# PhishDestroy domain threat record: halkidiki-realestate.gr

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/halkidiki-realestate.gr/
Machine-readable companion: https://phishdestroy.io/domain/halkidiki-realestate.gr/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-09-02 20:42:16 UTC
- Last availability or vendor check: 2026-10-22 10:28:38 UTC
- Stored record updated: 2026-10-22 16:07:29 UTC
- VirusTotal detections in the stored snapshot: 17/89
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored infrastructure

- Observed IP address: 45.76.136.72
- Registrar in stored WHOIS data: REGISTRAR_NOT_FOUND
- Registrar country in stored WHOIS data: Unknown
- Last stored HTTP status: 200

## Evidence links

- URLScan report: https://urlscan.io/result/01a063d9-d7b2-7259-92de-18e90069f34b/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/halkidiki-realestate.gr
- Certificate Transparency search: https://crt.sh/?q=%25.halkidiki-realestate.gr
- Web Archive lookup: https://web.archive.org/web/*/https://halkidiki-realestate.gr/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
halkidiki-realestate.gr presents itself as a local property business for the Halkidiki peninsula in Greece, and PhishDestroy classifies it as an impersonation phishing page. Its natural audience is anyone searching for homes, holiday rentals or investment property in the region. PhishDestroy first flagged it on 2026-09-02, and as of 2026-10-19 the site was still online and serving live content.

How the scam works
The page title, "halkidiki-realestate.gr – halkidiki-realestate," names no established agency, so the site trades on a plausible regional name rather than a specific brand. Impersonation sites in the property sector usually show attractive listings and then push visitors toward a reservation deposit, a viewing fee or an advance rent payment, sometimes in cryptocurrency. They also ask for passport scans and contact details. Money sent this way is rarely recoverable, and the collected identity documents can be reused for further fraud.

Evidence
On 2026-09-11, 17 of 89 VirusTotal engines marked the domain as malicious. Vendors flagging it included BitDefender, ESET, Fortinet, Forcepoint ThreatSeeker, alphaMountain.ai, ADMINUSLabs, CyRadar and the Vietnamese anti-phishing group Chong Lua Dao. That spread of unrelated engines points to a real threat rather than a single false positive. The domain also appears in six AlienVault OTX threat pulses and on the PhishDestroy blocklist.

Infrastructure
The site runs on IP 45.76.136.72 in The Constant Company, LLC network, a cloud provider better known as Vultr, with the server located in the United Kingdom. A Greek-named property site hosted on rented cloud capacity abroad is worth noticing, because local agencies more often use Greek providers. The Let's Encrypt certificate only means the connection is encrypted. It says nothing about whether the business behind the site is genuine.

What to do
If you paid a deposit, booking fee or rent through this site, contact your bank or card issuer right away to dispute the payment, and report the transfer to the police. If you sent ID documents, watch for misuse of your identity, and if you created an account there, change that password everywhere you reused it. Before paying any Greek property agent, confirm their registration and contact details through official channels rather than the site itself. Security teams should block the domain and its hosting IP, and submit it to their email and web filters.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a063d9-d7b2-7259-92de-18e90069f34b/
VirusTotal report: https://www.virustotal.com/gui/domain/halkidiki-realestate.gr
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=halkidiki-realestate.gr
Archived copy: https://web.archive.org/web/20260902204633/https://halkidiki-realestate.gr/
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 09:51:30 UTC

