# PhishDestroy domain threat record: bombolone.es Content language: English Canonical HTML report: https://phishdestroy.io/domain/bombolone.es/ Machine-readable companion: https://phishdestroy.io/domain/bombolone.es/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-09-11 01:26:53 UTC - Last availability or vendor check: 2026-10-22 10:26:20 UTC - Stored record updated: 2026-10-22 16:07:29 UTC - VirusTotal detections in the stored snapshot: 17/89 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: no stored flag ## Stored infrastructure - Observed IP address: 217.160.102.21 - Registrar in stored WHOIS data: REGISTRAR_NOT_FOUND - Registrar country in stored WHOIS data: Unknown - Last stored HTTP status: 200 ## Evidence links - URLScan report: https://urlscan.io/result/01a08e11-b105-731a-ae41-9b4a080a94a3/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/bombolone.es - Certificate Transparency search: https://crt.sh/?q=%25.bombolone.es - Web Archive lookup: https://web.archive.org/web/*/https://bombolone.es/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview bombolone.es presents itself as "Bombolone - Panadería y pastelería en Almería," a local bakery and pastry shop, but PhishDestroy classifies it as an impersonation phishing page. Its likely audience is Spanish-speaking visitors looking for a neighbourhood bakery, who have no reason to suspect a site like this. PhishDestroy first flagged the domain on 2026-09-11. As of 2026-10-19 the site was still online and serving content. The page title shows an ordinary small business, while our classification places the domain in the impersonation category. How the scam works Impersonation pages borrow the name and look of a legitimate business so visitors trust them enough to act. A bakery storefront makes a convincing front for fake orders, online payments or contact forms, and visitors rarely question a local shop. Anyone who fills in a form or completes a checkout on such a page risks giving card details, contact information or account credentials to whoever runs it, with no product ever delivered. Evidence On 2026-09-18, 17 of 89 VirusTotal engines flagged the domain. Several are established security vendors: ADMINUSLabs, alphaMountain.ai, BitDefender, CyRadar, ESET, Forcepoint ThreatSeeker, Fortinet and G-Data. Agreement from that many independent engines is significant for a site dressed up as a pastry shop. The domain also appears in five AlienVault OTX threat pulses, so other researchers have tracked it independently. Among the blocklists we monitor, PhishDestroy is currently the only one listing it. Infrastructure The site resolves to 217.160.102.21 on the IONOS SE network, located in Spain, which fits the Spanish-language bakery theme. No registrar could be identified for the domain. Hosting the page on a mainstream provider in the country it targets helps it blend in with genuine local business websites. What to do Do not place orders, pay or submit forms on bombolone.es. If you entered card details, contact your bank right away to block the card and dispute any charges. If you typed a password, change it on every service where you reuse it and turn on two-factor authentication. Treat follow-up emails or calls that mention your order as possible phishing. Defenders should block the domain and 217.160.102.21 at the DNS or proxy level, and report the site to IONOS and to Spanish consumer-protection authorities. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a08e11-b105-731a-ae41-9b4a080a94a3/ VirusTotal report: https://www.virustotal.com/gui/domain/bombolone.es Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=bombolone.es Archived copy: https://web.archive.org/web/20260922182330/https://bombolone.es/ Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-19 09:44:42 UTC ## Stored page captures - Primary capture: https://i.ibb.co/RTnQD367/3c2668e1e8e0.png Captured: 2026-09-11 01:26:53 UTC - URLScan capture: https://screenshots.phishdestroy.io/01a08e11-b105-731a-ae41-9b4a080a94a3.png Captured: 2026-09-11 01:26:53 UTC Source report: https://urlscan.io/result/01a08e11-b105-731a-ae41-9b4a080a94a3/ - URLQuery: https://screenshots.phishdestroy.io/uq/2113a825-37bf-405e-ba95-d4953104df84.png Captured: 2026-09-11 01:28:00 UTC Source report: https://urlquery.net/report/2113a825-37bf-405e-ba95-d4953104df84 SHA-256: 04b9fe0553a51853813558223480cca406f13e8ce1162e560e5b5ced75ad4f2a - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/af3fe437-a38c-4d53-875c-698c5ec9bc4c.png Captured: 2026-09-11 01:31:26 UTC Source report: https://radar.cloudflare.com/scan/af3fe437-a38c-4d53-875c-698c5ec9bc4c SHA-256: c42bfb5da757dafdfa78da591060436d50e13b2992346cd40cd5887fcf81482e ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-21T00:20:29Z", "uuid": "01a08e11-b105-731a-ae41-9b4a080a94a3", "scanned_at": "2026-09-11T01:25:28Z", "final_url": "https://bombolone.es/", "status": 200, "redirected": "https-only", "redirects": [ { "to": "https://bombolone.es/", "from": "http://bombolone.es/", "status": 307 } ], "ip": "217.160.102.21", "domains": [ "maps.googleapis.com", "fonts.googleapis.com", "fonts.gstatic.com", "maps.gstatic.com", "www.google.com", "maps.google.com", "mitziweb.com", "ludmilapsicologa.com", "www.googletagmanager.com" ], "ips": [ "172.217.118.4", "142.250.154.120", "142.251.14.94", "142.251.153.119", "142.251.110.138", "188.114.97.3", "142.250.154.95", "217.160.102.21" ], "asns": [ "15169", "13335", "8560" ], "countries": [ "US", "ES" ], "link_domains": [ "www.google.com", "www.facebook.com", "www.instagram.com" ], "social": [ "https://www.facebook.com", "https://www.instagram.com/explore/locations/664143553752916/bombolone" ], "doc_hash": "7deedc99fa553dec65ac31d6c0b72398baa54f0b8d096b4ff2d59d1e29c3dfda", "script_hashes": [ "cb6f2d32c49d1c2b25e9ffc9aaafa3f83075346c01bcd4ae6eb187392a4292cf", "5274f11e6fb32ae0cf2dfb9f8043272865c397a7c4223b4cfa7d50ea52fbde89", "0a65b0a2f930ac72138c36aea669a3c760c93ce1093e52fb2c542d46f8d1ec61", "c4596b16b126326b0d8fc2fb8bf91389ad3dc4671a269187913c19a8f2ad1094", "c5f3b2f654d2d8210a481c0164f0a53430cd09b77c34374fe23c9a03f5ad00fb", "747ee080eb57ab3ca956da0c0779e4177492db9da1a7022c4979936c2fd872f1", "8b352f348663958a8dda045ec0c2b60d01a6d30ab70bef0b6c26a527e46ccba2", "5af760e4297b064a2150dcd5f63d748a06dfa8b618c9e9d43a87c4ac74fa3974", "fd9ae84b4655a6ff4bc18628d0dedaa835d10b5d6ea48455d73523c8b34e34f6", "c66f47147d5fe3cceeaa47a93ff7440a328f859b049deec2f9d8f414e9137474" ], "globals": [ "jQuery", "gtag", "dataLayer", "setREVStartSize", "RSIW", "RSIH", "RS_MODULES", "revslider_showDoubleJqueryError", "cnArgs", "PojoA11yOptions", "generatepressMenu", "webpackChunkelementorFrontend", "elementorModules", "elementorFrontendConfig", "elementorFrontend", "EvEmitter", "imagesLoaded", "_", "wp", "strong_slider_id_1", "strongControllerParms", "debugit", "strongController", "webpackChunkelementor_pro", "ElementorProFrontendConfig", "elementorProFrontend", "webpackChunkadvanced_image_comparison_for_elementor", "tpj", "revapi1", "gsapVersions", "tpGS", "punchgs", "verge", "_wpemojiSettings", "RSANYID", "RSANYID_sliderID", "_R_is_Editor", "RSBrowser", "isSafari11", "T" ], "cookies": [ "pll_language" ], "storage_keys": [ "wpEmojiSettingsSupports" ], "tls": { "san": [ "*.bombolone.es", "bombolone.es" ], "cipher": "AES_128_GCM", "issuer": "YR2", "subject": "bombolone.es", "protocol": "TLS 1.3", "valid_to": "2026-10-27T14:49:59Z", "valid_from": "2026-07-29T14:50:00Z" }, "domain_age_days": 884, "apex_age_days": 884, "tls_age_days": 43, "tls_valid_days": 89, "requests": 104, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": -86, "malicious": false }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "nginx", "content-type": "text/html; charset=UTF-8", "x-powered-by": "PleskLin", "permissions-policy": "private-state-token-redemption=(self \"https://www.google.com\" \"https://www.gstatic.com\" \"https://recaptcha.net\" \"https://challenges.cloudflare.com\" \"https://hcaptcha.com\"), private-state-token-issuanc" } }, "cf": { "v": 1, "fetched_at": "2026-10-21T02:32:46Z", "uuid": "af3fe437-a38c-4d53-875c-698c5ec9bc4c", "scanned_at": "2026-09-11T01:31:26Z", "final_url": "https://bombolone.es/", "status": 200, "redirected": "https-only", "history": [ { "url": "http://bombolone.es/", "status": 307 }, { "url": "https://bombolone.es/", "status": 200 } ], "dom_hash": "d3b0c18fe3cb93650a6b55841b27f9b650d6678c40d65ec8784e8b2525172331", "doc_hash": "371e73b44e80dcfccc0342043c84f0d29d7159c6d614410fdd2306aa53a013d5", "domain_risks": [ "Food & Drink", "Society & Lifestyle" ], "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "bombolone.es", "type": "A", "value": "217.160.102.21" } ], "dnssec_valid": false, "ip": "217.160.102.21" }, "vt": { "v": 1, "fetched_at": "2026-10-22T17:42:42Z", "analysis_at": "2026-10-21T23:53:18Z", "stats": { "timeout": 0, "harmless": 47, "malicious": 14, "suspicious": 1, "undetected": 30 }, "detections": { "ESET": "suspicious", "VIPRE": "phishing", "G-Data": "phishing", "Lionic": "phishing", "Sophos": "phishing", "CyRadar": "phishing", "Webroot": "malicious", "Fortinet": "phishing", "SOCRadar": "phishing", "Gridinsoft": "phishing", "SafeToOpen": "phishing", "BitDefender": "phishing", "desenmascara.me": "malicious", "alphaMountain.ai": "phishing", "Forcepoint ThreatSeeker": "phishing" }, "reputation": 0, "categories": { "Google": "retail", "Sophos": "phishing and fraud", "Webroot": "Phishing and Other Frauds", "alphaMountain.ai": "Phishing (alphaMountain.ai)" }, "first_seen": "2024-04-13T20:46:17Z", "dns": [ { "ttl": 21600, "type": "TXT", "value": "google-site-verification=bCksxS5t4OpHaaetm1PPtV04Nz-vIlDzW8g0lbJhciw" }, { "ttl": 21600, "type": "NS", "value": "ns1.bombolone.es" }, { "ttl": 21600, "type": "SOA", "rname": "info.adelantia.com", "value": "ns2.bombolone.es" }, { "ttl": 21600, "type": "NS", "value": "ns2.bombolone.es" }, { "ttl": 21600, "type": "A", "value": "217.160.102.21" }, { "ttl": 21600, "type": "TXT", "value": "v=spf1 a mx ip4:217.160.102.21 ~all" }, { "ttl": 21600, "type": "MX", "value": "bombolone.es", "priority": 0 } ], "dns_at": "2026-10-21T23:53:48Z", "jarm": "21d19d00021d21d00042d43d00000091f9827a8676a9d9f27d421962a09b5d", "cert": { "san": [ "*.bombolone.es", "bombolone.es" ], "issuer": "Let's Encrypt / YR2", "serial": "6da13688dd9ddb98cd64a1c8a67142b14df", "sha256": "f2b9a1520dd7e3f8c3d74a8576bcbb154afdb06347fb8fb500f9a6e020bb49f7", "subject": "bombolone.es", "valid_to": "2026-12-26T16:49:49Z", "valid_from": "2026-09-27T16:49:50Z" } } } ```