# PhishDestroy domain threat record: baxleri.shop

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/baxleri.shop/
Machine-readable companion: https://phishdestroy.io/domain/baxleri.shop/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-22 20:48:51 UTC
- Last availability or vendor check: 2026-10-22 22:54:15 UTC
- Stored record updated: 2026-10-22 23:07:44 UTC
- VirusTotal detections in the stored snapshot: 13/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored infrastructure

- Observed IP address: 91.92.35.94
- Registrar in stored WHOIS data: Spaceship, Inc.
- Last stored HTTP status: 200
- Registration date in stored WHOIS data: 2026-10-09 22:19:13 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a165d0-a1a6-7557-adea-b599c31e1c04/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/baxleri.shop
- Certificate Transparency search: https://crt.sh/?q=%25.baxleri.shop
- Web Archive lookup: https://web.archive.org/web/*/https://baxleri.shop/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
PhishDestroy added baxleri.shop to its internal blocklist on 2026-10-22. The domain, registered on 2026-10-10, returned an HTTP 200 response that redirected via HTTP to neluora.shop; the page title was not recorded, so the landing‑page content is unknown.

How the scam works
A domain flagged as suspicious can be used for phishing, malware delivery, or as a redirector to other harmful sites. The observed cross‑site HTTP redirect and multiple vendor detections place baxleri.shop within this broader threat category, though no specific payload or credential‑harvesting form was observed.

Evidence
VirusTotal scanned the domain on 2026-10-21 and reported 13 detections from 92 engines, with 10 malicious and 3 suspicious labels from vendors such as BitDefender, CRDF and ESET. Google Safe Browsing checked on 2026-10-22 and did not flag the domain. Cloudflare Radar (2026-10-22) marked it malicious under the malware category; URLScan (2026-10-12) gave an overall clean verdict but a malicious engine score of 97, OTX listed three pulses as of 2026-10-22, and PhishDestroy’s internal blocklist flags the domain while external lists show a single hit from the CloudFlare Family resolver list.

Infrastructure
The domain was registered with Spaceship, Inc. on 2026-10-10 and resolves to IP 91.92.35.94, recorded as belonging to IP Vendetta Inc. in the country SC, with DNSSEC enabled. Its TLS certificate, issued by Let’s Encrypt, is valid from 2026-10-11 to 2027-01-09 and lists baxleri.shop and www.baxleri.shop in the SAN.

What to do
Avoid entering credentials, personal data, or downloading files from baxleri.shop; if any were submitted, change the associated passwords and monitor accounts for suspicious activity. Defenders should block the exact domain in firewalls and proxies, review logs for connections to 91.92.35.94, and share the indicator with relevant threat‑intel platforms.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a13041-0337-73da-8e44-c8206c221036/
Cloudflare Radar report: https://radar.cloudflare.com/scan/17f5c57e-6121-4a0e-b3bd-aec40b311b27
Stored capture screenshot: https://urlscan.io/screenshots/01a13041-0337-73da-8e44-c8206c221036.png
Cloudflare Radar screenshot (2026-10-22T20:59:51Z): https://screenshots.phishdestroy.io/cf/17f5c57e-6121-4a0e-b3bd-aec40b311b27.png
URLScan screenshot (2026-10-11T12:30:21Z): https://screenshots.phishdestroy.io/us/01a12af1-3822-743f-9240-aed80e818a64.png
URLScan capture report: https://urlscan.io/result/01a12af1-3822-743f-9240-aed80e818a64/
VirusTotal report: https://www.virustotal.com/gui/domain/baxleri.shop
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=baxleri.shop
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-22 21:33:37 UTC

## Stored page captures

- Primary capture: https://urlscan.io/screenshots/01a165d0-a1a6-7557-adea-b599c31e1c04.png
  Captured: 2026-10-22 22:54:15 UTC
- URLScan capture: https://screenshots.phishdestroy.io/01a13041-0337-73da-8e44-c8206c221036.png
  Captured: 2026-10-22 20:48:51 UTC
  Source report: https://urlscan.io/result/01a165d0-a1a6-7557-adea-b599c31e1c04/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/17f5c57e-6121-4a0e-b3bd-aec40b311b27.png
  Captured: 2026-10-22 20:59:51 UTC
  Source report: https://radar.cloudflare.com/scan/17f5c57e-6121-4a0e-b3bd-aec40b311b27
  SHA-256: bb5f7b4ca87222909e7cfd8d6a47f563fe071eaf9c5d66a3b649e8d83f05a17e
- URLScan · 2026-10-11: https://screenshots.phishdestroy.io/us/01a12af1-3822-743f-9240-aed80e818a64.png
  Captured: 2026-10-11 12:30:21 UTC
  Source report: https://urlscan.io/result/01a12af1-3822-743f-9240-aed80e818a64/
  SHA-256: df3ce695eeda95f111b61246eece94247a44e1cee863fd5d0198a9abfe6c9599

