# PhishDestroy domain threat record: bizuu-pl.shop

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/bizuu-pl.shop/
Machine-readable companion: https://phishdestroy.io/domain/bizuu-pl.shop/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-23 08:31:01 UTC
- Last availability or vendor check: 2026-10-23 10:00:23 UTC
- Stored record updated: 2026-10-23 10:51:50 UTC
- VirusTotal detections in the stored snapshot: 16/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored infrastructure

- Observed IP address: 34.120.77.6
- Registrar in stored WHOIS data: PDR Ltd. d/b/a PublicDomainRegistry.com
- Last stored HTTP status: 200
- Registration date in stored WHOIS data: 2026-04-08 02:12:11 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/019fe881-8937-70fc-b093-f0b2e09282de/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/bizuu-pl.shop
- Certificate Transparency search: https://crt.sh/?q=%25.bizuu-pl.shop
- Web Archive lookup: https://web.archive.org/web/*/https://bizuu-pl.shop/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
PhishDestroy added bizuu-pl.shop to its internal blocklist on 2026-10-23 after an intake check highlighted 12 malicious detections on VirusTotal. The domain returned HTTP 200 on the same date with no cross‑site redirect. An earlier urlscan capture from 2026-08-09 classified the site as a malicious phishing “Fake Shop”.

How the scam works
The detections suggest a typical fake‑shop phishing pattern, where a counterfeit storefront is used to trick visitors into submitting login credentials, personal data, or payment information. Such pages rely on the appearance of a legitimate e‑commerce site to harvest user data, but no specific wallet‑draining or credential‑harvesting behavior was observed on this page.

Evidence
VirusTotal reported 12 malicious and 4 suspicious vendor classifications out of 92 engines on 2026-10-22 (retrieved 2026-10-23). Google Safe Browsing did not flag the domain on 2026-10-23. urlscan.io’s analysis on 2026-08-09 gave a malicious verdict with a score of 100, categorising it as phishing and labeling the brand as “Fake Shop”. OTX listed one pulse referencing the domain on 2026-10-23. PhishDestroy’s internal blocklist marks the domain as malicious, while external blocklists returned zero hits, except a single Cloudflare Family block entry.

Infrastructure
The recorded IP was 34.120.77.6 and the hosting organization was identified as Google LLC in the United States. TLS was provided by Let’s Encrypt, valid from 2026-08-24 to 2026-11-22. The domain was 173 days old at the time of observation and used orderbox‑dns nameservers. The web server header reported Cloudflare.

What to do
Avoid entering any credentials, payment details, or personal information on the site. If you have already submitted data, change associated passwords and monitor accounts for unauthorized activity. Network defenders should block bizuu-pl.shop and add the domain to threat‑intel feeds, and review logs for any connections to the recorded host.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/019fe881-8937-70fc-b093-f0b2e09282de/
Cloudflare Radar report: https://radar.cloudflare.com/scan/7874f842-9a63-45db-b3b0-3247b97d562c
Stored capture screenshot: https://urlscan.io/screenshots/019fe881-8937-70fc-b093-f0b2e09282de.png
VirusTotal report: https://www.virustotal.com/gui/domain/bizuu-pl.shop
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=bizuu-pl.shop
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-23 08:34:18 UTC

## Stored page captures

- Primary capture: https://urlscan.io/screenshots/019fe881-8937-70fc-b093-f0b2e09282de.png
  Captured: 2026-10-23 08:31:01 UTC
- URLScan capture: https://screenshots.phishdestroy.io/019fe881-8937-70fc-b093-f0b2e09282de.png
  Source report: https://urlscan.io/result/019fe881-8937-70fc-b093-f0b2e09282de/
- URLScan · 2026-10-23: https://screenshots.phishdestroy.io/us/01a167e9-f7ba-724c-bc14-6438b95e5b8d.png
  Captured: 2026-10-23 08:39:17 UTC
  Source report: https://urlscan.io/result/01a167e9-f7ba-724c-bc14-6438b95e5b8d/
  SHA-256: 5a9d7a61054c24cc6e2a7b6f6d929bb7c9fcf9e217527ba70bc85bf698c9093b

