# PhishDestroy domain threat record: bonanzasatrangistyle.shop

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/bonanzasatrangistyle.shop/
Machine-readable companion: https://phishdestroy.io/domain/bonanzasatrangistyle.shop/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-22 01:43:41 UTC
- Last availability or vendor check: 2026-10-22 10:49:42 UTC
- Stored record updated: 2026-10-22 14:21:19 UTC
- VirusTotal detections in the stored snapshot: 4/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored infrastructure

- Observed IP address: 195.96.130.208
- Registrar in stored WHOIS data: Dynadot Inc.
- Last stored HTTP status: 200
- Registration date in stored WHOIS data: 2026-06-10 06:28:28 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a16145-647c-744f-9a4c-66a20b100a0b/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/bonanzasatrangistyle.shop
- Certificate Transparency search: https://crt.sh/?q=%25.bonanzasatrangistyle.shop
- Web Archive lookup: https://web.archive.org/web/*/https://bonanzasatrangistyle.shop/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
PhishDestroy’s intake AI classified the site as malicious because it pretends to be an official Bonanza Satrangi store and advertises heavily discounted products. The recorded page title reads “Satrangi by Bonanza | Bonanza Satrangi”, which matches the brand‑impersonation concern. The assessment was recorded on 2026-10-22, the same day the domain first appeared in PhishDestroy’s blocklist. No other behavior was observed beyond the page content excerpt.

How the scam works
Fake‑store scams copy a well‑known brand’s visual identity and lure shoppers with unrealistically low prices. Victims are prompted to enter payment details or login credentials, which can then be harvested for fraud or account takeover.

Evidence
VirusTotal reported one malicious detection (Netcraft) and three suspicious detections out of 92 engines on 2026-10-22, totaling four detections. Google Safe Browsing did not flag the domain on the same date. OTX listed four pulses referencing the domain as of 2026-10-22. urlscan’s automated analysis on 2026-10-22 marked the site malicious with a score of 100, categorising it as phishing and labeling it a fake shop. PhishDestroy’s internal blocklist includes the domain, while external blocklists checked on that date reported zero hits.

Infrastructure
The recorded IP was 195.96.130.208, which the intake observed as belonging to Malakmadze Web LLC in the United States. The domain used Cloudflare nameservers amit.ns.cloudflare.com and deb.ns.cloudflare.com. The Let’s Encrypt TLS certificate was issued on 2026-10-07 and was valid until 2027-01-05, and the domain age was 133 days at the time of observation.

What to do
Visitors should avoid entering any personal, payment, or login information on the site and, if they have already done so, change affected passwords and monitor financial accounts for unauthorized activity. Security teams should add the domain to web‑filtering policies and block it at the network perimeter. Review access logs for any connections to the recorded host to detect possible exposure.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a16145-647c-744f-9a4c-66a20b100a0b/
Cloudflare Radar report: https://radar.cloudflare.com/scan/5fa5b55a-a49f-42b7-8d44-c9bde96df4a8
Stored capture screenshot: https://urlscan.io/screenshots/01a16145-647c-744f-9a4c-66a20b100a0b.png
Cloudflare Radar screenshot (2026-10-22T02:17:17Z): https://screenshots.phishdestroy.io/cf/5fa5b55a-a49f-42b7-8d44-c9bde96df4a8.png
URLScan screenshot (2026-10-22T01:48:54Z): https://screenshots.phishdestroy.io/us/01a1614b-de1d-746c-91b0-c605f7c5872f.png
URLScan capture report: https://urlscan.io/result/01a1614b-de1d-746c-91b0-c605f7c5872f/
VirusTotal report: https://www.virustotal.com/gui/domain/bonanzasatrangistyle.shop
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=bonanzasatrangistyle.shop
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-22 02:18:52 UTC

## Stored page captures

- Primary capture: https://urlscan.io/screenshots/01a16145-647c-744f-9a4c-66a20b100a0b.png
  Captured: 2026-10-22 01:43:41 UTC
- URLScan capture: https://screenshots.phishdestroy.io/01a16145-647c-744f-9a4c-66a20b100a0b.png
  Captured: 2026-10-22 01:43:41 UTC
  Source report: https://urlscan.io/result/01a16145-647c-744f-9a4c-66a20b100a0b/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/5fa5b55a-a49f-42b7-8d44-c9bde96df4a8.png
  Captured: 2026-10-22 02:17:17 UTC
  Source report: https://radar.cloudflare.com/scan/5fa5b55a-a49f-42b7-8d44-c9bde96df4a8
  SHA-256: 32281de76fe48fc43e04fa30ce9dbd835358fc162e6b5d8948caf20bf14f952a
- URLScan · 2026-10-22: https://screenshots.phishdestroy.io/us/01a1614b-de1d-746c-91b0-c605f7c5872f.png
  Captured: 2026-10-22 01:48:54 UTC
  Source report: https://urlscan.io/result/01a1614b-de1d-746c-91b0-c605f7c5872f/
  SHA-256: 098c673048b821838b74872a63a8220bd184878751863841ce7ceb7ff538108f

