# PhishDestroy domain threat record: boch-saletop.shop Content language: English Canonical HTML report: https://phishdestroy.io/domain/boch-saletop.shop/ Machine-readable companion: https://phishdestroy.io/domain/boch-saletop.shop/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-10-23 08:32:53 UTC - Last availability or vendor check: 2026-10-23 11:24:23 UTC - Stored record updated: 2026-10-23 11:24:23 UTC - VirusTotal detections in the stored snapshot: 21/92 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: flagged ## Stored infrastructure - Observed IP address: 104.18.3.225 - Registrar in stored WHOIS data: PDR Ltd. d/b/a PublicDomainRegistry.com - Last stored HTTP status: 200 - Registration date in stored WHOIS data: 2026-09-14 12:30:38 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a167f7-3255-775b-b16f-ea8966ee5652/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/boch-saletop.shop - Certificate Transparency search: https://crt.sh/?q=%25.boch-saletop.shop - Web Archive lookup: https://web.archive.org/web/*/https://boch-saletop.shop/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview PhishDestroy listed boch-saletop.shop on its blocklist on 2026-10-23 after the domain was flagged for social‑engineering by Google Safe Browsing. A page fetch on 2026-10-23 returned HTTP 403 and a title of “500 Internal Server Error,” indicating the site did not serve content at that moment. An earlier urlscan capture taken on 2026-09-19 showed the domain responding with HTTP 200 and a malicious phishing verdict. How the scam works The detections place the site in the phishing/social‑engineering category, where attackers typically mimic legitimate services to trick users into revealing credentials or personal data. No credential‑stealing form or wallet request was observed in the captured page, so the exact method used by this domain cannot be confirmed. Evidence VirusTotal recorded 21 detections from 92 scanners on 2026-10-23, including 16 malicious and 5 suspicious labels from vendors such as BitDefender, ESET and Forcepoint ThreatSeeker. Google Safe Browsing flagged the domain for social‑engineering on 2026-10-23. urlscan’s automated analysis on 2026-09-19 gave a 100‑score malicious phishing verdict, and OTX listed one pulse referencing the domain on 2026-10-23; PhishDestroy’s internal list also marked it as blocked, while external public blocklists returned zero matches on the same day. Infrastructure The domain was registered four days before first observation and uses a TLS certificate issued by Google Trust Services, valid from 2026-09-14 to 2026-12-13. Hosting is provided through Cloudflare, resolving to the recorded IP 104.18.3.225 located in Canada. Authoritative nameservers are manvc.mars.orderbox-dns.com, manvc.earth.orderbox-dns.com, manvc.mercury.orderbox-dns.com and manvc.venus.orderbox-dns.com, and DNSSEC is not enabled. What to do Visitors should avoid entering any login credentials, payment information or personal data on the site and, if they have already done so, change affected passwords and monitor accounts for suspicious activity. Organizations should block network traffic to boch-saletop.shop and review logs for any prior connections to the recorded IP or domain. Security teams can create detection rules using the domain name, its TLS certificate details and the listed nameservers without assuming broader infrastructure involvement. