# PhishDestroy domain threat record: allegrolokalnie.aukcja865637302.cfd

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/allegrolokalnie.aukcja865637302.cfd/
Machine-readable companion: https://phishdestroy.io/domain/allegrolokalnie.aukcja865637302.cfd/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-26 16:15:12 UTC
- Last availability or vendor check: 2026-10-26 16:20:02 UTC
- Stored record updated: 2026-10-26 23:21:16 UTC
- VirusTotal detections in the stored snapshot: 12/92
- Independent public blocklist matches in the stored snapshot: 2
- Matching public blocklists: OpenPhish, Phishunt
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: allegrolokalnie

## Stored infrastructure

- Observed IP address: 104.21.26.36
- Registrar in stored WHOIS data: Hosting Concepts B.V. d/b/a Registrar.eu
- Registrar country in stored WHOIS data: RO
- Registration date in stored WHOIS data: 2026-10-24 13:04:30 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a17901-4d38-76fa-936f-69e3e9857629/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/allegrolokalnie.aukcja865637302.cfd
- Certificate Transparency search: https://crt.sh/?q=%25.allegrolokalnie.aukcja865637302.cfd
- Web Archive lookup: https://web.archive.org/web/*/https://allegrolokalnie.aukcja865637302.cfd/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
The captured screenshot from 2026-10-26 shows a bare Not Found page whose text warns that the requested address was not found on the server and asks the visitor to check the spelling. The page title recorded for the capture on 2026-10-26 read "1984 MZ etz 250 | Rybnik | Kup teraz na Allegro Lokalnie", an Allegro Lokalnie-style buy-now listing. PhishDestroy assessed the domain as an impersonation phishing page and first saw it on 2026-10-26.

How the scam works
The recorded listing title and offer path imitate an Allegro Lokalnie marketplace item, luring visitors with a buy-now offer tied to an unrelated domain. Captured JavaScript globals including goToCheckout, renderPhotos and track show a photo gallery wired to a checkout step, the typical funnel for capturing login or payment details. As a category risk, look-alike marketplace pages pull users away from the genuine service into attacker-controlled forms.

Evidence
The captured screenshot shows only the server's Not Found error text rather than the listing itself. On 2026-10-26 urlscan marked the captured offer page malicious with an overall phishing score of 100 and an ML engine score of 99, following a 307 redirect from plain HTTP to HTTPS, while a homepage scan returned 404. VirusTotal flagged the domain as malicious, with vendors including Sophos, Kaspersky and Fortinet applying phishing labels, whereas Google Safe Browsing did not flag it. OTX recorded 0 pulses on 2026-10-26; Spamhaus listed the domain in its phishing category, the PhishDestroy internal blocklist plus two external blocklists, OpenPhish and Phishunt, flagged it, and one script SHA256 hash 605e34bf9015 was recorded for campaign pivoting.

Infrastructure
The domain sat behind Cloudflare with its WAF enabled and Cloudflare-managed nameservers, and no registrar details were recorded. Technical posture: TLS 1.3 with AES-256-GCM, forward secrecy and ALPN h2; Content-Security-Policy, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, COOP, COEP and CORP all absent; DNSSEC unsigned; CAA records present.

