# PhishDestroy domain threat record: bitrefill.com-gift-esim-bc04.com

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/bitrefill.com-gift-esim-bc04.com/
Machine-readable companion: https://phishdestroy.io/domain/bitrefill.com-gift-esim-bc04.com/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: unknown
- First observed by PhishDestroy: 2026-10-23 18:40:03 UTC
- Stored record updated: 2026-10-23 20:00:11 UTC
- VirusTotal detections in the stored snapshot: 0/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored infrastructure

- Observed IP address: 62.60.226.39
- Registrar in stored WHOIS data: NICENIC INTERNATIONAL GROUP CO., LIMITED

## Evidence links

- URLScan report: https://urlscan.io/result/01a16a07-a3fc-75ef-8fea-205c8f8cf0b6/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/bitrefill.com-gift-esim-bc04.com
- Certificate Transparency search: https://crt.sh/?q=%25.bitrefill.com-gift-esim-bc04.com
- Web Archive lookup: https://web.archive.org/web/*/https://bitrefill.com-gift-esim-bc04.com/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
PhishDestroy listed bitrefill.com-gift-esim-bc04.com on 2026-10-23 following an admin report. The page returned HTTP 200 and displayed a FastPanel default landing page, indicating the site is not yet configured or publicly serving content. A 307 redirect from http to https was observed at the time of capture.

How the scam works
No specific malicious behavior was observed on this domain, so the listing does not point to a particular scam technique. Suspicious or newly registered domains are often used for phishing, credential harvesting, or fraudulent offers, but the current evidence does not confirm any of these mechanisms for this site.

Evidence
VirusTotal scanned the domain on 2026-10-23 with 92 engines and reported zero detections. Google Safe Browsing checked the same date and did not flag the site. urlscan.io captured the page on 2026-10-23; its machine‑learning engine assigned a high risk score (80) but the overall verdict was clean. OTX listed zero pulses as of 2026-10-23. PhishDestroy’s internal blocklist marks the domain as suspicious, while external blocklists returned no matches. The TLS certificate presented a generic "parking" issuer and subject, and the page content was limited to the FastPanel placeholder.

Infrastructure
The recorded observation showed the domain pointed to IP 62.60.226.39, which was listed under Femo IT Solutions Limited in Germany. The TLS certificate was issued on 2026-10-23 and is valid for one year. Cloudflare name servers (martin.ns.cloudflare.com, sunny.ns.cloudflare.com) are listed, and the domain age recorded as zero days at the time of observation.

What to do
Do not enter any credentials, payment information, or personal data on this site. If you have already submitted such data, change associated passwords and monitor accounts for unauthorized activity. Network defenders should add the domain to threat‑monitoring rules and review logs for any prior connections.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a16a07-a3fc-75ef-8fea-205c8f8cf0b6/
Cloudflare Radar report: https://radar.cloudflare.com/scan/ee625d75-4809-402c-9482-c69f0180b19e
Stored capture screenshot: https://urlscan.io/screenshots/01a16a07-a3fc-75ef-8fea-205c8f8cf0b6.png
Cloudflare Radar screenshot (2026-10-23T18:41:35Z): https://screenshots.phishdestroy.io/cf/ee625d75-4809-402c-9482-c69f0180b19e.png
VirusTotal report: https://www.virustotal.com/gui/domain/bitrefill.com-gift-esim-bc04.com
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=bitrefill.com-gift-esim-bc04.com
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-23 19:13:14 UTC

## Stored page captures

- Primary capture: https://urlscan.io/screenshots/01a16a07-a3fc-75ef-8fea-205c8f8cf0b6.png
  Captured: 2026-10-23 18:40:03 UTC
- URLScan capture: https://screenshots.phishdestroy.io/01a16a07-a3fc-75ef-8fea-205c8f8cf0b6.png
  Source report: https://urlscan.io/result/01a16a07-a3fc-75ef-8fea-205c8f8cf0b6/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/ee625d75-4809-402c-9482-c69f0180b19e.png
  Captured: 2026-10-23 18:41:35 UTC
  Source report: https://radar.cloudflare.com/scan/ee625d75-4809-402c-9482-c69f0180b19e
  SHA-256: a5db7ab655d3900bfb2bf44f8483ca7ce06fc6f795376f14b777be50f1f0af62

