# PhishDestroy domain threat record: bikehubplus.shop Content language: English Canonical HTML report: https://phishdestroy.io/domain/bikehubplus.shop/ Machine-readable companion: https://phishdestroy.io/domain/bikehubplus.shop/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-10-23 05:19:36 UTC - Last availability or vendor check: 2026-10-23 11:24:12 UTC - Stored record updated: 2026-10-23 18:20:46 UTC - VirusTotal detections in the stored snapshot: 18/92 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: no stored flag ## Stored infrastructure - Observed IP address: 94.154.172.92 - Registrar in stored WHOIS data: Namecheap, Inc. - Last stored HTTP status: 200 - Registration date in stored WHOIS data: 2026-05-06 15:24:17 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a16732-7a14-76dd-8b43-200a50318a93/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/bikehubplus.shop - Certificate Transparency search: https://crt.sh/?q=%25.bikehubplus.shop - Web Archive lookup: https://web.archive.org/web/*/https://bikehubplus.shop/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview PhishDestroy listed bikehubplus.shop on its internal blocklist because a large number of security vendors flagged the domain as malicious. The recorded page title reads "Sorry, the website has been stopped" and the HTTP response was 200 on 2026-10-23. The domain was first seen by PhishDestroy on 2026-10-23. How the scam works The classification is based on automated detections that associate the domain with phishing or malware risk, but no specific malicious behavior was observed on the captured page. Such listings typically indicate that the site may be used to lure users into revealing credentials, downloading unwanted software, or otherwise compromising security, though the exact tactic cannot be confirmed from the available evidence. Evidence VirusTotal reported 15 malicious and 3 suspicious detections out of 92 engines on 2026-10-22, with vendors such as ADMINUSLabs, BitDefender and Fortinet marking it malicious. Google Safe Browsing did not flag the domain on 2026-10-23. urlscan.io’s engine verdict was malicious with a score of 96, while its overall verdict was benign on 2026-10-23. Cloudflare Radar labeled the domain malicious for malware on 2026-10-23. OTX listed five pulses referencing the domain on the same day. PhishDestroy’s internal blocklist is true, while external blocklists showed zero matches. Spamhaus DBL did not list the domain. Infrastructure The domain is 168 days old and resolves to 94.154.172.92, hosted by IP Vendetta Inc. in South Carolina. It is announced by ASN 209101. The site uses a Let’s Encrypt certificate that expired on 2026-09-30. Nameservers are dns1.registrar-servers.com and dns2.registrar-servers.com, with standard MX records and no DNSSEC signatures. What to do Visitors should avoid entering any credentials or downloading files from the site and should change passwords if they suspect they entered data. Organizations should block bikehubplus.shop at the firewall and monitor logs for connections to 94.154.172.92. If any account credentials were used on the site, reset them and enable multi‑factor authentication. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a16732-7a14-76dd-8b43-200a50318a93/ Cloudflare Radar report: https://radar.cloudflare.com/scan/c0f9f3b7-4a5e-4b24-a124-c7fc43b7e923 URLQuery report: https://urlquery.net/report/caf680ea-e2b7-4bdb-9390-7af99e3b1487 Stored capture screenshot: https://i.ibb.co/Ld160cmq/f55bb5c7b3a6.png Cloudflare Radar screenshot (2026-10-23T06:00:04Z): https://screenshots.phishdestroy.io/cf/c0f9f3b7-4a5e-4b24-a124-c7fc43b7e923.png URLQuery screenshot: https://screenshots.phishdestroy.io/uq/caf680ea-e2b7-4bdb-9390-7af99e3b1487.png VirusTotal report: https://www.virustotal.com/gui/domain/bikehubplus.shop Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=bikehubplus.shop Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-23 08:46:41 UTC ## Stored page captures - Primary capture: https://i.ibb.co/Ld160cmq/f55bb5c7b3a6.png Captured: 2026-10-23 05:19:36 UTC - URLScan capture: https://screenshots.phishdestroy.io/01a16732-7a14-76dd-8b43-200a50318a93.png Captured: 2026-10-23 05:19:36 UTC Source report: https://urlscan.io/result/01a16732-7a14-76dd-8b43-200a50318a93/ - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/c0f9f3b7-4a5e-4b24-a124-c7fc43b7e923.png Captured: 2026-10-23 06:00:04 UTC Source report: https://radar.cloudflare.com/scan/c0f9f3b7-4a5e-4b24-a124-c7fc43b7e923 SHA-256: 36d07495bcca5f3e48f8eca8aedf572633b1c8597772c12bfb5fcf7563770e66 - URLQuery: https://screenshots.phishdestroy.io/uq/caf680ea-e2b7-4bdb-9390-7af99e3b1487.png Source report: https://urlquery.net/report/caf680ea-e2b7-4bdb-9390-7af99e3b1487 SHA-256: 700b79ed1f685bf601be09bd31336253a5b3a482484fbb4258e2a9c830fa1255 ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-23T06:04:57Z", "uuid": "01a16732-7a14-76dd-8b43-200a50318a93", "scanned_at": "2026-10-23T05:18:53Z", "final_url": "http://bikehubplus.shop/", "status": 200, "redirects": [ { "to": "https://bikehubplus.shop/", "from": "http://bikehubplus.shop/", "status": 307 }, { "to": "http://bikehubplus.shop/", "from": "https://bikehubplus.shop/", "status": 307 } ], "ip": "94.154.172.92", "ips": [ "94.154.172.92" ], "asns": [ "209101" ], "countries": [ "BG" ], "doc_hash": "484ee30249a893f2c835f0fd812695a44d401f9ac3949f5e1cf5989233f414e9", "domain_age_days": 168, "apex_age_days": 168, "requests": 3, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 96, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "nginx", "content-type": "text/html" } }, "cf": { "v": 1, "fetched_at": "2026-10-23T06:04:58Z", "uuid": "c0f9f3b7-4a5e-4b24-a124-c7fc43b7e923", "scanned_at": "2026-10-23T06:00:04Z", "final_url": "https://bikehubplus.shop/", "history": [ { "url": "https://bikehubplus.shop/", "status": 0 } ], "dom_hash": "8209feb37509e8b9535dd946f53ba5cb1dbf088871d39dbaaf39fceb7b2c1f3d", "domain_risks": [ "Malware", "Security threats", "CIPA Filter", "CIPA" ], "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "bikehubplus.shop", "type": "A", "value": "94.154.172.92" } ], "dnssec_valid": false, "verdict": { "tags": [ "malware" ], "malicious": true, "categories": [ "malware" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-23T08:38:51Z", "analysis_at": "2026-10-22T12:15:02Z", "stats": { "timeout": 0, "harmless": 42, "malicious": 15, "suspicious": 3, "undetected": 32 }, "detections": { "DNS8": "suspicious", "ESET": "suspicious", "VIPRE": "phishing", "G-Data": "phishing", "Lionic": "phishing", "Sophos": "phishing", "CyRadar": "phishing", "Webroot": "malicious", "Fortinet": "phishing", "SOCRadar": "phishing", "Kaspersky": "phishing", "LevelBlue": "phishing", "Seclookup": "malicious", "Gridinsoft": "suspicious", "ADMINUSLabs": "malicious", "BitDefender": "phishing", "alphaMountain.ai": "phishing", "Forcepoint