What to do
Anyone who submitted credentials or payment details through this page should change their password on the genuine Allegro Lokalnie service, enable 2FA, and review recent account activity. Treat any item, payment or handover arranged through this capture as suspicious and cease contact. Defenders should block allegrolokalnie.aukcja865637302.cfd, alert on look-alike domains naming Allegro Lokalnie, and pivot on the recorded script hash.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a17901-4d38-76fa-936f-69e3e9857629/
Cloudflare Radar report: https://radar.cloudflare.com/scan/8e10108c-4c08-47bf-ad03-77f301ca105a
URLQuery report: https://urlquery.net/report/e6652c31-2a11-4086-b93b-5ff167420872
Stored capture screenshot: https://i.ibb.co/kg52ShX2/2057de5b126b.png
Cloudflare Radar screenshot (2026-10-26T16:19:40Z): https://screenshots.phishdestroy.io/cf/8e10108c-4c08-47bf-ad03-77f301ca105a.png
URLQuery screenshot: https://screenshots.phishdestroy.io/uq/e6652c31-2a11-4086-b93b-5ff167420872.png
URLScan screenshot (2026-10-25T09:51:37Z): https://screenshots.phishdestroy.io/us/01a17278-f3aa-767d-8fa6-dd6f710206ae.png
URLScan capture report: https://urlscan.io/result/01a17278-f3aa-767d-8fa6-dd6f710206ae/
URLScan screenshot (2026-10-26T13:06:05Z): https://screenshots.phishdestroy.io/us/01a17851-552a-77ef-b162-eccdb0218626.png
URLScan capture report: https://urlscan.io/result/01a17851-552a-77ef-b162-eccdb0218626/
URLScan screenshot (2026-10-26T16:25:19Z): https://screenshots.phishdestroy.io/us/01a17907-bcec-71f1-9d83-a4898ebf7bce.png
URLScan capture report: https://urlscan.io/result/01a17907-bcec-71f1-9d83-a4898ebf7bce/
URLScan screenshot (2026-10-26T16:32:42Z): https://screenshots.phishdestroy.io/us/01a1790c-af1f-745a-8dea-2a3888a662ba.png
URLScan capture report: https://urlscan.io/result/01a1790c-af1f-745a-8dea-2a3888a662ba/
VirusTotal report: https://www.virustotal.com/gui/domain/allegrolokalnie.aukcja865637302.cfd
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=allegrolokalnie.aukcja865637302.cfd
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-26 20:18:10 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/kg52ShX2/2057de5b126b.png
  Captured: 2026-10-26 16:20:02 UTC
- URLScan capture 1: https://screenshots.phishdestroy.io/01a17901-4d38-76fa-936f-69e3e9857629.png
  Captured: 2026-10-26 16:20:02 UTC
  Source report: https://urlscan.io/result/01a17901-4d38-76fa-936f-69e3e9857629/
- URLScan · 2026-10-26: https://screenshots.phishdestroy.io/us/01a17851-552a-77ef-b162-eccdb0218626.png
  Captured: 2026-10-26 13:06:05 UTC
  Source report: https://urlscan.io/result/01a17851-552a-77ef-b162-eccdb0218626/
  SHA-256: 299ce1cfe2bae63b5c40f4222cc56b6c6e36e7c407721740339f73bfbf625ed0
- URLScan · 2026-10-25: https://screenshots.phishdestroy.io/us/01a17278-f3aa-767d-8fa6-dd6f710206ae.png
  Captured: 2026-10-25 09:51:37 UTC
  Source report: https://urlscan.io/result/01a17278-f3aa-767d-8fa6-dd6f710206ae/
  SHA-256: 384d7f2356c62c93718845f62cbda08866b9e46a12e5c5e0c007841ca6d337aa
- URLScan · 2026-10-26: https://screenshots.phishdestroy.io/us/01a17907-bcec-71f1-9d83-a4898ebf7bce.png
  Captured: 2026-10-26 16:25:19 UTC
  Source report: https://urlscan.io/result/01a17907-bcec-71f1-9d83-a4898ebf7bce/
  SHA-256: 384d7f2356c62c93718845f62cbda08866b9e46a12e5c5e0c007841ca6d337aa
- URLScan · 2026-10-26: https://screenshots.phishdestroy.io/us/01a1790c-af1f-745a-8dea-2a3888a662ba.png
  Captured: 2026-10-26 16:32:42 UTC
  Source report: https://urlscan.io/result/01a1790c-af1f-745a-8dea-2a3888a662ba/
  SHA-256: 299ce1cfe2bae63b5c40f4222cc56b6c6e36e7c407721740339f73bfbf625ed0
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/8e10108c-4c08-47bf-ad03-77f301ca105a.png
  Captured: 2026-10-26 16:19:40 UTC
  Source report: https://radar.cloudflare.com/scan/8e10108c-4c08-47bf-ad03-77f301ca105a
  SHA-256: 0e2736430fec5d571928d6af081ac53a45401173ea0a66f7c042e3fff687ed59
- URLQuery: https://screenshots.phishdestroy.io/uq/e6652c31-2a11-4086-b93b-5ff167420872.png
  Source report: https://urlquery.net/report/e6652c31-2a11-4086-b93b-5ff167420872
  SHA-256: 1654df5466f551b5fcfa9de9cd1e52f053e8cdc21b6d4f8cb5e31c2ab143f4f3