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a0b905-dc77-76c1-8855-9db3c6ae9ff0/ Cloudflare Radar report: https://radar.cloudflare.com/scan/6819efc9-cc87-4a4f-bffa-97789cead18f Stored capture screenshot: https://urlscan.io/screenshots/01a0b905-dc77-76c1-8855-9db3c6ae9ff0.png Cloudflare Radar screenshot (2026-10-23T08:39:29Z): https://screenshots.phishdestroy.io/cf/6819efc9-cc87-4a4f-bffa-97789cead18f.png URLScan screenshot (2026-09-18T03:00:30Z): https://screenshots.phishdestroy.io/us/01a0b275-3fbe-7517-b22a-62c4f52433da.png URLScan capture report: https://urlscan.io/result/01a0b275-3fbe-7517-b22a-62c4f52433da/ URLScan screenshot (2026-09-18T09:52:28Z): https://screenshots.phishdestroy.io/us/01a0b3ee-6f86-70da-a33f-f2d87ff3db13.png URLScan capture report: https://urlscan.io/result/01a0b3ee-6f86-70da-a33f-f2d87ff3db13/ VirusTotal report: https://www.virustotal.com/gui/domain/boch-saletop.shop Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=boch-saletop.shop Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-23 08:42:33 UTC ## Stored page captures - Primary capture: https://i.ibb.co/5XNqq1bZ/7be968f4b2a9.png Captured: 2026-10-23 08:55:08 UTC - URLScan capture 1: https://urlscan.io/screenshots/01a167f7-3255-775b-b16f-ea8966ee5652.png Captured: 2026-10-23 08:55:08 UTC Source report: https://urlscan.io/result/01a167f7-3255-775b-b16f-ea8966ee5652/ - URLScan capture 2: https://screenshots.phishdestroy.io/01a0b905-dc77-76c1-8855-9db3c6ae9ff0.png Captured: 2026-10-23 08:32:53 UTC Source report: https://urlscan.io/result/01a167f7-3255-775b-b16f-ea8966ee5652/ - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/6819efc9-cc87-4a4f-bffa-97789cead18f.png Captured: 2026-10-23 08:39:29 UTC Source report: https://radar.cloudflare.com/scan/6819efc9-cc87-4a4f-bffa-97789cead18f SHA-256: 606f141ab46abfef2fa1365e59f9de8ffc9d856293512bdf490619b1c7dfb5fe - URLScan · 2026-09-18: https://screenshots.phishdestroy.io/us/01a0b275-3fbe-7517-b22a-62c4f52433da.png Captured: 2026-09-18 03:00:30 UTC Source report: https://urlscan.io/result/01a0b275-3fbe-7517-b22a-62c4f52433da/ SHA-256: f98f6407bcc29292846b94a5988659e60e3b2d5d5339772d4c82f8faa5909132 - URLScan · 2026-09-18: https://screenshots.phishdestroy.io/us/01a0b3ee-6f86-70da-a33f-f2d87ff3db13.png Captured: 2026-09-18 09:52:28 UTC Source report: https://urlscan.io/result/01a0b3ee-6f86-70da-a33f-f2d87ff3db13/ SHA-256: f98f6407bcc29292846b94a5988659e60e3b2d5d5339772d4c82f8faa5909132 ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-23T09:33:07Z", "uuid": "01a167f7-3255-775b-b16f-ea8966ee5652", "scanned_at": "2026-10-23T08:53:42Z", "final_url": "https://boch-saletop.shop/", "status": 200, "redirected": "https-only", "redirects": [ { "to": "https://boch-saletop.shop/", "from": "http://boch-saletop.shop/", "status": 307 } ], "ip": "104.18.3.225", "domains": [ "fonts.gstatic.com" ], "ips": [ "142.251.211.67", "104.18.3.225" ], "asns": [ "15169", "13335" ], "countries": [ "US" ], "doc_hash": "9631984743ef8e3fb27abe10e62823376d30b2c2eac1b0d33dea53d783dc7053", "script_hashes": [ "1d53860f359b86b64f2ab580d77c99934434f263f2f28c1309ba071073ae1c33" ], "globals": [ "_bochsaletopshop_", "_BBCFZCE_", "themeConfig", "shop_theme", "storeConfig", "shop_config", "lang", "shop_lang", "C_SETTINGS", "_GET_C_SETTING_", "oemcart_client_browser", "oemcart_current_template", "oemcart_store_id", "oemcart_user_id", "oemcart_time_zone", "oemcart_page_ca", "oemcart_user_email", "oemcart_pv_id", "oemcart_data_from", "oemcart_user", "oemcart_currency", "oemcart_currency_code", "oemcart_currency_rate", "oemcart_currency_lcoin", "oemcart_currency_rcoin", "oemcart_currency_decimal", "oemcart_base_currency", "oemcart_base_currency_code", "oemcart_base_currency_rate", "oemcart_base_currency_lcoin", "oemcart_base_currency_rcoin", "oemcart_base_currency_decimal", "oemcart_website_domain", "oemcart_real_domain", "oemcart_site_type", "oemcart_client_country", "oemcart_protocal_type", "oemcart_website_language", "oemcart_utm_source", "oemcart_utm_medium" ], "cookies": [ "_bbdhdf_vid", "_bbdhdf_cvid", "_bbdhdf_vs", "utm_source", "utm_medium", "order_utm_history", "landing_page", "_bbdhdf_ka", "first_http_referer", "first_visit_time", "PHPSESSID", "__cf_bm" ], "tls": { "san": [ "boch-saletop.shop" ], "cipher": "AES_128_GCM", "issuer": "WE1", "subject": "boch-saletop.shop", "protocol": "TLS 1.3", "valid_to": "2026-12-13T15:08:47Z", "valid_from": "2026-09-14T14:08:51Z" }, "domain_age_days": 38, "apex_age_days": 38, "tls_age_days": 38, "tls_valid_days": 90, "requests": 6, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 99, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "cloudflare", "content-type": "text/html; charset=utf-8" } }, "cf": { "v": 1, "fetched_at": "2026-10-23T08:41:39Z", "uuid": "6819efc9-cc87-4a4f-bffa-97789cead18f", "scanned_at": "2026-10-23T08:39:29Z", "final_url": "https://boch-saletop.shop/", "status": 200, "history": [ { "url": "https://boch-saletop.shop/", "status": 200 } ], "dom_hash": "c2bef41e4b79f40ddbd1dd3c126b116b4d6fc79f58e379fa050a74328b92ab18", "doc_hash": "67aab17ff9ea39a7c0e3ffe67b61312dbf087d0c5d45af0cdfe6857c823113f6", "phishing_v2": [ "phishing" ], "domain_risks": [ "Malware", "Security threats", "CIPA Filter", "CIPA" ], "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "boch-saletop.shop", "type": "A", "value": "104.18.3.225" } ], "dnssec_valid": false, "ip": "104.18.3.225", "verdict": { "tags": [ "malware" ], "malicious": true, "categories": [ "malware" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-23T08:38:45Z", "analysis_at": "2026-10-22T00:12:38Z", "stats": { "timeout": 0, "harmless": 40, "malicious": 16, "suspicious": 5, "undetected": 31 }, "detections": { "CRDF": "malicious", "DNS8": "suspicious", "ESET": "suspicious", "VIPRE": "phishing", "G-Data": "phishing", "Lionic": "phishing", "Sophos": "phishing", "CyRadar": "phishing", "Fortinet": "phishing", "Netcraft": "malicious", "PREBYTES": "suspicious", "SOCRadar": "phishing", "Kaspersky": "phishing", "LevelBlue": "suspicious", "Seclookup": "malicious", "Gridinsoft": "suspicious", "BitDefender": "phishing", "Chong Lua Dao": "malicious", "alphaMountain.ai": "phishing", "Google Safe Browsing": "phishing", "Forcepoint ThreatSeeker": "phishing" }, "reputation": 0, "categories": { "Sophos": "phishing and fraud", "PREBYTES": "fraud", "alphaMountain.ai": "Phishing (alphaMountain.ai)", "Forcepoint ThreatSeeker": "phishing and other frauds" }, "first_seen": "2026-09-14T15:13:53Z", "dns": [ { "ttl": 14400, "type": "A", "value": "104.18.3.225" }, { "ttl": 21600, "type": "NS", "value": "manvc.mars.orderbox-dns.com" }, { "ttl": 21600, "type": "NS", "value": "manvc.earth.orderbox-dns.com" }, { "ttl": 21600, "type": "NS", "value": "manvc.mercury.orderbox-dns.com" }, { "ttl": 7200, "type": "SOA", "rname": "3458862.qq.com", "value": "manvc.earth.orderbox-dns.com" }, { "ttl": 21600, "type": "NS", "value": "manvc.venus.orderbox-dns.com" } ], "dns_at": "2026-10-22T00:13:00Z", "jarm": "27d40d40d00040d00042d43d00041df04c41293ba84f6efe3a613b22f983e6", "cert": { "san": [ "boch-saletop.shop" ], "issuer": "Google Trust Services / WE1", "serial": "dc233cbc17dc2af71385c9ff0afa2e67", "sha256": "7b8e59f525016c54d80fbd5a0eefb97c77feeba328a8b7728e212e12e6334f41", "subject": "boch-saletop.shop", "valid_to": "2026-12-13T15:08:47Z", "valid_from": "2026-09-14T14:08:51Z" } }, "webcheck": { "v": 1, "fetched_at": "2026-10-23T08:42:02Z", "mail_config": { "spf_lookups": 0 }, "caa_records": { "domain": "boch-saletop.shop" }, "block_lists": { "resolvers": 12, "blocked_by": [ "CloudFlare Family" ], "blocked_count": 1 }, "archives": { "last": "2026-10-23T08:35:30Z", "first": "2026-09-14T17:40:07Z", "changes": 2, "days_archived": 3, "scans_per_day": 0.05, "avg_page_bytes": 45782 }, "social_tags": { "title": "500 Internal Server Error", "robots": "noindex, nofollow" }, "trackers": { "requests": 42, "trackers": [ { "name": "Facebook", "company": "Meta", "country": "US", "category": "Advertising", "requests": 3 }, { "name": "Facebook Custom Audience", "company": "Meta", "country": "US", "category": "Advertising", "requests": 1 }, { "name": "Google Translate", "company": "Google", "country": "US", "category": "Customer Interaction", "requests": 1 }, { "name": "Google APIs", "company": "Google", "country": "US", "category": "Hosting", "requests": 1 }, { "name": "Google Static", "company": "Google", "country": "US", "category": "Hosting", "requests": 4 }, { "name": "Facebook Connect", "company": "Meta", "country": "US", "category": "Site Analytics", "requests": 2 }, { "name": "TikTok Analytics", "company": "ByteDance Inc", "country": "KY", "category": "Site Analytics", "requests": 1 } ] }, "mixed_content": { "third_party_scripts": 0 }, "status": { "up": true, "code": 200, "timings": { "dns": 429, "tls": 27, "wait": 212, "connect": 8, "download": 1 }, "response_ms": 677 }, "tls_connection": { "alpn": "h2", "cipher": "TLS_AES_256_GCM_SHA384", "protocol": "TLSv1.3", "versions": [ "TLSv1.2", "TLSv1.3" ], "authorized": true, "forward_secrecy": true }, "ports": { "open": [ 80, 443, 8080 ] }, "carbon": { "bytes": 219, "co2_grams": 0, "cleaner_than": 95 }, "dns_server": { "ns": [ { "ip": "162.251.82.252", "host": "manvc.mars.orderbox-dns.com" }, { "ip": "162.251.82.247", "host": "manvc.earth.orderbox-dns.com" }, { "ip": "162.251.82.249", "host": "manvc.venus.orderbox-dns.com" }, { "ip": "162.251.82.250", "host": "manvc.mercury.orderbox-dns.com" } ], "zone": "boch-saletop.shop" }, "cookies": { "cookies": [ { "name": "_fbp", "same_site": "Lax" }, { "name": "_bbdhdf_vid" }, { "name": "_bbdhdf_cvid" }, { "name": "_bbdhdf_vs" }, { "name": "utm_source" }, { "name": "utm_medium" }, { "name": "order_utm_history" }, { "name": "landing_page" }, { "name": "_bbdhdf_ka" }, { "name": "first_http_referer" }, { "name": "first_visit_time" }, { "name": "PHPSESSID", "session": true }, { "name": "__cf_bm", "secure": true, "http_only": true, "same_site": "None" }, { "name": "_BBCFZCE_ua", "secure": true, "same_site": "None" }, { "name": "_BBCFZCE_pu", "secure": true, "same_site": "None" }, { "name": "_BBCFZCE_tz", "secure": true, "same_site": "None" }, { "name": "_BBCFZCE_ss", "secure": true, "same_site": "None" }, { "name": "_BBCFZCE_lang", "secure": true, "same_site": "None" }, { "name": "_BBCFZCE_vs", "secure": true, "same_site": "None" }, { "name": "_BBCFZCE_dt", "secure": true, "same_site": "None" } ] }, "location": { "ip": "104.18.3.225", "asn": "13335", "org": "Cloudflare, Inc.", "city": "Toronto", "country": "CA" }, "ssl": { "issuer": "Google Trust Services / WE1", "subject": "boch-saletop.shop" }, "dns": { "A": [ "104.18.3.225" ], "NS": [ "manvc.venus.orderbox-dns.com", "manvc.mars.orderbox-dns.com", "manvc.mercury.orderbox-dns.com", "manvc.earth.orderbox-dns.com" ], "SOA": "{\"nsname\": \"manvc.earth.orderbox-dns.com\", \"hostmaster\": \"3458862.qq.com\", \"serial\": 2026091403, \"refresh\": 7200, \"retry\": 7200, \"expire\": 172800, \"minttl\": 38400}" }, "dnssec": { "ds": false, "rrsig": false, "dnskey": false }, "hsts": { "message": "Site does not serve any HSTS headers." }, "http_security": { "xFrameOptions": false, "referrerPolicy": false, "xXSSProtection": false, "permissionsPolicy": false, "xContentTypeOptions": false, "contentSecurityPolicy": false, "strictTransportPolicy": false, "crossOriginOpenerPolicy": false, "crossOriginEmbedderPolicy": false, "crossOriginResourcePolicy": false }, "firewall": { "waf": "Cloudflare", "has_waf": true }, "get_ip": { "ip": "104.18.3.225", "family": 4 }, "redirects": { "chain": [ "https://boch-saletop.shop" ] }, "headers": { "headers": { "server": "cloudflare", "content-type": "text/html; charset=utf-8" } } } } ```