## Stored page captures

- Primary capture: https://urlscan.io/screenshots/01a063d9-d7b2-7259-92de-18e90069f34b.png
  Captured: 2026-09-02 20:42:16 UTC
- URLScan capture: https://screenshots.phishdestroy.io/01a063d9-d7b2-7259-92de-18e90069f34b.png
  Captured: 2026-09-02 20:42:16 UTC
  Source report: https://urlscan.io/result/01a063d9-d7b2-7259-92de-18e90069f34b/
- URLQuery: https://screenshots.phishdestroy.io/uq/8d3ff433-8927-4ee7-921a-90af455cbd84.png
  Captured: 2026-09-02 20:59:24 UTC
  Source report: https://urlquery.net/report/8d3ff433-8927-4ee7-921a-90af455cbd84
  SHA-256: e4422ca703dd9021ca666e4a281e1c5fa4f180f80c684f6d1ef7854b5cf718ee
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/6ddd1b15-2633-411a-8379-b55f17e53cb2.png
  Captured: 2026-09-02 21:27:06 UTC
  Source report: https://radar.cloudflare.com/scan/6ddd1b15-2633-411a-8379-b55f17e53cb2
  SHA-256: 20ad0fcc398c4b19f5cec4f670bdb9718f9118833893c07ab2c308b36c2e7258
- URLScan · 2026-08-17: https://screenshots.phishdestroy.io/us/01a0104a-7487-744f-b20d-ccccfc5d6e10.png
  Captured: 2026-08-17 15:15:17 UTC
  Source report: https://urlscan.io/result/01a0104a-7487-744f-b20d-ccccfc5d6e10/
  SHA-256: 09ad46d2dbfc1e923e934ab7ca5979cb8fb3bd0d2dfb8de4196de05c88e90066
- URLScan · 2026-08-31: https://screenshots.phishdestroy.io/us/01a059fe-b2b7-776e-a4a3-2776b1f80f60.png
  Captured: 2026-08-31 22:44:26 UTC
  Source report: https://urlscan.io/result/01a059fe-b2b7-776e-a4a3-2776b1f80f60/
  SHA-256: 09ad46d2dbfc1e923e934ab7ca5979cb8fb3bd0d2dfb8de4196de05c88e90066
- URLScan · 2026-08-31: https://screenshots.phishdestroy.io/us/01a059fe-ca63-745e-836c-8d6c79f25933.png
  Captured: 2026-08-31 22:44:32 UTC
  Source report: https://urlscan.io/result/01a059fe-ca63-745e-836c-8d6c79f25933/
  SHA-256: 09ad46d2dbfc1e923e934ab7ca5979cb8fb3bd0d2dfb8de4196de05c88e90066
- URLScan · 2026-09-02: https://screenshots.phishdestroy.io/us/01a063da-c2ef-72c8-9671-6d13e4711180.png
  Captured: 2026-09-02 20:41:22 UTC
  Source report: https://urlscan.io/result/01a063da-c2ef-72c8-9671-6d13e4711180/
  SHA-256: 09ad46d2dbfc1e923e934ab7ca5979cb8fb3bd0d2dfb8de4196de05c88e90066
- URLScan · 2026-09-04: https://screenshots.phishdestroy.io/us/01a06cd0-4964-71bb-ac66-d164338fb608.png
  Captured: 2026-09-04 14:26:35 UTC
  Source report: https://urlscan.io/result/01a06cd0-4964-71bb-ac66-d164338fb608/
  SHA-256: 09ad46d2dbfc1e923e934ab7ca5979cb8fb3bd0d2dfb8de4196de05c88e90066
- URLScan · 2026-09-04: https://screenshots.phishdestroy.io/us/01a06cd0-8341-70be-8989-0c7cebe380f4.png
  Captured: 2026-09-04 14:26:58 UTC
  Source report: https://urlscan.io/result/01a06cd0-8341-70be-8989-0c7cebe380f4/
  SHA-256: 09ad46d2dbfc1e923e934ab7ca5979cb8fb3bd0d2dfb8de4196de05c88e90066