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-22T23:10:09Z",
        "uuid": "01a165d0-a1a6-7557-adea-b599c31e1c04",
        "scanned_at": "2026-10-22T22:52:20Z",
        "final_url": "https://baxleri.shop/cgi-sys/defaultwebpage.cgi",
        "status": 200,
        "redirected": "same-domain",
        "redirects": [
            {
                "to": "https://baxleri.shop/",
                "from": "http://baxleri.shop/",
                "status": 307
            },
            {
                "to": "https://baxleri.shop/cgi-sys/defaultwebpage.cgi",
                "from": "https://baxleri.shop/"
            }
        ],
        "ip": "91.92.35.94",
        "ips": [
            "91.92.35.94"
        ],
        "asns": [
            "209101"
        ],
        "countries": [
            "BG"
        ],
        "link_domains": [
            "go.cpanel.net",
            "cpanel.net"
        ],
        "doc_hash": "9278d16ed2fdcd5dc651615b0b8adc6b55fb667a9d106a9891b861d4561d9a24",
        "tls": {
            "san": [
                "baxleri.shop",
                "www.baxleri.shop"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "YE2",
            "subject": "baxleri.shop",
            "protocol": "TLS 1.3",
            "valid_to": "2027-01-09T10:47:35Z",
            "valid_from": "2026-10-11T10:47:36Z"
        },
        "domain_age_days": 12,
        "apex_age_days": 12,
        "tls_age_days": 11,
        "tls_valid_days": 89,
        "requests": 8,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 85,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "LiteSpeed",
            "content-type": "text/html",
            "strict-transport-security": "max-age=63072000; includeSubDomains; preload",
            "x-frame-options": "SAMEORIGIN",
            "x-content-type-options": "nosniff",
            "referrer-policy": "strict-origin-when-cross-origin"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-22T21:02:34Z",
        "uuid": "17f5c57e-6121-4a0e-b3bd-aec40b311b27",
        "scanned_at": "2026-10-22T20:59:51Z",
        "final_url": "https://baxleri.shop/cgi-sys/defaultwebpage.cgi",
        "status": 200,
        "history": [
            {
                "url": "https://baxleri.shop/",
                "status": 200
            },
            {
                "url": "https://baxleri.shop/cgi-sys/defaultwebpage.cgi",
                "status": 200
            }
        ],
        "dom_hash": "b259d4c75057396bfb7d9d47400c526bfda21a9b43818ce537c1c3eea3ff021a",
        "doc_hash": "9278d16ed2fdcd5dc651615b0b8adc6b55fb667a9d106a9891b861d4561d9a24",
        "phishing_v2": [
            "phishing"
        ],
        "domain_risks": [
            "Newly Seen Domains",
            "Security Risks",
            "Malware",
            "Security threats",
            "CIPA Filter",
            "CIPA"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "baxleri.shop",
                "type": "A",
                "value": "91.92.35.94"
            }
        ],
        "dnssec_valid": true,
        "ip": "91.92.35.94",
        "verdict": {
            "tags": [
                "malware"
            ],
            "malicious": true,
            "categories": [
                "malware"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-22T21:31:59Z",
        "analysis_at": "2026-10-21T13:56:02Z",
        "stats": {
            "timeout": 0,
            "harmless": 46,
            "malicious": 10,
            "suspicious": 3,
            "undetected": 33
        },
        "detections": {
            "CRDF": "malicious",
            "DNS8": "phishing",
            "ESET": "suspicious",
            "VIPRE": "phishing",
            "G-Data": "phishing",
            "Sophos": "phishing",
            "Fortinet": "spam",
            "SOCRadar": "phishing",
            "Kaspersky": "phishing",
            "Gridinsoft": "suspicious",
            "BitDefender": "phishing",
            "alphaMountain.ai": "phishing",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "first_seen": "2026-10-11T12:03:39Z",
        "dns": [
            {
                "ttl": 1800,
                "type": "SOA",
                "rname": "support.spaceship.com",
                "value": "launch1.spaceship.net"
            },
            {
                "ttl": 1800,
                "type": "NS",
                "value": "launch2.spaceship.net"
            },
            {
                "ttl": 1800,
                "type": "NS",
                "value": "launch1.spaceship.net"
            },
            {
                "ttl": 3600,
                "type": "A",
                "value": "91.92.35.94"
            }