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-26T16:25:52Z",
        "uuid": "01a17901-4d38-76fa-936f-69e3e9857629",
        "scanned_at": "2026-10-26T16:19:47Z",
        "final_url": "https://allegrolokalnie.aukcja865637302.cfd/oferta/1984-mz-etz-250/80344",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://allegrolokalnie.aukcja865637302.cfd/oferta/1984-mz-etz-250/80344",
                "from": "http://allegrolokalnie.aukcja865637302.cfd/oferta/1984-mz-etz-250/80344",
                "status": 307
            }
        ],
        "ip": "172.67.135.88",
        "domains": [
            "storage.googleapis.com"
        ],
        "ips": [
            "172.67.135.88"
        ],
        "asns": [
            "13335"
        ],
        "link_domains": [
            "allegrolokalnie.pl",
            "allegro.pl",
            "clicktrans.pl",
            "spolecznosc.allegro.pl"
        ],
        "doc_hash": "dab53dfc8f37d628ec5913b1a8cc26b9022172a4e4c65c8035a87b912cee859e",
        "script_hashes": [
            "605e34bf9015a800e7495933538d85cff682773ef9f69109bffad05c392e56a1"
        ],
        "globals": [
            "toggleDropdown",
            "toggleArrows",
            "renderPhotos",
            "renderThumbnails",
            "goTo",
            "goToCheckout",
            "photos",
            "currentIndex",
            "track",
            "thumbs"
        ],
        "tls": {
            "san": [
                "*.aukcja865637302.cfd",
                "aukcja865637302.cfd"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "YE1",
            "subject": "aukcja865637302.cfd",
            "protocol": "QUIC",
            "valid_to": "2027-01-22T14:14:18Z",
            "valid_from": "2026-10-24T14:14:19Z"
        },
        "domain_age_days": 1,
        "apex_age_days": 1,
        "tls_age_days": 2,
        "tls_valid_days": 89,
        "requests": 24,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 99,
                "malicious": true
            },
            "overall": {
                "tags": [
                    "phishing"
                ],
                "score": 100,
                "brands": [
                    "allegrolokalnie"
                ],
                "malicious": true,
                "categories": [
                    "phishing"
                ]
            },
            "urlscan": {
                "tags": [
                    "phishing"
                ],
                "score": 100,
                "brands": [
                    "Allegro Lokalnie"
                ],
                "malicious": true,
                "categories": [
                    "phishing"
                ]
            }
        },
        "headers": {
            "server": "cloudflare",
            "content-type": "text/html; charset=utf-8"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-26T16:25:54Z",
        "uuid": "8e10108c-4c08-47bf-ad03-77f301ca105a",
        "scanned_at": "2026-10-26T16:19:40Z",
        "final_url": "https://allegrolokalnie.aukcja865637302.cfd/",
        "status": 404,
        "history": [
            {
                "url": "https://allegrolokalnie.aukcja865637302.cfd/",
                "status": 404
            }
        ],
        "dom_hash": "7c6e985fdc0afc269b229d5a22ecb1d4b68ea121e00d45c47ac0260af0a972cd",
        "doc_hash": "70f06257807ac3b62752d0d27e9e6a8720a1b1296e5af844d5a4c20a6344a4c0",
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "allegrolokalnie.aukcja865637302.cfd",
                "type": "A",
                "value": "104.21.26.36"
            },
            {
                "name": "allegrolokalnie.aukcja865637302.cfd",
                "type": "A",
                "value": "172.67.135.88"
            },
            {
                "name": "allegrolokalnie.aukcja865637302.cfd",
                "type": "AAAA",
                "value": "2606:4700:3034::6815:1a24"
            },
            {
                "name": "allegrolokalnie.aukcja865637302.cfd",
                "type": "AAAA",
                "value": "2606:4700:3037::ac43:8758"
            }
        ],
        "dnssec_valid": false,
        "ip": "104.21.26.36",
        "verdict": {
            "tags": [
                "malware"
            ],
            "malicious": true,
            "categories": [
                "malware"
            ]
        },
        "whois": {
            "registrar": "Hosting Concepts B.V. d/b/a Registrar.eu",
            "created": "2026-10-24T15:04:30Z",
            "updated": "2026-10-24T15:04:37Z",
            "expires": "2027-10-24T23:59:59Z",
            "nameservers": [
                "clyde.ns.cloudflare.com",
                "sara.ns.cloudflare.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-26T16:51:02Z",
        "analysis_at": "2026-10-26T08:48:04Z",
        "stats": {
            "timeout": 0,
            "harmless": 46,
            "malicious": 9,
            "suspicious": 3,
            "undetected": 34
        },
        "detections": {
            "CRDF": "malicious",
            "DNS8": "phishing",
            "ESET": "suspicious",
            "G-Data": "phishing",
            "Sophos": "phishing",
            "CyRadar": "phishing",
            "Fortinet": "phishing",
            "SOCRadar": "phishing",