ThreatSeeker": "phishing" }, "reputation": 0, "first_seen": "2026-05-11T17:17:31Z", "dns": [ { "ttl": 1800, "type": "MX", "value": "eforward5.registrar-servers.com", "priority": 20 }, { "ttl": 1800, "type": "MX", "value": "eforward3.registrar-servers.com", "priority": 10 }, { "ttl": 1800, "type": "A", "value": "94.154.172.92" }, { "ttl": 3601, "type": "SOA", "rname": "hostmaster.registrar-servers.com", "value": "dns1.registrar-servers.com" }, { "ttl": 1800, "type": "NS", "value": "dns1.registrar-servers.com" }, { "ttl": 1800, "type": "MX", "value": "eforward1.registrar-servers.com", "priority": 10 }, { "ttl": 1800, "type": "MX", "value": "eforward2.registrar-servers.com", "priority": 10 }, { "ttl": 1800, "type": "MX", "value": "eforward4.registrar-servers.com", "priority": 15 }, { "ttl": 1800, "type": "TXT", "value": "v=spf1 include:spf.efwd.registrar-servers.com ~all" }, { "ttl": 1800, "type": "NS", "value": "dns2.registrar-servers.com" } ], "dns_at": "2026-10-22T12:20:36Z", "jarm": "3fd3fd0003fd3fd00042d42d0000002059a3b916699461c5923779b77cf06b", "cert": { "san": [ "94.154.172.92" ], "issuer": "Let's Encrypt / YR2", "serial": "50a6988107e6dd2cd9d41d61bbf67350bd8", "sha256": "cf50b5651f2296293e87039f0a88b7e957b99b513fb8625daefa3b58ecf8328c", "valid_to": "2026-09-30T01:17:03Z", "valid_from": "2026-09-23T09:17:04Z" } }, "webcheck": { "v": 1, "fetched_at": "2026-10-23T06:05:18Z", "mail_config": { "mx": [ "eforward2.registrar-servers.com", "eforward3.registrar-servers.com", "eforward4.registrar-servers.com", "eforward5.registrar-servers.com", "eforward1.registrar-servers.com" ], "spf": "v=spf1 include:spf.efwd.registrar-servers.com ~all", "spf_lookups": 1 }, "caa_records": { "domain": "bikehubplus.shop" }, "block_lists": { "resolvers": 12, "blocked_by": [ "CloudFlare Family" ], "blocked_count": 1 }, "tls_connection": { "alpn": "h2", "cipher": "TLS_AES_256_GCM_SHA384", "protocol": "TLSv1.3", "versions": [ "TLSv1.2", "TLSv1.3" ], "authorized": false, "forward_secrecy": true }, "ports": { "open": [ 21, 22, 80, 443 ] }, "dns_server": { "ns": [ { "ip": "156.154.133.200", "host": "dns2.registrar-servers.com" }, { "ip": "156.154.132.200", "host": "dns1.registrar-servers.com" } ], "zone": "bikehubplus.shop" }, "location": { "ip": "94.154.172.92", "asn": "209101", "org": "IP Vendetta Inc.", "city": "Victoria", "country": "SC" }, "ssl": { "issuer": "Let's Encrypt / YR2" }, "dns": { "A": [ "94.154.172.92" ], "MX": [ "{\"exchange\": \"eforward5.registrar-servers.com\", \"priority\": 20}", "{\"exchange\": \"eforward3.registrar-servers.com\", \"priority\": 10}", "{\"exchange\": \"eforward1.registrar-servers.com\", \"priority\": 10}", "{\"exchange\": \"eforward2.registrar-servers.com\", \"priority\": 10}", "{\"exchange\": \"eforward4.registrar-servers.com\", \"priority\": 15}" ], "NS": [ "dns2.registrar-servers.com", "dns1.registrar-servers.com" ], "SOA": "{\"nsname\": \"dns1.registrar-servers.com\", \"hostmaster\": \"hostmaster.registrar-servers.com\", \"serial\": 1778519064, \"refresh\": 43200, \"retry\": 3600, \"expire\": 604800, \"minttl\": 3601}", "TXT": [ "v=spf1 include:spf.efwd.registrar-servers.com ~all" ] }, "dnssec": { "ds": false, "rrsig": false, "dnskey": false }, "get_ip": { "ip": "94.154.172.92", "family": 4 } } } ```