        ],
        "dns_at": "2026-10-21T14:01:18Z",
        "jarm": "1dd40d40d00040d00042d43d000000ffd4768d0539f26c1eea462bed21f172",
        "cert": {
            "san": [
                "baxleri.shop",
                "www.baxleri.shop"
            ],
            "issuer": "Let's Encrypt / YE2",
            "serial": "6a5fc1d2a99ad973ca9b764ce648dca4666",
            "sha256": "863c6639bacf4b9a2a56920f66f4e915de4ee5ceb08b3667e2d6e943982afdae",
            "subject": "baxleri.shop",
            "valid_to": "2027-01-09T10:47:35Z",
            "valid_from": "2026-10-11T10:47:36Z"
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-22T21:02:47Z",
        "mail_config": {
            "spf_lookups": 0
        },
        "caa_records": {
            "domain": "baxleri.shop"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_by": [
                "CloudFlare Family"
            ],
            "blocked_count": 1
        },
        "archives": {
            "last": "2026-10-22T20:52:53Z",
            "first": "2026-10-10T07:39:47Z",
            "changes": 1,
            "days_archived": 2,
            "scans_per_day": 0.08,
            "avg_page_bytes": 872
        },
        "trackers": {
            "requests": 6
        },
        "mixed_content": {
            "third_party_scripts": 0
        },
        "status": {
            "up": true,
            "code": 200,
            "timings": {
                "dns": 39,
                "tls": 23,
                "wait": 39,
                "connect": 24,
                "download": 1
            },
            "response_ms": 126
        },
        "tls_connection": {
            "alpn": "h2",
            "cipher": "TLS_AES_256_GCM_SHA384",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                22,
                80,
                443
            ]
        },
        "carbon": {
            "bytes": 163,
            "co2_grams": 0,
            "cleaner_than": 95
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "162.159.26.38",
                    "host": "launch1.spaceship.net"
                },
                {
                    "ip": "162.159.27.32",
                    "host": "launch2.spaceship.net"
                }
            ],
            "zone": "baxleri.shop"
        },
        "location": {
            "ip": "91.92.35.94",
            "asn": "209101",
            "org": "IP Vendetta Inc.",
            "city": "Victoria",
            "country": "SC"
        },
        "ssl": {
            "issuer": "Let's Encrypt / YE2",
            "subject": "baxleri.shop"
        },
        "dns": {
            "A": [
                "91.92.35.94"
            ],
            "NS": [
                "launch2.spaceship.net",
                "launch1.spaceship.net"
            ],
            "SOA": "{\"nsname\": \"launch1.spaceship.net\", \"hostmaster\": \"support.spaceship.com\", \"serial\": 1791719061, \"refresh\": 43200, \"retry\": 3600, \"expire\": 604800, \"minttl\": 3600}"
        },
        "dnssec": {
            "ds": true,
            "rrsig": true,
            "dnskey": true
        },
        "hsts": {
            "header": "max-age=63072000; includeSubDomains; preload",
            "message": "Site is compatible with the HSTS preload list!",
            "compatible": true
        },
        "http_security": {
            "xFrameOptions": "SAMEORIGIN",
            "referrerPolicy": "strict-origin-when-cross-origin",
            "xXSSProtection": false,
            "permissionsPolicy": false,
            "xContentTypeOptions": "nosniff",
            "contentSecurityPolicy": false,
            "strictTransportPolicy": "max-age=63072000; includeSubDomains; preload",
            "crossOriginOpenerPolicy": false,
            "crossOriginEmbedderPolicy": false,
            "crossOriginResourcePolicy": false
        },
        "get_ip": {
            "ip": "91.92.35.94",
            "family": 4
        },
        "redirects": {
            "chain": [
                "https://baxleri.shop"
            ]
        },
        "tech_stack": {
            "technologies": [
                "LiteSpeed",
                "lit-html",
                "lit-element",
                "HSTS"
            ]
        },
        "headers": {
            "headers": {
                "server": "LiteSpeed",
                "content-type": "text/html",
                "strict-transport-security": "max-age=63072000; includeSubDomains; preload",
                "x-frame-options": "SAMEORIGIN",
                "x-content-type-options": "nosniff",
                "referrer-policy": "strict-origin-when-cross-origin"
            }
        }
    }
}
```