# PhishDestroy domain threat record: inventory.easdc.com Content language: English Canonical HTML report: https://phishdestroy.io/domain/inventory.easdc.com/ Machine-readable companion: https://phishdestroy.io/domain/inventory.easdc.com/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-09-21 13:46:29 UTC - Last availability or vendor check: 2026-10-22 10:06:29 UTC - Stored record updated: 2026-10-22 16:07:29 UTC - VirusTotal detections in the stored snapshot: 7/91 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: flagged ## Stored infrastructure - Observed IP address: 135.181.234.15 - Registrar in stored WHOIS data: Onlinenic Inc - Registrar country in stored WHOIS data: GB - Last stored HTTP status: 303 - Registration date (registry RDAP, easdc.com): 2009-10-13 09:36:55 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a0c437-ec47-702b-b767-2f4495ba8bdb/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/inventory.easdc.com - Certificate Transparency search: https://crt.sh/?q=%25.inventory.easdc.com - Web Archive lookup: https://web.archive.org/web/*/https://inventory.easdc.com/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview inventory.easdc.com is an impersonation phishing page. It poses as a trusted service so visitors will hand over sensitive information. PhishDestroy first flagged it on 2026-09-21. As of 2026-10-19 the site was still online and redirecting visitors elsewhere, so the threat is active. How the scam works Impersonation pages copy the look and wording of a legitimate login, account or wallet portal. They then collect whatever the visitor types in, such as usernames, passwords, one-time codes, card details or wallet recovery phrases. The page title here shows only the hostname and names no brand. The redirect sends visitors on to another destination, which lets the operator change where people land without changing the entry point. Anything a victim submits goes straight to the attacker, who can take over accounts or empty funds. Evidence Google Safe Browsing labels the site as social engineering, the category it uses for deceptive phishing pages. Browsers that rely on that service will show a warning before loading it. On VirusTotal, 7 of 91 engines flagged it as of 2026-10-03: alphaMountain.ai, CRDF, Forcepoint ThreatSeeker, Fortinet, SOCRadar, URLQuery and desenmascara.me. That count is modest, so many security tools may still let the site through. The Google verdict and the spread of independent vendors still point the same way. PhishDestroy lists it on its own blocklist. Infrastructure The parent domain easdc.com was registered on 2009-10-13 through Onlinenic Inc. That is many years before this subdomain was seen serving phishing, so a phishing page can sit on a domain with a long history. The server is in Finland on Hetzner Online GmbH's network. It uses a free, automatically issued Let's Encrypt certificate. The padlock in the address bar therefore only means the connection is encrypted, not that the site is legitimate. What to do If you entered a password on this site, change it right away on the real service and on any other account that uses the same password. Then turn on app-based two-factor authentication and sign out of all other active sessions. If you typed a one-time code or card details, contact your bank or the service's support team and watch for unfamiliar logins or charges. If you entered a wallet recovery phrase, treat that wallet as compromised and move your assets to a new wallet with a freshly generated phrase. Defenders should block the hostname and its IP at the proxy and DNS layers and search mail and web logs for any users who clicked through. Report the page to the hosting provider's abuse team so the redirect can be taken down. