800,
                "type": "NS",
                "value": "dns1.registrar-servers.com"
            },
            {
                "ttl": 1800,
                "type": "MX",
                "value": "eforward4.registrar-servers.com",
                "priority": 15
            },
            {
                "ttl": 3601,
                "type": "SOA",
                "rname": "hostmaster.registrar-servers.com",
                "value": "dns1.registrar-servers.com"
            },
            {
                "ttl": 1800,
                "type": "MX",
                "value": "eforward2.registrar-servers.com",
                "priority": 10
            },
            {
                "ttl": 1800,
                "type": "MX",
                "value": "eforward5.registrar-servers.com",
                "priority": 20
            },
            {
                "ttl": 1800,
                "type": "MX",
                "value": "eforward3.registrar-servers.com",
                "priority": 10
            },
            {
                "ttl": 1800,
                "type": "NS",
                "value": "dns2.registrar-servers.com"
            },
            {
                "ttl": 1800,
                "type": "MX",
                "value": "eforward1.registrar-servers.com",
                "priority": 10
            },
            {
                "ttl": 1800,
                "type": "TXT",
                "value": "v=spf1 include:spf.efwd.registrar-servers.com ~all"
            }
        ],
        "dns_at": "2026-10-23T12:23:29Z",
        "jarm": "3fd00000000000000043d00000043d522d90ea5f09880300720f82ae291923",
        "cert": {
            "san": [
                "groveandmerchant.eu"
            ],
            "issuer": "Let's Encrypt / R12",
            "serial": "6e5e6378d6a02f81acb87bc6ee20717b175",
            "sha256": "f06290b3cfcd1b2352e8df755c89ab04346b0bdc79854113a72efad60968d413",
            "subject": "groveandmerchant.eu",
            "valid_to": "2026-08-19T18:45:21Z",
            "valid_from": "2026-05-21T18:45:22Z"
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-27T23:43:22Z",
        "mail_config": {
            "mx": [
                "eforward5.registrar-servers.com",
                "eforward1.registrar-servers.com",
                "eforward2.registrar-servers.com",
                "eforward3.registrar-servers.com",
                "eforward4.registrar-servers.com"
            ],
            "spf": "v=spf1 include:spf.efwd.registrar-servers.com ~all",
            "spf_lookups": 1
        },
        "caa_records": {
            "domain": "groveandmerchant.eu"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_by": [
                "CloudFlare Family"
            ],
            "blocked_count": 1
        },
        "trackers": {
            "requests": 2
        },
        "tls_connection": {
            "cipher": "ECDHE-RSA-AES128-GCM-SHA256",
            "protocol": "TLSv1.2",
            "versions": [
                "TLSv1",
                "TLSv1.1",
                "TLSv1.2"
            ],
            "authorized": false,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                22,
                25,
                53,
                80,
                110,
                143,
                443,
                993,
                995,
                3306
            ]
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "156.154.133.200",
                    "host": "dns2.registrar-servers.com"
                },
                {
                    "ip": "156.154.132.200",
                    "host": "dns1.registrar-servers.com"
                }
            ],
            "zone": "groveandmerchant.eu"
        },
        "location": {
            "ip": "213.109.192.154",
            "asn": "62005",
            "org": "BlueVPS OU",
            "city": "Palermo",
            "country": "IT"
        },
        "ssl": {
            "issuer": "SomeOrganization / rhoaspens.com",
            "subject": "rhoaspens.com"
        },
        "dns": {
            "A": [
                "213.109.192.154"
            ],
            "MX": [
                "{\"exchange\": \"eforward4.registrar-servers.com\", \"priority\": 15}",
                "{\"exchange\": \"eforward5.registrar-servers.com\", \"priority\": 20}",
                "{\"exchange\": \"eforward1.registrar-servers.com\", \"priority\": 10}",
                "{\"exchange\": \"eforward2.registrar-servers.com\", \"priority\": 10}",
                "{\"exchange\": \"eforward3.registrar-servers.com\", \"priority\": 10}"
            ],
            "NS": [
                "dns1.registrar-servers.com",
                "dns2.registrar-servers.com"
            ],
            "SOA": "{\"nsname\": \"dns1.registrar-servers.com\", \"hostmaster\": \"hostmaster.registrar-servers.com\", \"serial\": 1779391091, \"refresh\": 43200, \"retry\": 3600, \"expire\": 604800, \"minttl\": 3601}",
            "TXT": [
                "v=spf1 include:spf.efwd.registrar-servers.com ~all"
            ]
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "get_ip": {
            "ip": "213.109.192.154",
            "family": 4
        },
        "whois": {
            "registrar": "Namecheap, Inc",
            "nameservers": [
                "dns2.registrar-servers.com",
                "dns1.registrar-servers.com"
            ]
        }
    }
}
```