# PhishDestroy domain threat record: bikeroza.shop Content language: English Canonical HTML report: https://phishdestroy.io/domain/bikeroza.shop/ Machine-readable companion: https://phishdestroy.io/domain/bikeroza.shop/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-10-23 05:20:47 UTC - Last availability or vendor check: 2026-10-23 11:24:14 UTC - Stored record updated: 2026-10-23 18:20:46 UTC - VirusTotal detections in the stored snapshot: 18/92 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: no stored flag ## Stored infrastructure - Observed IP address: 94.154.172.92 - Registrar in stored WHOIS data: REGISTRAR_NOT_FOUND - Last stored HTTP status: 200 ## Evidence links - URLScan report: https://urlscan.io/result/01a16733-384b-75ab-8dc8-37421624c2e2/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/bikeroza.shop - Certificate Transparency search: https://crt.sh/?q=%25.bikeroza.shop - Web Archive lookup: https://web.archive.org/web/*/https://bikeroza.shop/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview PhishDestroy listed bikeroza.shop as a suspicious domain on 2026-10-23. The recorded page title reads “Sorry, the website has been stopped”, but the title date is unknown. An HTTP 200 response was observed on the same day, and Google Safe Browsing reported no threat. How the scam works The detections suggest the site may be used for phishing or other fraud, but no specific malicious behavior was observed on the page. In general, domains flagged for phishing attempt to trick users into revealing credentials or personal data by mimicking legitimate services. Without concrete evidence of a particular scheme, the risk remains classified as generic phishing/fraud potential. Evidence VirusTotal (analysis 2026-10-21, retrieved 2026-10-23) reported 18 detections across 92 engines, with 15 malicious and 3 suspicious labels. Google Safe Browsing checked on 2026-10-23 returned false. urlscan.io captured the site on 2026-10-23, marking it malicious with a score of 96, while its overall verdict was non‑malicious; the scan showed 307 redirects between HTTP and HTTPS. Cloudflare Radar (2026-10-23) marked the domain malicious under the malware category. OTX listed five pulses referencing the domain. PhishDestroy’s internal blocklist includes the domain, while external blocklists (including Spamhaus) reported no listing. Infrastructure The domain was registered with Namecheap, Inc. on 2026-04-28. It resolved to IP 94.154.172.92, which was listed as belonging to IP Vendetta Inc. (ASN 209101) and recorded in country SC. The web server runs nginx and presents a Let’s Encrypt TLS certificate valid until 2026-09-30. Open ports include 21, 22, 80 and 443, and standard DNS records (A, MX, NS, TXT) are present. What to do Visitors should avoid entering any credentials or personal information on the site; if they have already done so, change passwords and monitor accounts for suspicious activity. No wallet approvals were detected, so wallet‑related actions are not required. Defenders can block bikeroza.shop at the network perimeter and monitor outbound connections to 94.154.172.92 for any unexpected traffic. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a16733-384b-75ab-8dc8-37421624c2e2/ Cloudflare Radar report: https://radar.cloudflare.com/scan/b7682b94-ff7f-456f-9556-2df2320609a1 URLQuery report: https://urlquery.net/report/e9897394-8ace-4bb2-81a5-bb4dd38f13e8 Stored capture screenshot: https://i.ibb.co/Ld160cmq/f55bb5c7b3a6.png Cloudflare Radar screenshot (2026-10-23T05:59:51Z): https://screenshots.phishdestroy.io/cf/b7682b94-ff7f-456f-9556-2df2320609a1.png URLQuery screenshot: https://screenshots.phishdestroy.io/uq/e9897394-8ace-4bb2-81a5-bb4dd38f13e8.png VirusTotal report: https://www.virustotal.com/gui/domain/bikeroza.shop Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=bikeroza.shop Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-23 06:36:41 UTC ## Stored page captures - Primary capture: https://i.ibb.co/Ld160cmq/f55bb5c7b3a6.png Captured: 2026-10-23 05:20:47 UTC - URLScan capture: https://screenshots.phishdestroy.io/01a16733-384b-75ab-8dc8-37421624c2e2.png Captured: 2026-10-23 05:20:47 UTC Source report: https://urlscan.io/result/01a16733-384b-75ab-8dc8-37421624c2e2/ - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/b7682b94-ff7f-456f-9556-2df2320609a1.png Captured: 2026-10-23 05:59:51 UTC Source report: https://radar.cloudflare.com/scan/b7682b94-ff7f-456f-9556-2df2320609a1 SHA-256: 36d07495bcca5f3e48f8eca8aedf572633b1c8597772c12bfb5fcf7563770e66 - URLQuery: https://screenshots.phishdestroy.io/uq/e9897394-8ace-4bb2-81a5-bb4dd38f13e8.png Source report: https://urlquery.net/report/e9897394-8ace-4bb2-81a5-bb4dd38f13e8 SHA-256: 700b79ed1f685bf601be09bd31336253a5b3a482484fbb4258e2a9c830fa1255 ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-23T06:04:18Z", "uuid": "01a16733-384b-75ab-8dc8-37421624c2e2", "scanned_at": "2026-10-23T05:19:38Z", "final_url": "http://bikeroza.shop/", "status": 200, "redirects": [ { "to": "https://bikeroza.shop/", "from": "http://bikeroza.shop/", "status": 307 }, { "to": "http://bikeroza.shop/", "from": "https://bikeroza.shop/", "status": 307 } ], "ip": "94.154.172.92", "ips": [ "94.154.172.92" ], "asns": [ "209101" ], "countries": [ "BG" ], "doc_hash": "484ee30249a893f2c835f0fd812695a44d401f9ac3949f5e1cf5989233f414e9", "domain_age_days": 176, "apex_age_days": 176, "requests": 3, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 96, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "nginx", "content-type": "text/html" } }, "cf": { "v": 1, "fetched_at": "2026-10-23T06:04:19Z", "uuid": "b7682b94-ff7f-456f-9556-2df2320609a1", "scanned_at": "2026-10-23T05:59:51Z", "final_url": "https://bikeroza.shop/", "history": [ { "url": "https://bikeroza.shop/", "status": 0 } ], "domain_risks": [ "Malware", "Security threats", "CIPA Filter", "CIPA" ], "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "bikeroza.shop", "type": "A", "value": "94.154.172.92" } ], "dnssec_valid": false, "verdict": { "tags": [ "malware" ], "malicious": true, "categories": [ "malware" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-23T06:32:59Z", "analysis_at": "2026-10-21T12:04:50Z", "stats": { "timeout": 0, "harmless": 42, "malicious": 15, "suspicious": 3, "undetected": 32 }, "detections": { "DNS8": "suspicious", "ESET": "suspicious", "VIPRE": "phishing", "G-Data": "phishing", "Lionic": "phishing", "Sophos": "phishing", "CyRadar": "phishing", "Webroot": "malicious", "Fortinet": "phishing", "SOCRadar": "phishing", "Kaspersky": "phishing", "LevelBlue": "phishing", "Seclookup": "malicious", "Gridinsoft": "suspicious", "BitDefender": "phishing", "Chong Lua Dao": "malicious", "alphaMountain.ai": "phishing", "Forcepoint ThreatSeeker": "phishing" }, "reputation": 0, "categories": { "Sophos": "phishing and fraud", "Webroot": "Phishing and Other Frauds", "alphaMountain.ai": "Phishing (alphaMountain.ai)" }, "first_seen": "2026-04-29T08:16:59Z", "dns": [ { "ttl": 1800, "type": "TXT", "value": "v=spf1 include:spf.efwd.registrar-servers.com ~all" }, { "ttl": 1800, "type": "NS", "value": "dns2.registrar-servers.com" }, { "ttl": 1800, "type": "MX", "value": "eforward2.registrar-servers.com", "priority": 10 }, { "ttl": 3601, "type": "SOA", "rname": "hostmaster.registrar-servers.com", "value": "dns1.registrar-servers.com" }, { "ttl": 1800, "type": "MX", "value": "eforward5.registrar-servers.com", "priority": 20 }, { "ttl": 1800, "type": "NS", "value": "dns1.registrar-servers.com" }, { "ttl": 1800, "type": "MX", "value": "eforward3.registrar-servers.com", "priority": 10 }, { "ttl": 1800, "type": "MX", "value": "eforward1.registrar-servers.com", "priority": 10 }, { "ttl": 1800, "type": "A", "value": "94.154.172.92" }, { "ttl": 1800, "type": "MX", "value": "eforward4.registrar-servers.com", "priority": 15 } ], "dns_at": "2026-10-21T12:10:15Z", "jarm": "3fd3fd0003fd3fd00042d42d0000002059a3b916699461c5923779b77cf06b", "cert": { "san": [ "94.154.172.92" ], "issuer": "Let's Encrypt / YR2", "serial": "50a6988107e6dd2cd9d41d61bbf67350bd8", "sha256": "cf50b5651f2296293e87039f0a88b7e957b99b513fb8625daefa3b58ecf8328c", "valid_to": "2026-09-30T01:17:03Z", "valid_from": "2026-09-23T09:17:04Z" } }, "webcheck": { "v": 1, "fetched_at": "2026-10-23T06:04:38Z", "mail_config": { "mx": [ "eforward5.registrar-servers.com", "eforward1.registrar-servers.com", "eforward2.registrar-servers.com", "eforward3.registrar-servers.com", "eforward4.registrar-servers.com" ], "spf": "v=spf1 include:spf.efwd.registrar-servers.com ~all", "spf_lookups": 1 }, "caa_records": { "domain": "bikeroza.shop" }, "block_lists": { "resolvers": 12, "blocked_by": [ "CloudFlare Family" ], "blocked_count": 1 }, "archives": { "last": "2026-10-12T10:51:08Z", "first": "2026-10-12T10:51:08Z", "changes": 0, "days_archived": 1, "avg_page_bytes": 44617 }, "tls_connection": { "alpn": "h2", "cipher": "TLS_AES_256_GCM_SHA384", "protocol": "TLSv1.3", "versions": [ "TLSv1.2", "TLSv1.3" ], "authorized": false, "forward_secrecy": true }, "ports": { "open": [ 21, 22, 80, 443 ] }, "dns_server": { "ns": [ { "ip": "156.154.133.200", "host": "dns2.registrar-servers.com" }, { "ip": "156.154.132.200", "host": "dns1.registrar-servers.com" } ], "zone": "bikeroza.shop" }, "location": { "ip": "94.154.172.92", "asn": "209101", "org": "IP Vendetta Inc.", "city": "Victoria", "country": "SC" }, "ssl": { "issuer": "Let's Encrypt / YR2" }, "dns": { "A": [ "94.154.172.92" ], "MX": [ "{\"exchange\": \"eforward3.registrar-servers.com\", \"priority\": 10}", "{\"exchange\": \"eforward4.registrar-servers.com\", \"priority\": 15}", "{\"exchange\": \"eforward1.registrar-servers.com\", \"priority\": 10}", "{\"exchange\": \"eforward5.registrar-servers.com\", \"priority\": 20}", "{\"exchange\": \"eforward2.registrar-servers.com\", \"priority\": 10}" ], "NS": [ "dns2.registrar-servers.com", "dns1.registrar-servers.com" ], "SOA": "{\"nsname\": \"dns1.registrar-servers.com\", \"hostmaster\": \"hostmaster.registrar-servers.com\", \"serial\": 1777449350, \"refresh\": 43200, \"retry\": 3600, \"expire\": 604800, \"minttl\": 3601}", "TXT": [ "v=spf1 include:spf.efwd.registrar-servers.com ~all" ] }, "dnssec": { "ds": false, "rrsig": false, "dnskey": false }, "get_ip": { "ip": "94.154.172.92", "family": 4 }, "subdomains": { "count": 1, "subdomains": [ "www.bikeroza.shop" ] } } } ```