# PhishDestroy domain threat record: bolsdirect.shop Content language: English Canonical HTML report: https://phishdestroy.io/domain/bolsdirect.shop/ Machine-readable companion: https://phishdestroy.io/domain/bolsdirect.shop/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: not observed active - First observed by PhishDestroy: 2026-10-20 20:15:17 UTC - Last availability or vendor check: 2026-10-21 22:32:48 UTC - Stored record updated: 2026-10-22 03:14:32 UTC - VirusTotal detections in the stored snapshot: 1/92 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: no stored flag ## Stored infrastructure - Observed IP address: 46.245.239.121 - Registrar in stored WHOIS data: Dynadot Inc. - Last stored HTTP status: 200 - Registration date in stored WHOIS data: 2026-05-26 13:58:16 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a15af2-be5f-77ee-bfea-eda3b4bd2090/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/bolsdirect.shop - Certificate Transparency search: https://crt.sh/?q=%25.bolsdirect.shop - Web Archive lookup: https://web.archive.org/web/*/https://bolsdirect.shop/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview PhishDestroy has listed bolsdirect.shop on its internal blocklist as a suspicious domain. The site was first observed by PhishDestroy on 2026-10-20. The recorded page title reads "Cocktail Supplies | Cocktail Workshops | Courses for Bartenders | Bols". How the scam works The domain is flagged only as suspicious; no specific phishing, wallet‑draining, or malware activity has been observed. A legitimate‑sounding brand in the title could be leveraged in various scams, but without concrete evidence a particular mechanism cannot be identified. Evidence VirusTotal scanned the domain on 2026-10-16 and reported 1 detection out of 92 engines, flagged by alphaMountain.ai. Google Safe Browsing checked on 2026-10-20 and did not flag the site. External blocklists checked on 2026-10-20 returned zero hits. PhishDestroy internal blocklist marked the domain as suspicious on 2026-10-20. OTX recorded four pulses referencing the domain as of 2026-10-20. Infrastructure The recorded IP address for bolsdirect.shop is 46.245.239.121. What to do If you visited the site, ensure your browser and operating system are up to date and run a malware scan. If you entered any credentials, change them on the affected service and enable multi‑factor authentication. Defenders should add the exact domain to blocklists and monitor network logs for connections to 46.245.239.121. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a15af2-be5f-77ee-bfea-eda3b4bd2090/ VirusTotal report: https://www.virustotal.com/gui/domain/bolsdirect.shop Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=bolsdirect.shop Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-20 21:22:12 UTC ## Stored page captures - Primary capture: https://i.ibb.co/HDdqTtDx/2c2d3cb8ada3.png Captured: 2026-10-20 20:15:17 UTC - URLScan capture: https://screenshots.phishdestroy.io/01a15af2-be5f-77ee-bfea-eda3b4bd2090.png Captured: 2026-10-20 20:15:17 UTC Source report: https://urlscan.io/result/01a15af2-be5f-77ee-bfea-eda3b4bd2090/ - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/3255ab1f-766c-4b62-b13a-b8d257b9a987.png Captured: 2026-10-20 21:18:33 UTC Source report: https://radar.cloudflare.com/scan/3255ab1f-766c-4b62-b13a-b8d257b9a987 SHA-256: 586053a4f30f526154a7af569d1129902e32a53ff2a0c25ce5a56555d4997ec9 - URLQuery: https://screenshots.phishdestroy.io/uq/acdd4bcd-c537-465c-afe2-7265fbe74382.png Source report: https://urlquery.net/report/acdd4bcd-c537-465c-afe2-7265fbe74382 SHA-256: 88c3ca9f23d68d8053dd5d883af19928e72f7c50563bba62aefcb67a7d5e2190 - URLScan · 2026-10-20: https://screenshots.phishdestroy.io/us/01a15afa-8e74-7074-b85e-416278f3e741.png Captured: 2026-10-20 20:22:48 UTC Source report: https://urlscan.io/result/01a15afa-8e74-7074-b85e-416278f3e741/ SHA-256: dcfe887204f211332b7990b86920ff8ba9ffcb2e2d98d3842446c238bfe3670f ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-20T20:51:13Z", "uuid": "01a15af2-be5f-77ee-bfea-eda3b4bd2090", "scanned_at": "2026-10-20T20:13:50Z", "final_url": "https://bolsdirect.shop/", "status": 200, "redirected": "https-only", "redirects": [ { "to": "https://bolsdirect.shop/", "from": "http://bolsdirect.shop/", "status": 307 } ], "ip": "46.245.239.121", "domains": [ "placehold.co", "fonts.gstatic.com", "fonts.googleapis.com" ], "ips": [ "188.114.97.3", "142.251.13.94", "142.250.154.95", "46.245.239.121" ], "asns": [ "13335", "15169", "199242" ], "countries": [ "US", "GE" ], "doc_hash": "c9cb4911d26890875827d6011ae4f4ab0af2cefae0b557a9d19c54f9ce2278f4", "script_hashes": [ "7302d96ee0c7d033dff721d1d98ecc615fb2f9936d2589d9c82e0acdf3815d50", "da1c9803523e7a18f5f93419f7dbf9cab702b5a78564eb9dc0e18c32e492ae4f", "56bef185cd5d43be7d55db75e9756858e8a4093525595194b8d3202210013efe", "2d9ed79eb6d7a824a49129543fe8712e46fdc8f048e145692492d81f589f33b5", "91eb4c6e12d5d0f37080b53c6a8b513c579db4854839928eb478164ef6dc1d65", "acfed8ce931532ba4fbcdbc534468ab16b1e4ab08c8f8b9859558b9fbfc86d3e", "5790cd3ddf6d13150fad9403a3be5269f8bb5c8905966746bca6929477b611e0", "54674023c15e7c7d2c117eacd9399f7e7ff4a224093be6fbd07fba4480b882ba", "ef598e4df04d2d336c9267057130a0ab7a499d928810f0bceb6393f28a5fcb03", "915eca2ddd30cf0f0dcf655424d66e36e55d66a038b3365bfff815980b355c29" ], "globals": [ "__next_f", "webpackChunk_N_E", "next", "_N_E_STYLE_LOAD", "Prism" ], "cookies": [ "_1b9_cid", "_1b9_rg", "_1b9_rid", "_site_domain" ], "storage_keys": [ "analytics_session_id", "analytics_session_id_ts", "__analytics_utm__", "analytics_visitor_id" ], "tls": { "san": [ "bolsdirect.shop" ], "cipher": "AES_128_GCM", "issuer": "YE2", "subject": "bolsdirect.shop", "protocol": "TLS 1.3", "valid_to": "2026-12-22T00:31:03Z", "valid_from": "2026-09-23T00:31:04Z" }, "domain_age_days": 147, "apex_age_days": 147, "tls_age_days": 27, "tls_valid_days": 89, "requests": 50, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 95, "malicious": true }, "overall": { "tags": [ "phishing" ], "score": 100, "brands": [ "fakeshop" ], "malicious": true, "categories": [ "phishing" ] }, "urlscan": { "tags": [ "phishing" ], "score": 100, "brands": [ "Fake Shop" ], "malicious": true, "categories": [ "phishing" ] } }, "headers": { "content-type": "text/html; charset=utf-8", "x-frame-options": "SAMEORIGIN", "x-content-type-options": "nosniff", "referrer-policy": "strict-origin-when-cross-origin" } }, "cf": { "v": 1, "fetched_at": "2026-10-20T22:28:50Z", "uuid": "3255ab1f-766c-4b62-b13a-b8d257b9a987", "scanned_at": "2026-10-20T21:18:33Z", "final_url": "https://bolsdirect.shop/", "status": 200, "history": [ { "url": "https://bolsdirect.shop/", "status": 200 } ], "dom_hash": "73273fb0dc98c4b2615f49b778e5f9815994be54c60385d5f9070646b349d982", "doc_hash": "b227f3920ec46b04fc1292fcc04b2aa495cfe0291ab98001d670e74881513a42", "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "bolsdirect.shop", "type": "A", "value": "46.245.239.121" } ], "dnssec_valid": false, "ip": "46.245.239.121" }, "vt": { "v": 1, "fetched_at": "2026-10-20T21:10:46Z", "analysis_at": "2026-10-16T00:32:06Z", "stats": { "timeout": 0, "harmless": 55, "malicious": 0, "suspicious": 1, "undetected": 36 }, "detections": { "alphaMountain.ai": "suspicious" }, "reputation": 0, "categories": { "alphaMountain.ai": "Suspicious (alphaMountain.ai)" }, "first_seen": "2026-05-26T16:53:56Z", "dns": [ { "ttl": 300, "type": "A", "value": "46.245.239.121" }, { "ttl": 21600, "type": "NS", "value": "hasslo.ns.cloudflare.com" }, { "ttl": 1800, "type": "SOA", "rname": "dns.cloudflare.com", "value": "hasslo.ns.cloudflare.com" }, { "ttl": 21600, "type": "NS", "value": "mckinley.ns.cloudflare.com" } ], "dns_at": "2026-10-16T00:40:37Z", "jarm": "40d40d40d00000000043d43d00043d6aff5ab0f4fc31897186312c9e639319", "cert": { "san": [ "bolsdirect.shop" ], "issuer": "Let's Encrypt / YE2", "serial": "5db50620b17bd2a20d586f8085cd16e21b7", "sha256": "51ad1f72cc397185f65dcd6f80319e5a25e94fe74c764ae38d9fab0cbcf71524", "subject": "bolsdirect.shop", "valid_to": "2026-12-22T00:31:03Z", "valid_from": "2026-09-23T00:31:04Z" } }, "webcheck": { "v": 1, "fetched_at": "2026-10-21T01:33:04Z", "mail_config": { "spf_lookups": 0 }, "caa_records": { "domain": "bolsdirect.shop" }, "block_lists": { "resolvers": 12, "blocked_count": 0 }, "tls_connection": { "alpn": "h2", "cipher": "TLS_AES_128_GCM_SHA256", "protocol": "TLSv1.3", "versions": [ "TLSv1.2", "TLSv1.3" ], "authorized": true, "forward_secrecy": true }, "ports": { "open": [ 22, 80, 443, 8000 ] }, "dns_server": { "ns": [ { "ip": "108.162.195.134", "host": "hasslo.ns.cloudflare.com" }, { "ip": "108.162.194.73", "host": "mckinley.ns.cloudflare.com" } ], "zone": "bolsdirect.shop" }, "location": { "ip": "46.245.239.121", "asn": "199242", "org": "Malakmadze Web LLC", "country": "GE" }, "ssl": { "issuer": "Let's Encrypt / YE2", "subject": "bolsdirect.shop" }, "dns": { "A": [ "46.245.239.121" ], "NS": [ "hasslo.ns.cloudflare.com", "mckinley.ns.cloudflare.com" ], "SOA": "{\"nsname\": \"hasslo.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2416513156, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}" }, "dnssec": { "ds": false, "rrsig": false, "dnskey": false }, "get_ip": { "ip": "46.245.239.121", "family": 4 } } } ```