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-23T18:42:33Z",
        "uuid": "01a16a07-a3fc-75ef-8fea-205c8f8cf0b6",
        "scanned_at": "2026-10-23T18:30:53Z",
        "final_url": "https://bitrefill.com-gift-esim-bc04.com/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://bitrefill.com-gift-esim-bc04.com/",
                "from": "http://bitrefill.com-gift-esim-bc04.com/",
                "status": 307
            }
        ],
        "ip": "62.60.226.39",
        "domains": [
            "fonts.gstatic.com",
            "fonts.googleapis.com"
        ],
        "ips": [
            "142.251.20.94",
            "142.251.14.95",
            "62.60.226.39"
        ],
        "asns": [
            "15169",
            "214351"
        ],
        "countries": [
            "US",
            "DE"
        ],
        "link_domains": [
            "kb.fastpanel.direct"
        ],
        "doc_hash": "825eb1a627f34c3d1fad85cb5904b5ac0fded65f677c5a85fa992e42c450fd99",
        "tls": {
            "cipher": "AES_256_GCM",
            "issuer": "parking",
            "subject": "parking",
            "protocol": "TLS 1.3",
            "valid_to": "2027-09-24T08:51:35Z",
            "valid_from": "2026-09-24T08:51:35Z"
        },
        "domain_age_days": 0,
        "apex_age_days": 0,
        "tls_age_days": 29,
        "tls_valid_days": 365,
        "requests": 7,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 80,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "nginx/1.30.5",
            "content-type": "text/html"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-23T18:42:35Z",
        "uuid": "ee625d75-4809-402c-9482-c69f0180b19e",
        "scanned_at": "2026-10-23T18:41:35Z",
        "final_url": "https://bitrefill.com-gift-esim-bc04.com/",
        "history": [
            {
                "url": "https://bitrefill.com-gift-esim-bc04.com/",
                "status": 0
            }
        ],
        "dom_hash": "0be15d34945b061b4688e4c7a258d982bf21eeec94f047738c21f26a19145958",
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "bitrefill.com-gift-esim-bc04.com",
                "type": "A",
                "value": "62.60.226.39"
            }
        ],
        "dnssec_valid": false,
        "whois": {
            "registrar": "NICENIC INTERNATIONAL GROUP CO., LIMITED",
            "created": "2026-10-23T14:46:52Z",
            "updated": "2026-10-23T14:46:52Z",
            "expires": "2027-10-23T14:46:52Z",
            "nameservers": [
                "martin.ns.cloudflare.com",
                "sunny.ns.cloudflare.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-23T19:12:49Z",
        "analysis_at": "2026-10-23T14:51:38Z",
        "stats": {
            "timeout": 0,
            "harmless": 53,
            "malicious": 0,
            "suspicious": 0,
            "undetected": 39
        },
        "reputation": 0,
        "tags": [
            "dga"
        ],
        "registrar": "NICENIC INTERNATIONAL GROUP CO., LIMITED",
        "created": "2026-10-23T14:46:52Z",
        "expires": "2027-10-23T14:46:52Z",
        "updated": "2026-10-23T14:46:52Z",
        "first_seen": "2026-10-23T14:51:58Z",
        "dns": [
            {
                "ttl": 3600,
                "type": "A",
                "value": "62.60.226.39"
            }
        ],
        "dns_at": "2026-10-23T14:51:58Z",
        "jarm": "2ad2ad0002ad2ad00042d42d00000000f78d2dc0ce6e5bbc5b8149a4872356",
        "cert": {
            "san": [
                "bitrefill.com-gift-esim-bc04.com",
                "www.bitrefill.com-gift-esim-bc04.com"
            ],
            "issuer": "Let's Encrypt / YR2",
            "serial": "6a0f6a6cbdacc5b548a6bc196666bb7b9cf",
            "sha256": "aa3911e61218b0d8c11667de0816d33492be39efe0ed75e4801806d178badd8b",
            "subject": "bitrefill.com-gift-esim-bc04.com",
            "valid_to": "2027-01-21T13:49:00Z",
            "valid_from": "2026-10-23T13:49:01Z"
        },
        "whois": {
            "registrar": "NICENIC INTERNATIONAL GROUP CO., LIMITED",
            "registrar_iana_id": "3765",
            "registrar_url": "https://nicenic.com",
            "created": "2026-10-23T14:46:52Z",
            "updated": "2026-10-23T14:46:52Z",
            "expires": "2027-10-23T14:46:52Z",
            "status": [
                "clientDeleteProhibited",
                "clientTransferProhibited"
            ],
            "nameservers": [
                "martin.ns.cloudflare.com",
                "sunny.ns.cloudflare.com"
            ],
            "dnssec": "unsigned"
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-23T18:42:55Z",
        "caa_records": {
            "domain": "bitrefill.com-gift-esim-bc04.com"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_count": 0
        },
        "archives": {
            "last": "2026-10-23T18:41:03Z",
            "first": "2026-10-23T18:41:03Z",
            "changes": 0,
            "days_archived": 1,
            "avg_page_bytes": 3715
        },
        "trackers": {
            "requests": 3,
            "trackers": [
                {
                    "name": "Google Fonts",
                    "company": "Google",
                    "country": "US",
                    "category": "Hosting",
                    "requests": 1
                },
                {
                    "name": "Google Static",
                    "company": "Google",
                    "country": "US",
                    "category": "Hosting",
                    "requests": 1
                }
            ]
        },
        "tls_connection": {
            "alpn": "http/1.1",
            "cipher": "TLS_AES_256_GCM_SHA384",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": false,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                21,
                22,
                25,
                80,
                110,
                143,
                443,
                587,
                993,
                995,
                8888
            ]
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "162.159.38.166",
                    "host": "sunny.ns.cloudflare.com"
                },
                {
                    "ip": "172.64.35.87",
                    "host": "martin.ns.cloudflare.com"
                }
            ],
            "zone": "com-gift-esim-bc04.com"
        },
        "location": {
            "ip": "62.60.226.39",
            "asn": "214351",
            "org": "Femo IT Solutions Limited",
            "city": "Frankfurt am Main",
            "country": "DE"
        },
        "ssl": {
            "issuer": "FASTPANEL / parking",
            "subject": "parking"
        },
        "dns": {
            "A": [
                "62.60.226.39"
            ]
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "get_ip": {
            "ip": "62.60.226.39",
            "family": 4
        },
        "whois": {
            "registrar": "NICENIC INTERNATIONAL GROUP CO., LIMITED",
            "created": "2026-10-23T14:46:52Z",
            "updated": "2026-10-23T14:46:52Z",
            "expires": "2027-10-23T14:46:52Z",
            "status": [
                "clientDeleteProhibited https://icann.org/epp",
                "clientTransferProhibited https://icann.org/epp"
            ],
            "nameservers": [
                "martin.ns.cloudflare.com",
                "sunny.ns.cloudflare.com"
            ]
        }
    }
}
```