            "Kaspersky": "phishing",
            "LevelBlue": "suspicious",
            "Gridinsoft": "suspicious",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "tags": [
            "dga",
            "hex"
        ],
        "registrar": "Hosting Concepts B.V. d/b/a Registrar.eu",
        "created": "2026-10-24T15:04:30Z",
        "expires": "2027-10-24T23:59:59Z",
        "updated": "2026-10-24T17:04:38Z",
        "first_seen": "2026-10-24T16:20:14Z",
        "dns": [
            {
                "ttl": 300,
                "type": "A",
                "value": "104.21.26.36"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "172.67.135.88"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3034::6815:1a24"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3037::ac43:8758"
            }
        ],
        "dns_at": "2026-10-26T08:48:28Z",
        "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c",
        "cert": {
            "san": [
                "*.aukcja865637302.cfd",
                "aukcja865637302.cfd"
            ],
            "issuer": "Let's Encrypt / YE1",
            "serial": "57f99721f31db16f6927fcf6c7efc00c6dc",
            "sha256": "02cd89d4e8199f3ee9f6fc551ed08065799f6fd22886b0387499a0f1c94e0848",
            "subject": "aukcja865637302.cfd",
            "valid_to": "2027-01-22T14:14:18Z",
            "valid_from": "2026-10-24T14:14:19Z"
        },
        "whois": {
            "registrar": "Hosting Concepts B.V. d/b/a Registrar.eu",
            "registrar_iana_id": "1647",
            "registrar_url": "https://www.openprovider.com/",
            "created": "2026-10-24T15:04:30Z",
            "updated": "2026-10-24T15:04:37Z",
            "expires": "2027-10-24T23:59:59Z",
            "status": [
                "addPeriod",
                "clientTransferProhibited",
                "serverTransferProhibited"
            ],
            "nameservers": [
                "clyde.ns.cloudflare.com",
                "sara.ns.cloudflare.com"
            ],
            "dnssec": "unsigned"
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-26T16:26:04Z",
        "caa_records": {
            "domain": "allegrolokalnie.aukcja865637302.cfd"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_by": [
                "CloudFlare Family"
            ],
            "blocked_count": 1
        },
        "robots_txt": {
            "agents": [
                "*"
            ],
            "present": true
        },
        "tls_connection": {
            "alpn": "h2",
            "cipher": "TLS_AES_256_GCM_SHA384",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1",
                "TLSv1.1",
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                80,
                443,
                8080
            ]
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "173.245.59.91",
                    "host": "clyde.ns.cloudflare.com"
                },
                {
                    "ip": "172.64.32.144",
                    "host": "sara.ns.cloudflare.com"
                }
            ],
            "zone": "aukcja865637302.cfd"
        },
        "location": {
            "ip": "2606:4700:3034::6815:1a24",
            "asn": "13335",
            "org": "Cloudflare, Inc.",
            "city": "Toronto",
            "country": "CA"
        },
        "ssl": {
            "issuer": "Let's Encrypt / YE1",
            "subject": "aukcja865637302.cfd"
        },
        "dns": {
            "A": [
                "172.67.135.88",
                "104.21.26.36"
            ],
            "AAAA": [
                "2606:4700:3037::ac43:8758",
                "2606:4700:3034::6815:1a24"
            ]
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "hsts": {
            "message": "Site does not serve any HSTS headers."
        },
        "http_security": {
            "xFrameOptions": false,
            "referrerPolicy": false,
            "xXSSProtection": false,
            "permissionsPolicy": false,
            "xContentTypeOptions": false,
            "contentSecurityPolicy": false,
            "strictTransportPolicy": false,
            "crossOriginOpenerPolicy": false,
            "crossOriginEmbedderPolicy": false,
            "crossOriginResourcePolicy": false
        },
        "firewall": {
            "waf": "Cloudflare",
            "has_waf": true
        },
        "get_ip": {
            "ip": "2606:4700:3037::ac43:8758",
            "family": 6
        },
        "whois": {
            "registrar": "Hosting Concepts B.V. d/b/a Registrar.eu",
            "created": "2026-10-24T15:04:30Z",
            "updated": "2026-10-24T15:04:37Z",
            "expires": "2027-10-24T23:59:59Z",
            "status": [
                "serverTransferProhibited https://icann.org/epp",
                "clientTransferProhibited https://icann.org/epp",
                "addPeriod https://icann.org/epp"
            ],
            "nameservers": [
                "clyde.ns.cloudflare.com",
                "sara.ns.cloudflare.com"
            ]
        },
        "headers": {
            "headers": {
                "server": "cloudflare",
                "content-type": "text/html; charset=utf-8"
            }
        }
    }
}
```