# PhishDestroy domain threat record: aneluva.shop Content language: English Canonical HTML report: https://phishdestroy.io/domain/aneluva.shop/ Machine-readable companion: https://phishdestroy.io/domain/aneluva.shop/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-10-21 02:18:35 UTC - Last availability or vendor check: 2026-10-21 22:00:18 UTC - Stored record updated: 2026-10-22 00:23:44 UTC - VirusTotal detections in the stored snapshot: 4/92 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: no stored flag ## Stored infrastructure - Observed IP address: 91.92.35.94 - Registrar in stored WHOIS data: Spaceship, Inc. - Last stored HTTP status: 302 - Registration date in stored WHOIS data: 2026-10-16 01:10:02 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a14930-2772-737b-979d-b13f594685e0/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/aneluva.shop - Certificate Transparency search: https://crt.sh/?q=%25.aneluva.shop - Web Archive lookup: https://web.archive.org/web/*/https://aneluva.shop/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview PhishDestroy listed aneluva.shop as suspicious based on VirusTotal detections of three malicious vendors and a redirect to neluora.shop. The domain was first seen by PhishDestroy on 2026-10-21. A page fetch on 2026-10-21 returned HTTP 200 and performed a cross‑site HTTP redirect to neluora.shop. How the scam works The available evidence does not identify a concrete fraud technique, only that the site redirects visitors to another domain, a pattern often used to hide the final destination. Such redirects can be leveraged to deliver phishing pages, malware or other unwanted content, but the specific intent of aneluva.shop cannot be confirmed from the current data. Evidence VirusTotal recorded four detections on 2026-10-21, with three vendors (G‑Data, Sophos, SOCRadar) marking the domain as malicious and one vendor (DNS8) as suspicious. Google Safe Browsing checked on 2026-10-21 and did not flag the domain. urlscan captured the site on 2026-10-17, showing a 200 response and an engine‑based malicious score of 97, while its overall verdict was non‑malicious. Cloudflare Radar on 2026-10-21 labeled the domain malicious under the malware category; OTX listed one pulse referencing the domain; PhishDestroy’s internal blocklist contains the domain, whereas external blocklists reported zero matches; Webcheck DNS checks on 2026-10-21 queried twelve resolvers and found one block. Infrastructure The recorded IP for aneluva.shop is 91.92.35.94, belonging to the network labeled IP Vendetta Inc. The IP record includes the country code SC; no registrar or CDN details are available. What to do Users should avoid visiting or interacting with aneluva.shop and should not submit credentials or download files from it. If any credentials were entered, change them immediately and monitor the associated accounts for unauthorized activity. Defenders should block the domain, review DNS logs for queries to 91.92.35.94, and apply similar controls to any future redirects originating from this domain. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a14930-2772-737b-979d-b13f594685e0/ VirusTotal report: https://www.virustotal.com/gui/domain/aneluva.shop Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=aneluva.shop Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-21 02:27:45 UTC ## Stored page captures - Primary capture: https://urlscan.io/screenshots/01a14930-2772-737b-979d-b13f594685e0.png Captured: 2026-10-21 02:18:35 UTC - URLScan capture: https://screenshots.phishdestroy.io/01a14930-2772-737b-979d-b13f594685e0.png Captured: 2026-10-21 03:30:35 UTC Source report: https://urlscan.io/result/01a14930-2772-737b-979d-b13f594685e0/ - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/5c4fe13e-772b-4a2a-8593-3de197d9e076.png Captured: 2026-10-21 02:23:51 UTC Source report: https://radar.cloudflare.com/scan/5c4fe13e-772b-4a2a-8593-3de197d9e076 SHA-256: 5b685b6fd0c356b8389e33596a40c60d2f63ca6aac5f9ec6250f109105361924 - URLScan · 2026-10-16: https://screenshots.phishdestroy.io/us/01a14307-4cdb-761a-845b-b7ed33047040.png Captured: 2026-10-16 04:45:23 UTC Source report: https://urlscan.io/result/01a14307-4cdb-761a-845b-b7ed33047040/ SHA-256: df3ce695eeda95f111b61246eece94247a44e1cee863fd5d0198a9abfe6c9599 - URLScan · 