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-21T03:54:09Z",
        "uuid": "01a063d9-d7b2-7259-92de-18e90069f34b",
        "scanned_at": "2026-09-02T20:40:23Z",
        "final_url": "https://halkidiki-realestate.gr/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://halkidiki-realestate.gr/",
                "from": "http://halkidiki-realestate.gr/",
                "status": 307
            }
        ],
        "ip": "45.76.136.72",
        "ptr": "ecp-web1.rssrv.uk",
        "domains": [
            "maps.googleapis.com",
            "fonts.bunny.net",
            "fonts.googleapis.com",
            "maps.gstatic.com",
            "www.google.com"
        ],
        "ips": [
            "142.251.20.95",
            "172.217.112.4",
            "192.178.183.94",
            "142.251.156.119",
            "78.46.92.118",
            "45.76.136.72"
        ],
        "asns": [
            "15169",
            "24940",
            "20473"
        ],
        "countries": [
            "US",
            "DE",
            "GB"
        ],
        "doc_hash": "cb7d2ea408573c0cd568a40473b1cb814af9161004414eadccbbffeda99aad59",
        "script_hashes": [
            "b70740dc871cb331dda551c0129f78e377e52b5fb72c92dc499b2df4bcaced0f",
            "cb6f2d32c49d1c2b25e9ffc9aaafa3f83075346c01bcd4ae6eb187392a4292cf",
            "5274f11e6fb32ae0cf2dfb9f8043272865c397a7c4223b4cfa7d50ea52fbde89",
            "5a43a22e48f94b7a45a9a9b1a107f197213b73307fdfa2e6b2daadab264f94d2",
            "4a8bd33bfe771e0bd46fade45435a9fa2d0c3a8af2409b1f5a74a6b96b03faa9",
            "a661ebd0f81a083b4bffe625acd29b8ba47af493152dc912580b007a6c9d302b",
            "9b2ea7b5e867616e46363feeee2d6988061bafce3bdc0f74f96e91e6e4b11e96"
        ],
        "globals": [
            "_wpemojiSettings",
            "__CONFIG__",
            "jQuery",
            "wp",
            "starter_templates_zip_preview",
            "twentytwenty",
            "twentytwentyDomReady",
            "twentytwentyToggleAttribute",
            "twentytwentyMenuToggle",
            "twentytwentyFindParents",
            "BrizyLibs",
            "brzPopup",
            "Brz"
        ],
        "storage_keys": [
            "wpEmojiSettingsSupports",
            "brz-sessions",
            "brz-pagesViewsInSessionTimeLine",
            "brz-showedPopupsInSessionTimeLine",
            "brz-pagesViews",
            "brz-firstVisit",
            "brz-lastVisit"
        ],
        "tls": {
            "san": [
                "halkidiki-realestate.gr",
                "www.halkidiki-realestate.gr"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "YR2",
            "subject": "halkidiki-realestate.gr",
            "protocol": "TLS 1.3",
            "valid_to": "2026-11-15T13:19:04Z",
            "valid_from": "2026-08-17T13:19:05Z"
        },
        "domain_age_days": 3579,
        "apex_age_days": 3579,
        "tls_age_days": 16,
        "tls_valid_days": 89,
        "requests": 48,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": -49,
                "malicious": false
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "LiteSpeed",
            "content-type": "text/html; charset=UTF-8",
            "x-powered-by": "PHP/8.2.33"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-21T04:34:35Z",
        "uuid": "6ddd1b15-2633-411a-8379-b55f17e53cb2",
        "scanned_at": "2026-09-02T21:27:06Z",
        "final_url": "https://halkidiki-realestate.gr/",
        "status": 200,
        "history": [
            {
                "url": "https://halkidiki-realestate.gr/",
                "status": 200
            }
        ],
        "dom_hash": "f4a08f5b6df357da6f5b90798fe3054dc83ff8cc410e048a219a08cd7a0795d7",
        "doc_hash": "27a3ada99bfecbb7bcdc7fccc8e4f8f7abdafef9cf084ca6ad7aa74364dfe60f",
        "phishing_v2": [
            "phishing"
        ],
        "domain_risks": [
            "Phishing",
            "Security threats",
            "CIPA Filter",
            "CIPA"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "halkidiki-realestate.gr",
                "type": "A",
                "value": "45.76.136.72"
            }
        ],
        "dnssec_valid": false,
        "ip": "45.76.136.72",
        "verdict": {
            "tags": [
                "phishing"
            ],
            "malicious": true,
            "categories": [
                "phishing"
            ]
        }
    }
}
```