# PhishDestroy domain threat record: grupoexter.eu Content language: English Canonical HTML report: https://phishdestroy.io/domain/grupoexter.eu/ Machine-readable companion: https://phishdestroy.io/domain/grupoexter.eu/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-10-07 07:43:37 UTC - Last availability or vendor check: 2026-10-22 10:37:43 UTC - Stored record updated: 2026-10-22 16:07:29 UTC - VirusTotal detections in the stored snapshot: 9/92 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: no stored flag ## Stored infrastructure - Observed IP address: 188.114.97.3 - Registrar in stored WHOIS data: DonDominio.com / Soluciones Corporativas IP, SL - Last stored HTTP status: 200 ## Evidence links - URLScan report: https://urlscan.io/result/01a11556-3958-7090-9136-326f7da166bf/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/grupoexter.eu - Certificate Transparency search: https://crt.sh/?q=%25.grupoexter.eu - Web Archive lookup: https://web.archive.org/web/*/https://grupoexter.eu/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview grupoexter.eu is on the PhishDestroy blocklist as a suspicious domain. Its name resembles a Spanish-language business group, but no specific impersonated brand or target audience has been confirmed. PhishDestroy first saw it on 2026-10-07. As of 2026-10-19 the site was still online and serving content. The page title reads "Error - Laravel Application", a default framework error screen, while several independent sources list the domain for phishing. How the scam works No specific scheme has been tied to this domain yet, so treat it as an unverified phishing risk. Spamhaus lists it as a domain abused for phishing. Domains with that label typically host pages that collect logins, payment details or personal information, or redirect visitors to sites that do. A live domain showing an error page can still be used for this, because the content behind it can change at any time. Anyone who submits credentials or payment data to a domain like this could lose access to those accounts or face fraudulent charges. Evidence On 2026-10-11, 9 of 92 VirusTotal engines flagged the domain. Named vendors include ESET, Fortinet, Forcepoint ThreatSeeker, alphaMountain.ai, CRDF, Gridinsoft, MalwareURL and SOCRadar. That is a minority of engines, but the vendors are unrelated to each other, which carries weight. Spamhaus DBL classifies it as DBL_ABUSED_PHISH, a phishing listing for a domain it considers abused. Five AlienVault OTX threat pulses also reference the domain, so other researchers are tracking it. Infrastructure The domain is registered through DonDominio.com / Soluciones Corporativas IP, SL, a Spanish registrar, which fits the .eu name and its Spanish-sounding wording. It resolves to 188.114.97.3 on Cloudflare's network, with the address geolocated to Canada. Cloudflare's proxy hides the server that actually hosts the content. The Google Trust Services certificate is the standard kind issued at Cloudflare's edge, so it says nothing about who runs the site. What to do Do not enter usernames, passwords, card numbers or identity documents on grupoexter.eu. If you already did, change those passwords from a trusted device and turn on two-factor authentication. Contact your bank to block any card you used there and watch your statements for charges you do not recognise. Security teams should block the domain at DNS and web proxies and search their logs for earlier visits. Report any new phishing content on it to Cloudflare and the registrar. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a11556-3958-7090-9136-326f7da166bf/ VirusTotal report: https://www.virustotal.com/gui/domain/grupoexter.eu Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=grupoexter.eu Archived copy: https://web.archive.org/web/20261009135714/https://grupoexter.eu/ Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-19 10:42:32 UTC ## Stored page captures - Primary capture: https://i.ibb.co/qYBmkbCh/bc9f6c9e18dd.png Captured: 2026-10-07 07:49:48 UTC - URLScan capture 1: https://screenshots.phishdestroy.io/01a11556-3958-7090-9136-326f7da166bf.png Captured: 2026-10-07 07:49:48 UTC Source report: https://urlscan.io/result/01a11556-3958-7090-9136-326f7da166bf/ - URLScan capture 2: https://urlscan.io/screenshots/01a10a54-1dba-775d-b279-4467ab55b8a7.png Captured: 2026-10-07 07:43:37 UTC Source report: https://urlscan.io/result/01a11556-3958-7090-9136-326f7da166bf/ - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/50c26588-3d14-418e-9f2a-23e9749d868e.png Captured: 2026-10-07 07:48:24 UTC Source report: https://radar.cloudflare.com/scan/50c26588-3d14-418e-9f2a-23e9749d868e SHA-256: 55ae4b151075d761784458e2ba54be586a82b779bba709e9bee56af73dc923a3 - URLScan · 2026-09-30: https://screenshots.phishdestroy.io/us/01a0f142-d84e-7658-a404-4d1c1577890b.png Captured: 2026-09-30 07:41:30 UTC Source report: https://urlscan.io/result/01a0f142-d84e-7658-a404-4d1c1577890b/ SHA-256: 9f95a61e1b5d45e6f59a03a1371183671bb55ac17a469d4146406b74d2e7d3f9 - URLScan · 2026-10-04: https://screenshots.phishdestroy.io/us/01a10797-b6d2-77e4-b21a-a9cda7d1bdb4.png Captured: 2026-10-04 15:45:53 UTC Source report: https://urlscan.io/result/01a10797-b6d2-77e4-b21a-a9cda7d1bdb4/ SHA-256: 9f95a61e1b5d45e6f59a03a1371183671bb55ac17a469d4146406b74d2e7d3f9 - URLScan · 2026-10-05: https://screenshots.phishdestroy.io/us/01a10994-b01d-7699-8dfb-5ba2eb2c6afd.png Captured: 2026-10-05 01:01:47 UTC Source report: https://urlscan.io/result/01a10994-b01d-7699-8dfb-5ba2eb2c6afd/ SHA-256: 9f95a61e1b5d45e6f59a03a1371183671bb55ac17a469d4146406b74d2e7d3f9 - URLScan · 2026-10-05: https://screenshots.phishdestroy.io/us/01a10a54-1dba-775d-b279-4467ab55b8a7.png Captured: 2026-10-05 04:32:05 UTC Source report: https://urlscan.io/result/01a10a54-1dba-775d-b279-4467ab55b8a7/ SHA-256: 9f95a61e1b5d45e6f59a03a1371183671bb55ac17a469d4146406b74d2e7d3f9 - URLScan · 2026-10-07: https://screenshots.phishdestroy.io/us/01a11552-da39-76e4-a9ae-03a2589c55fe.png Captured: 2026-10-07 07:45:19 UTC Source report: https://urlscan.io/result/01a11552-da39-76e4-a9ae-03a2589c55fe/ SHA-256: 9f95a61e1b5d45e6f59a03a1371183671bb55ac17a469d4146406b74d2e7d3f9 ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-20T19:27:43Z", "uuid": "01a11556-3958-7090-9136-326f7da166bf", "scanned_at": "2026-10-07T07:49:00Z", "final_url": "https://grupoexter.eu/wp-content/plugins/reading-progress-bar/public/css/48518408841de847155184158184815100sdcdr81d/", "status": 200, "redirected": "same-domain", "redirects": [ { "to": "https://grupoexter.eu/wp-content/plugins/reading-progress-bar/public/css/48518408841de847155184158184815100sdcdr81d", "from": "http://grupoexter.eu/wp-content/plugins/reading-progress-bar/public/css/48518408841de847155184158184815100sdcdr81d", "status": 307 }, { "to": "https://grupoexter.eu/wp-content/plugins/reading-progress-bar/public/css/48518408841de847155184158184815100sdcdr81d/", "from": "https://grupoexter.eu/wp-content/plugins/reading-progress-bar/public/css/48518408841de847155184158184815100sdcdr81d", "status": 301 } ], "ip": "188.114.96.3", "ips": [ "188.114.96.3" ], "asns": [ "13335" ], "doc_hash": "bd5d943b3db7ac81d79567ba9b30ca227602f852a97ed1d526aa6f840877b370", "cookies": [ "PHPSESSID", "__wpdm_client" ], "tls": { "san": [ "grupoexter.eu", "*.grupoexter.eu" ], "cipher": "AES_128_GCM", "issuer": "WE1", "subject": "grupoexter.eu", "protocol": "QUIC", "valid_to": "2026-12-25T21:08:27Z", "valid_from": "2026-09-26T20:10:48Z" }, "domain_age_days": 2644, "apex_age_days": 2644, "tls_age_days": 10, "tls_valid_days": 90, "requests": 2, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": -32, "malicious": false }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "cloudflare", "content-type": "text/html; charset=UTF-8", "strict-transport-security": "max-age=31536000" } }, "cf": { "v": 1, "fetched_at": "2026-10-20T19:37:32Z", "uuid": "50c26588-3d14-418e-9f2a-23e9749d868e", "scanned_at": "2026-10-07T07:48:24Z", "final_url": "https://grupoexter.eu/", "status": 200, "history": [ { "url": "https://grupoexter.eu/", "status": 200 } ], "dom_hash": "586fbcab8ac8fc8f5870ee0273e26dd03b7e6564726e9dbfa3dbd6a37c6bb302", "doc_hash": "88f4274e6836e37356459f15dafb26f9c73def2ffdaf870ae6f012b3250243d8", "domain_risks": [ "Health & Fitness", "Health" ], "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "grupoexter.eu", "type": "A", "value": "172.67.151.53" }, { "name": "grupoexter.eu", "type": "A", "value": "104.21.64.138" }, { "name": "grupoexter.eu", "type": "AAAA", "value": "2606:4700:3033::6815:408a" }, { "name": "grupoexter.eu", "type": "AAAA", "value": "2606:4700:3032::ac43:9735" } ], "dnssec_valid": false, "ip": "172.67.151.53", "whois": { "registrar": "DonDominio.com / Soluciones Corporativas IP, SL", "nameservers": [ "gerald.ns.cloudflare.com", "ainsley.ns.cloudflare.com" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-21T09:01:02Z", "analysis_at": "2026-10-19T17:28:15Z", "stats": { "timeout": 0, "harmless": 56, "malicious": 0, "suspicious": 0, "undetected": 36 }, "reputation": 0, "popularity": { "Cisco Umbrella": 568166 }, "first_seen": "2024-03-05T14:39:57Z", "dns": [ { "ttl": 300, "type": "A", "value": "172.67.151.53" }, { "ttl": 1800, "type": "SOA", "rname": "dns.cloudflare.com", "value": "ainsley.ns.cloudflare.com" }, { "ttl": 300, "type": "AAAA", "value": "2606:4700:3032::ac43:9735" }, { "ttl": 300, "type": "AAAA", "value": "2606:4700:3033::6815:408a" }, { "ttl": 300, "type": "MX", "value": "_dc-mx.5ac778a43f31.grupoexter.eu", "priority": 10 }, { "ttl": 21600, "type": "NS", "value": "ainsley.ns.cloudflare.com" }, { "ttl": 300, "type": "A", "value": "104.21.64.138" }, { "ttl": 21600, "type": "NS", "value": "gerald.ns.cloudflare.com" }, { "ttl": 300, "type": "TXT", "value": "v=spf1 a mx ip4:213.32.64.108 ~all" } ], "dns_at": "2026-10-19T17:34:54Z", "jarm": "27d40d40d00040d00027d40d27d40dbc9595a9e7036a6bc0deff9a2ae690e7", "cert": { "san": [ "grupoexter.eu", "*.grupoexter.eu" ], "issuer": "Google Trust Services / WE1", "serial": "6cee2fe562b2be600e708c78e54e25f2", "sha256": "328f06f402cbba04ac4462acd368419afc4fd37a24524d741929a700d59a5998", "subject": "grupoexter.eu", "valid_to": "2026-12-25T21:08:27Z", "valid_from": "2026-09-26T20:10:48Z" } } } ```