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a0c437-ec47-702b-b767-2f4495ba8bdb/ VirusTotal report: https://www.virustotal.com/gui/domain/inventory.easdc.com Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=inventory.easdc.com Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-19 09:37:24 UTC ## Stored page captures - Primary capture: https://i.ibb.co/Df2P64h5/5cada9fbdc7f.png Captured: 2026-09-21 13:47:22 UTC - URLScan capture 1: https://screenshots.phishdestroy.io/01a0c437-ec47-702b-b767-2f4495ba8bdb.png Captured: 2026-09-21 13:47:22 UTC Source report: https://urlscan.io/result/01a0c437-ec47-702b-b767-2f4495ba8bdb/ - URLScan capture 2: https://urlscan.io/screenshots/019e075b-4f3b-76ef-b308-b1daf80978e1.png Captured: 2026-09-21 13:46:29 UTC Source report: https://urlscan.io/result/01a0c437-ec47-702b-b767-2f4495ba8bdb/ - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/651f83c1-914b-4c95-a092-705dbd48ce81.png Captured: 2026-09-21 13:48:15 UTC Source report: https://radar.cloudflare.com/scan/651f83c1-914b-4c95-a092-705dbd48ce81 SHA-256: 66659ba08f1f4e7dd88e9b4fb4e75ca4b487d6a6e90cebf13081377043000339 - URLQuery: https://screenshots.phishdestroy.io/uq/4266f03e-b709-4804-b441-05064b9c65c6.png Source report: https://urlquery.net/report/4266f03e-b709-4804-b441-05064b9c65c6 SHA-256: fd96fe4e3e31bf59393088d534d75d659dc18b4368029613dc6d877d49425a33 ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-20T23:43:43Z", "uuid": "01a0c437-ec47-702b-b767-2f4495ba8bdb", "scanned_at": "2026-09-21T13:46:41Z", "final_url": "https://inventory.easdc.com/count/index.php", "status": 200, "ip": "135.181.234.15", "ptr": "static.15.234.181.135.clients.your-server.de", "ips": [ "135.181.234.15" ], "asns": [ "24940" ], "countries": [ "FI" ], "doc_hash": "a65ae7ae32f140a887ce6c5321fa663e2e6fa3ec91baae5616031a06ff56443f", "globals": [ "i4", "i8", "rec", "_f_c", "hd", "hw", "i6", "he", "hh", "hwa", "atou", "utoa", "rea", "reb", "__", "c2", "c1", "message", "clickIE", "clickNS", "disableCtrlKeyCombination" ], "tls": { "san": [ "inventory.easdc.com" ], "cipher": "AES_128_GCM", "issuer": "YR1", "subject": "inventory.easdc.com", "protocol": "TLS 1.3", "valid_to": "2026-11-06T08:46:37Z", "valid_from": "2026-08-08T08:46:38Z" }, "domain_age_days": 378, "apex_age_days": 1314, "tls_age_days": 44, "tls_valid_days": 89, "requests": 3, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 37, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "nginx", "content-type": "text/html; charset=UTF-8", "x-powered-by": "PHP/8.3.33\nPleskLin" } }, "cf": { "v": 1, "fetched_at": "2026-10-20T22:29:38Z", "uuid": "651f83c1-914b-4c95-a092-705dbd48ce81", "scanned_at": "2026-09-21T13:48:15Z", "final_url": "https://inventory.easdc.com/", "status": 500, "history": [ { "url": "https://inventory.easdc.com/", "status": 500 } ], "dom_hash": "4cb2d0d4b5c2a72f9fb10107bd6a4a3dfad62f889f9647db9e1f0c4ae5f8cc2a", "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "inventory.easdc.com", "type": "A", "value": "135.181.234.15" } ], "dnssec_valid": false, "ip": "135.181.234.15", "whois": { "registrar": "OnlineNIC, Inc.", "created": "2009-10-13T09:36:55Z", "updated": "2026-09-20T07:29:30Z", "expires": "2030-10-13T09:36:55Z", "nameservers": [ "elliot.ns.cloudflare.com", "elsa.ns.cloudflare.com" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-22T00:27:54Z", "analysis_at": "2026-10-05T12:02:19Z", "stats": { "timeout": 0, "harmless": 51, "malicious": 5, "suspicious": 2, "undetected": 34 }, "detections": { "CRDF": "malicious", "Fortinet": "phishing", "SOCRadar": "phishing", "URLQuery": "suspicious", "desenmascara.me": "malicious", "Google Safe Browsing": "phishing", "Forcepoint ThreatSeeker": "suspicious" }, "reputation": 0, "categories": { "alphaMountain.ai": "Health (alphaMountain.ai)" }, "registrar": "OnlineNIC, Inc.", "created": "2009-10-13T09:36:55Z", "expires": "2030-10-13T09:36:55Z", "updated": "2026-09-27T07:40:43Z", "first_seen": "2025-09-08T14:52:55Z", "dns": [ { "ttl": 300, "type": "A", "value": "135.181.234.15" } ], "dns_at": "2026-10-05T13:12:20Z", "jarm": "29d3fd00029d29d00042d43d0000002059a3b916699461c5923779b77cf06b", "cert": { "san": [ "cp.healthcityprojects.com" ], "issuer": "Let's Encrypt / YR1", "serial": "5cbc46eb5e691d0d69c6087e9a983e9e04c", "sha256": "f5648438eb680db6b8866e3492a06750330ac9ff8023cfd3d91ddf251e1a622d", "subject": "cp.healthcityprojects.com", "valid_to": "2026-11-11T09:46:37Z", "valid_from": "2026-08-13T09:46:38Z" }, "whois": { "registrar": "OnlineNIC, Inc.", "registrar_iana_id": "82", "registrar_url": "http://www.onlinenic.com", "created": "2009-10-13T04:00:00Z", "updated": "2024-06-11T18:46:59Z", "expires": "2030-10-13T04:00:00Z", "status": [ "clientTransferProhibited" ], "nameservers": [ "elliot.ns.cloudflare.com", "elsa.ns.cloudflare.com" ], "dnssec": "unsigned" } } } ```