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-23T08:33:20Z",
        "uuid": "019fe881-8937-70fc-b093-f0b2e09282de",
        "scanned_at": "2026-08-09T21:50:38Z",
        "final_url": "https://bizuu-pl.shop/",
        "status": 200,
        "ip": "104.18.5.221",
        "domains": [
            "fonts.gstatic.com",
            "connect.facebook.net",
            "www.facebook.com",
            "sl-11a463aaedf44600a99367660fd6fa70.ecs.us-east-1.on.aws"
        ],
        "ips": [
            "57.144.244.1",
            "34.205.237.113",
            "142.251.20.94",
            "157.240.253.1",
            "104.18.5.221"
        ],
        "asns": [
            "32934",
            "14618",
            "15169",
            "13335"
        ],
        "countries": [
            "DE",
            "US"
        ],
        "doc_hash": "39c30c6c95709662992a885d11f0882d6f643703441b9a57aa81d773c9887c5f",
        "script_hashes": [
            "72faf5fb8c6deb840471b51a9e12c15947e91edc106846787b1692d62ef8e91b",
            "f1de2fa4c63e78d6c450fe232e2ffff4afe160dc1894069cd0bb8c75607e81de"
        ],
        "globals": [
            "_bizuuplshop_",
            "_BZFZZBD_",
            "themeConfig",
            "shop_theme",
            "storeConfig",
            "shop_config",
            "lang",
            "shop_lang",
            "C_SETTINGS",
            "_GET_C_SETTING_",
            "oemcart_client_browser",
            "oemcart_current_template",
            "oemcart_store_id",
            "oemcart_time_zone",
            "oemcart_page_ca",
            "oemcart_pv_id",
            "oemcart_data_from",
            "oemcart_user",
            "oemcart_currency",
            "oemcart_currency_code",
            "oemcart_base_currency",
            "oemcart_base_currency_code",
            "oemcart_website_domain",
            "oemcart_real_domain",
            "oemcart_client_country",
            "oemcart_protocal_type",
            "oemcart_website_language",
            "oemcart_utm_source",
            "oemcart_utm_medium",
            "oemcart_global_unique_id",
            "oemcart_global_session_unique_id",
            "oemcart_countrys",
            "oemcart_cart_number",
            "oemcart_current_domain",
            "oemcart_imgcdn",
            "oemcart_current_router",
            "oemcart_templateRoute",
            "oemcart_current_theme_title",
            "oemcart_current_theme_id",
            "oemcart_current_theme_name"
        ],
        "cookies": [
            "_bahdgh_vid",
            "_bahdgh_cvid",
            "_bahdgh_vs",
            "PHPSESSID",
            "__cf_bm",
            "_BZFZZBD_ua",
            "_BZFZZBD_pu",
            "_BZFZZBD_tz",
            "_BZFZZBD_ss",
            "_BZFZZBD_lang",
            "_BZFZZBD_vs",
            "_BZFZZBD_dt",
            "_fbp"
        ],
        "storage_keys": [
            "lastExternalReferrer",
            "lastExternalReferrerTime"
        ],
        "tls": {
            "san": [
                "bizuu-pl.shop"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "WE1",
            "subject": "bizuu-pl.shop",
            "protocol": "TLS 1.3",
            "valid_to": "2026-10-23T09:53:45Z",
            "valid_from": "2026-07-25T08:53:50Z"
        },
        "domain_age_days": 173,
        "apex_age_days": 173,
        "tls_age_days": 15,
        "tls_valid_days": 90,
        "requests": 15,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 99,
                "malicious": true
            },
            "overall": {
                "tags": [
                    "phishing"
                ],
                "score": 100,
                "brands": [
                    "fakeshop"
                ],
                "malicious": true,
                "categories": [
                    "phishing"
                ]
            },
            "urlscan": {
                "tags": [
                    "phishing"
                ],
                "score": 100,
                "brands": [
                    "Fake Shop"
                ],
                "malicious": true,
                "categories": [
                    "phishing"
                ]
            }
        },
        "headers": {
            "server": "cloudflare",
            "content-type": "text/html; charset=utf-8"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-23T08:33:22Z",