2026-10-16: https://screenshots.phishdestroy.io/us/01a14424-2fc1-738a-8baa-2736c3720017.png Captured: 2026-10-16 09:56:30 UTC Source report: https://urlscan.io/result/01a14424-2fc1-738a-8baa-2736c3720017/ SHA-256: df3ce695eeda95f111b61246eece94247a44e1cee863fd5d0198a9abfe6c9599 ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-21T02:26:45Z", "uuid": "01a14930-2772-737b-979d-b13f594685e0", "scanned_at": "2026-10-17T09:27:40Z", "final_url": "https://aneluva.shop/", "status": 200, "redirected": "https-only", "ip": "91.92.35.94", "ips": [ "91.92.35.94" ], "asns": [ "209101" ], "countries": [ "BG" ], "doc_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "tls": { "san": [ "aneluva.shop", "www.aneluva.shop" ], "cipher": "AES_128_GCM", "issuer": "YE1", "subject": "aneluva.shop", "protocol": "TLS 1.3", "valid_to": "2027-01-14T03:05:13Z", "valid_from": "2026-10-16T03:05:14Z" }, "domain_age_days": 1, "apex_age_days": 1, "tls_age_days": 1, "tls_valid_days": 89, "requests": 2, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 97, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "LiteSpeed", "content-type": "text/html; charset=UTF-8", "strict-transport-security": "max-age=63072000; includeSubDomains; preload", "x-frame-options": "SAMEORIGIN", "x-content-type-options": "nosniff", "referrer-policy": "strict-origin-when-cross-origin" } }, "cf": { "v": 1, "fetched_at": "2026-10-21T02:26:46Z", "uuid": "5c4fe13e-772b-4a2a-8593-3de197d9e076", "scanned_at": "2026-10-21T02:23:51Z", "final_url": "https://aneluva.shop/", "status": 200, "history": [ { "url": "https://aneluva.shop/", "status": 200 } ], "dom_hash": "a7fe83ec64bb23eb28090598db3d166ed98e52e39d1afbbfd74c579553f93e4e", "domain_risks": [ "Newly Seen Domains", "Security Risks", "Malware", "Security threats", "New Domains", "CIPA Filter", "CIPA" ], "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "aneluva.shop", "type": "A", "value": "91.92.35.94" } ], "dnssec_valid": true, "ip": "91.92.35.94", "verdict": { "tags": [ "malware" ], "malicious": true, "categories": [ "malware" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-21T02:22:51Z", "analysis_at": "2026-10-16T17:30:24Z", "stats": { "timeout": 0, "harmless": 51, "malicious": 3, "suspicious": 1, "undetected": 37 }, "detections": { "DNS8": "suspicious", "G-Data": "phishing", "Sophos": "phishing", "SOCRadar": "phishing" }, "reputation": 0, "categories": { "alphaMountain.ai": "Phishing (alphaMountain.ai)" }, "first_seen": "2026-10-16T04:15:04Z", "dns": [ { "ttl": 1800, "type": "NS", "value": "launch2.spaceship.net" }, { "ttl": 1800, "type": "SOA", "rname": "support.spaceship.com", "value": "launch1.spaceship.net" }, { "ttl": 3600, "type": "A", "value": "91.92.35.94" }, { "ttl": 1800, "type": "NS", "value": "launch1.spaceship.net" } ], "dns_at": "2026-10-16T17:35:31Z", "jarm": "1dd40d40d00040d00042d43d000000ffd4768d0539f26c1eea462bed21f172", "cert": { "san": [ "aneluva.shop", "www.aneluva.shop" ], "issuer": "Let's Encrypt / YE1", "serial": "6bcbc30391300257a3cac01886428b03925", "sha256": "d21d55ca2792cf7e183ac4ed11aa17fcb48152bc7f57c1d0e58a870b433997b7", "subject": "aneluva.shop", "valid_to": "2027-01-14T03:05:13Z", "valid_from": "2026-10-16T03:05:14Z" } }, "webcheck": { "v": 1, "fetched_at": "2026-10-21T02:27:23Z", "mail_config": { "spf_lookups": 0 }, "caa_records": { "domain": "aneluva.shop" }, "block_lists": { "resolvers": 12, "blocked_by": [ "CloudFlare Family" ], "blocked_count": 1 }, "archives": { "last": "2026-10-21T02:22:07Z", "first": "2026-10-16T04:22:08Z", "changes": 0, "days_archived": 2, "scans_per_day": 0.2, "avg_page_bytes": 599 }, "ports": { "open": [ 22 ] }, "dns_server": { "ns": [ { "ip": "162.159.27.32", "host": "launch2.spaceship.net" }, { "ip": "162.159.26.38", "host": "launch1.spaceship.net" } ], "zone": "aneluva.shop" }, "location": { "ip": "91.92.35.94", "asn": "209101", "org": "IP Vendetta Inc.", "city": "Amsterdam", "country": "NL" }, "dns": { "A": [ "91.92.35.94" ], "NS": [ "launch2.spaceship.net", "launch1.spaceship.net" ], "SOA": "{\"nsname\": \"launch1.spaceship.net\", \"hostmaster\": \"support.spaceship.com\", \"serial\": 1792123317, \"refresh\": 43200, \"retry\": 3600, \"expire\": 604800, \"minttl\": 3600}" }, "dnssec": { "ds": true, "rrsig": true, "dnskey": true }, "get_ip": { "ip": "91.92.35.94", "family": 4 } } } ```