# PhishDestroy domain threat record: yorkfieldlane.eu Content language: English Canonical HTML report: https://phishdestroy.io/domain/yorkfieldlane.eu/ Machine-readable companion: https://phishdestroy.io/domain/yorkfieldlane.eu/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-09-20 10:01:13 UTC - Last availability or vendor check: 2026-10-22 10:08:09 UTC - Stored record updated: 2026-10-22 16:07:29 UTC - VirusTotal detections in the stored snapshot: 15/91 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: no stored flag ## Stored infrastructure - Observed IP address: 45.150.67.37 - Registrar in stored WHOIS data: Namecheap, Inc - Last stored HTTP status: 308 ## Evidence links - URLScan report: https://urlscan.io/result/019e9251-9de4-7628-8c03-07d50cbed9d2/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/yorkfieldlane.eu - Certificate Transparency search: https://crt.sh/?q=%25.yorkfieldlane.eu - Web Archive lookup: https://web.archive.org/web/*/https://yorkfieldlane.eu/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview yorkfieldlane.eu is classified by PhishDestroy as an impersonation phishing page. PhishDestroy first saw it on 2026-09-20. On 2026-10-19 the site was still online and was sending visitors to another destination rather than serving its own content. Its page title, in Czech, presents it as a car care blog about servicing vehicles and preventing breakdowns. That title does not match our impersonation classification. How the scam works Impersonation phishing sites pose as a legitimate business or service so visitors trust them enough to hand over something of value, usually login credentials, personal details or payment information. A harmless-looking front, here a Czech automotive maintenance article, can make the domain look ordinary at a glance. The redirect seen on 2026-10-19 means the address now forwards visitors elsewhere. Anyone who reaches the final page risks entering credentials or payment data into a form controlled by the operators. Evidence The classification is backed by independent vendors. On 2026-09-30, 15 of 91 VirusTotal engines flagged the domain, including BitDefender, ESET, Kaspersky, Fortinet, Forcepoint ThreatSeeker, G-Data, Gridinsoft and alphaMountain.ai. Several established security firms reaching the same verdict makes a false positive unlikely. The domain also appears in four AlienVault OTX threat pulses, so other researchers have tracked it as part of malicious activity. It is listed on the PhishDestroy blocklist. Infrastructure The domain is registered through Namecheap, Inc. It resolves to 45.150.67.37 on a network registered to Baykov Ilya Sergeevich, hosted in Finland. An automotive blog aimed at Czech readers, on a .eu domain, hosted in Finland, with no visible connection to any real business, fits the pattern of disposable sites set up for a campaign rather than a genuine local publisher. What to do If you visited yorkfieldlane.eu and entered a password anywhere along the redirect chain, change that password immediately, along with any other account that reuses it, and turn on two-factor authentication. If you submitted card or banking details, contact your bank to block the card and dispute any unfamiliar charges. Be wary of follow-up emails or calls that refer to your visit. Security teams should block the domain and the IP 45.150.67.37 at DNS and proxy level. They should also check logs for users who were redirected through it and reset credentials for any affected accounts. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/019e9251-9de4-7628-8c03-07d50cbed9d2/ VirusTotal report: https://www.virustotal.com/gui/domain/yorkfieldlane.eu Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=yorkfieldlane.eu Archived copy: https://web.archive.org/web/20261010013646/https://yorkfieldlane.eu/ Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-19 09:38:27 UTC ## Stored page captures - Primary capture: https://urlscan.io/screenshots/019e9251-9de4-7628-8c03-07d50cbed9d2.png Captured: 2026-09-20 10:01:13 UTC - URLScan capture: https://screenshots.phishdestroy.io/019e9251-9de4-7628-8c03-07d50cbed9d2.png Captured: 2026-09-22 03:30:19 UTC Source report: https://urlscan.io/result/019e9251-9de4-7628-8c03-07d50cbed9d2/ - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/a8644b9c-7ca9-4820-bfbb-043771954ab1.png