        "uuid": "7874f842-9a63-45db-b3b0-3247b97d562c",
        "scanned_at": "2026-10-23T08:32:01Z"
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-23T08:31:36Z",
        "analysis_at": "2026-10-22T12:13:30Z",
        "stats": {
            "timeout": 0,
            "harmless": 45,
            "malicious": 12,
            "suspicious": 4,
            "undetected": 31
        },
        "detections": {
            "DNS8": "suspicious",
            "ESET": "suspicious",
            "VIPRE": "malware",
            "G-Data": "phishing",
            "Lionic": "phishing",
            "Sophos": "phishing",
            "CyRadar": "phishing",
            "Webroot": "malicious",
            "Fortinet": "spam",
            "SOCRadar": "phishing",
            "Kaspersky": "phishing",
            "Seclookup": "malicious",
            "Gridinsoft": "suspicious",
            "BitDefender": "phishing",
            "alphaMountain.ai": "phishing",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "tags": [
            "dga"
        ],
        "first_seen": "2026-04-08T04:41:49Z",
        "dns": [
            {
                "ttl": 21600,
                "type": "NS",
                "value": "manvc.earth.orderbox-dns.com"
            },
            {
                "ttl": 14400,
                "type": "A",
                "value": "34.120.77.6"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "manvc.venus.orderbox-dns.com"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "manvc.mercury.orderbox-dns.com"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "manvc.mars.orderbox-dns.com"
            },
            {
                "ttl": 7200,
                "type": "SOA",
                "rname": "3458862.qq.com",
                "value": "manvc.earth.orderbox-dns.com"
            }
        ],
        "dns_at": "2026-10-22T12:18:52Z",
        "jarm": "29d3fd00029d29d00042d43d00041d6f940079659edb62e1c38c38bd26ee84",
        "cert": {
            "san": [
                "bizuu-pl.shop"
            ],
            "issuer": "Let's Encrypt / YR1",
            "serial": "5236b21b27e3c0ae0bea55d04bde1926ede",
            "sha256": "9875a4fd098ff412fe7a390ee1fd86b9faa9d7a1597a24ea0f4e4287cece92e7",
            "subject": "bizuu-pl.shop",
            "valid_to": "2026-11-22T14:02:04Z",
            "valid_from": "2026-08-24T14:02:05Z"
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-23T08:33:43Z",
        "mail_config": {
            "spf_lookups": 0
        },
        "caa_records": {
            "domain": "bizuu-pl.shop"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_by": [
                "CloudFlare Family"
            ],
            "blocked_count": 1
        },
        "ports": {
            "open": [
                80,
                443
            ]
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "162.251.82.246",
                    "host": "manvc.earth.orderbox-dns.com"
                },
                {
                    "ip": "162.251.82.253",
                    "host": "manvc.mars.orderbox-dns.com"
                },
                {
                    "ip": "162.251.82.121",
                    "host": "manvc.venus.orderbox-dns.com"
                },
                {
                    "ip": "162.251.82.251",
                    "host": "manvc.mercury.orderbox-dns.com"
                }
            ],
            "zone": "bizuu-pl.shop"
        },
        "location": {
            "ip": "34.120.77.6",
            "asn": "396982",
            "org": "Google LLC",
            "city": "Kansas City",
            "country": "US"
        },
        "dns": {
            "A": [
                "34.120.77.6"
            ],
            "NS": [
                "manvc.venus.orderbox-dns.com",
                "manvc.mars.orderbox-dns.com",
                "manvc.earth.orderbox-dns.com",
                "manvc.mercury.orderbox-dns.com"
            ],
            "SOA": "{\"nsname\": \"manvc.earth.orderbox-dns.com\", \"hostmaster\": \"3458862.qq.com\", \"serial\": 2026082402, \"refresh\": 7200, \"retry\": 7200, \"expire\": 172800, \"minttl\": 38400}"
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "get_ip": {
            "ip": "34.120.77.6",
            "family": 4
        },
        "subdomains": {
            "count": 1,
            "subdomains": [
                "www.bizuu-pl.shop"
            ]
        }
    }
}
```