Captured: 2026-09-20 10:08:04 UTC Source report: https://radar.cloudflare.com/scan/a8644b9c-7ca9-4820-bfbb-043771954ab1 SHA-256: 36d07495bcca5f3e48f8eca8aedf572633b1c8597772c12bfb5fcf7563770e66 ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-20T22:23:38Z", "uuid": "019e9251-9de4-7628-8c03-07d50cbed9d2", "scanned_at": "2026-06-04T11:08:12Z", "final_url": "https://yorkfieldlane.eu/", "status": 200, "redirected": "https-only", "redirects": [ { "to": "https://yorkfieldlane.eu/", "from": "http://yorkfieldlane.eu/", "status": 307 } ], "ip": "45.150.67.37", "domains": [ "upload.wikimedia.org", "fonts.gstatic.com", "fonts.googleapis.com" ], "ips": [ "142.251.110.94", "192.178.170.95", "185.15.59.240", "45.150.67.37" ], "asns": [ "15169", "14907", "209847" ], "countries": [ "US", "GB" ], "link_domains": [ "www.autoexpert.cz", "www.napa.com", "www.auto.cz" ], "doc_hash": "2801314542c1be3ec9780e42006ce435ede7cb2e079bd8c8f1a7d232c236e28b", "script_hashes": [ "231751ea2ae4fea9414a02d29ad3ca350c688f83e15eacf3a6e38cec3726f3c2" ], "cookies": [ "97854703", "WMF-Uniq" ], "tls": { "san": [ "yorkfieldlane.eu" ], "cipher": "AES_128_GCM", "issuer": "R13", "subject": "yorkfieldlane.eu", "protocol": "TLS 1.3", "valid_to": "2026-07-30T18:44:07Z", "valid_from": "2026-05-01T18:44:08Z" }, "domain_age_days": 33, "apex_age_days": 33, "tls_age_days": 33, "tls_valid_days": 89, "requests": 11, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 99, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "nginx", "content-type": "text/html; charset=UTF-8" } }, "cf": { "v": 1, "fetched_at": "2026-10-20T22:31:32Z", "uuid": "a8644b9c-7ca9-4820-bfbb-043771954ab1", "scanned_at": "2026-09-20T10:08:04Z", "final_url": "https://yorkfieldlane.eu/", "history": [ { "url": "https://yorkfieldlane.eu/", "status": 0 } ], "dom_hash": "f7a48cc844a2898cdb50aa55394e2633ea45e5ef13dc1aed1292ed349b65d815", "domain_risks": [ "Malware", "Security threats", "CIPA Filter", "CIPA" ], "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "yorkfieldlane.eu", "type": "A", "value": "45.150.67.37" } ], "dnssec_valid": false, "verdict": { "tags": [ "malware" ], "malicious": true, "categories": [ "malware" ] }, "whois": { "registrar": "Namecheap, Inc", "nameservers": [ "dns2.registrar-servers.com", "dns1.registrar-servers.com" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-22T01:56:05Z", "analysis_at": "2026-10-18T17:46:56Z", "stats": { "timeout": 0, "harmless": 43, "malicious": 14, "suspicious": 3, "undetected": 32 }, "detections": { "DNS8": "suspicious", "ESET": "suspicious", "VIPRE": "malware", "G-Data": "phishing", "Lionic": "phishing", "Sophos": "phishing", "CyRadar": "phishing", "Webroot": "malicious", "Fortinet": "phishing", "SOCRadar": "phishing", "Kaspersky": "phishing", "Seclookup": "malicious", "Gridinsoft": "suspicious", "SafeToOpen": "phishing", "BitDefender": "phishing", "alphaMountain.ai": "phishing", "Forcepoint ThreatSeeker": "phishing" }, "reputation": 0, "first_seen": "2026-05-01T20:02:49Z", "dns": [ { "ttl": 1800, "type": "MX", "value": "eforward3.registrar-servers.com", "priority": 10 }, { "ttl": 1800, "type": "MX", "value": "eforward2.registrar-servers.com", "priority": 10 }, { "ttl": 60, "type": "A", "value": "45.150.67.37" }, { "ttl": 1800, "type": "MX", "value": "eforward5.registrar-servers.com", "priority": 20 }, { "ttl": 1800, "type": "MX", "value": "eforward1.registrar-servers.com", "priority": 10 }, { "ttl": 1800, "type": "NS", "value": "dns2.registrar-servers.com" }, { "ttl": 3601, "type": "SOA", "rname": "hostmaster.registrar-servers.com", "value": "dns1.registrar-servers.com" }, { "ttl": 1800, "type": "MX", "value": "eforward4.registrar-servers.com", "priority": 15 }, { "ttl": 1800, "type": "TXT", "value": "v=spf1 include:spf.efwd.registrar-servers.com ~all" }, { "ttl": 1800, "type": "NS", "value": "dns1.registrar-servers.com" } ], "dns_at": "2026-10-18T17:52:15Z", "jarm": "28d28d28d00028d00042d42d000000e1ea2a807a629b496b664cf07ad7c08d", "cert": { "san": [ "origin.tvoi.net" ], "issuer": "Let's Encrypt / YE1", "serial": "56474b506d399b66d0403850c8a4666da8a", "sha256": "ba3e5173bda5cceb54cd2246cdb8390707307663c50cf3ef67e25cc875f24028", "subject": "origin.tvoi.net", "valid_to": "2027-01-04T09:24:40Z", "valid_from": "2026-10-06T09:24:41Z" } } } ```