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-22T02:18:15Z",
        "uuid": "01a16145-647c-744f-9a4c-66a20b100a0b",
        "scanned_at": "2026-10-22T01:41:52Z",
        "final_url": "https://bonanzasatrangistyle.shop/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://bonanzasatrangistyle.shop/",
                "from": "http://bonanzasatrangistyle.shop/",
                "status": 307
            }
        ],
        "ip": "195.96.130.208",
        "domains": [
            "fonts.gstatic.com",
            "fonts.googleapis.com"
        ],
        "ips": [
            "142.251.13.94",
            "2a00:1450:4001:c1f::5f",
            "195.96.130.208"
        ],
        "asns": [
            "15169",
            "199242"
        ],
        "countries": [
            "US",
            "DE"
        ],
        "doc_hash": "c346e1c606d817beab36284e0915f0d0227e4e54df0a0fdfcf331934035d512b",
        "script_hashes": [
            "f75772611b8378789fc49a0f18e1311dfa7c8d62c76b48b82f7ef6a2c3e17f32",
            "da1c9803523e7a18f5f93419f7dbf9cab702b5a78564eb9dc0e18c32e492ae4f",
            "56bef185cd5d43be7d55db75e9756858e8a4093525595194b8d3202210013efe",
            "2d9ed79eb6d7a824a49129543fe8712e46fdc8f048e145692492d81f589f33b5",
            "91eb4c6e12d5d0f37080b53c6a8b513c579db4854839928eb478164ef6dc1d65",
            "acfed8ce931532ba4fbcdbc534468ab16b1e4ab08c8f8b9859558b9fbfc86d3e",
            "5790cd3ddf6d13150fad9403a3be5269f8bb5c8905966746bca6929477b611e0",
            "54674023c15e7c7d2c117eacd9399f7e7ff4a224093be6fbd07fba4480b882ba",
            "ef598e4df04d2d336c9267057130a0ab7a499d928810f0bceb6393f28a5fcb03",
            "915eca2ddd30cf0f0dcf655424d66e36e55d66a038b3365bfff815980b355c29"
        ],
        "globals": [
            "__next_f",
            "webpackChunk_N_E",
            "next",
            "_N_E_STYLE_LOAD",
            "Prism"
        ],
        "cookies": [
            "_ea6_cid",
            "_ea6_rg",
            "_ea6_rid",
            "_site_domain"
        ],
        "storage_keys": [
            "analytics_session_id",
            "analytics_session_id_ts",
            "__analytics_utm__",
            "analytics_visitor_id"
        ],
        "tls": {
            "san": [
                "bonanzasatrangistyle.shop"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "YE2",
            "subject": "bonanzasatrangistyle.shop",
            "protocol": "TLS 1.3",
            "valid_to": "2027-01-05T14:40:51Z",
            "valid_from": "2026-10-07T14:40:52Z"
        },
        "domain_age_days": 133,
        "apex_age_days": 133,
        "tls_age_days": 14,
        "tls_valid_days": 89,
        "requests": 55,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 92,
                "malicious": true
            },
            "overall": {
                "tags": [
                    "phishing"
                ],
                "score": 100,
                "brands": [
                    "fakeshop"
                ],
                "malicious": true,
                "categories": [
                    "phishing"
                ]
            },
            "urlscan": {
                "tags": [
                    "phishing"
                ],
                "score": 100,
                "brands": [
                    "Fake Shop"
                ],
                "malicious": true,
                "categories": [
                    "phishing"
                ]
            }
        },
        "headers": {
            "content-type": "text/html; charset=utf-8",
            "x-frame-options": "SAMEORIGIN",
            "x-content-type-options": "nosniff",
            "referrer-policy": "strict-origin-when-cross-origin"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-22T02:18:16Z",
        "uuid": "5fa5b55a-a49f-42b7-8d44-c9bde96df4a8",
        "scanned_at": "2026-10-22T02:17:17Z",
        "final_url": "https://bonanzasatrangistyle.shop/",
        "status": 200,
        "history": [
            {
                "url": "https://bonanzasatrangistyle.shop/",
                "status": 200
            }
        ],
        "dom_hash": "fbfefe49e1f6c01218298b4388f7af74016287e9ba7270b1486192ab9f8d677e",
        "doc_hash": "715695ee8cd42e9e7f90931fcfcf10b222de76d5b18962615e0fd555148a60ec",
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "bonanzasatrangistyle.shop",
                "type": "A",
                "value": "195.96.130.208"
            }
        ],
        "dnssec_valid": false,
        "ip": "195.96.130.208"
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-22T02:16:17Z",
        "analysis_at": "2026-10-11T15:47:37Z",
        "stats": {
            "timeout": 0,
            "harmless": 52,
            "malicious": 1,
            "suspicious": 3,
            "undetected": 36
        },
        "detections": {
            "Netcraft": "malicious",
            "LevelBlue": "suspicious",
            "Gridinsoft": "suspicious",
            "alphaMountain.ai": "suspicious"
        },
        "reputation": 0,
        "categories": {
            "Google": "shopping",
            "alphaMountain.ai": "Suspicious (alphaMountain.ai)"
        },
        "first_seen": "2026-06-10T09:24:59Z",
        "dns": [
            {
                "ttl": 21600,
                "type": "NS",
                "value": "amit.ns.cloudflare.com"
            },
            {
                "ttl": 1800,
                "type": "SOA",
                "rname": "dns.cloudflare.com",
                "value": "amit.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "195.96.130.208"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "deb.ns.cloudflare.com"
            }
        ],
        "dns_at": "2026-10-11T17:28:31Z",
        "jarm": "40d40d40d00000000043d43d00043d6aff5ab0f4fc31897186312c9e639319",
        "cert": {
            "san": [
                "bonanzasatrangistyle.shop"
            ],
            "issuer": "Let's Encrypt / YE2",
            "serial": "6cbca4611b4f974c57d358eabc52cfea831",
            "sha256": "afbb164686dcdb05833c0e8f0c676430797c226a1739fd0b536872bc4a52a70b",
            "subject": "bonanzasatrangistyle.shop",
            "valid_to": "2027-01-05T14:40:51Z",
            "valid_from": "2026-10-07T14:40:52Z"
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-22T02:18:32Z",
        "mail_config": {
            "spf_lookups": 0
        },
        "caa_records": {
            "domain": "bonanzasatrangistyle.shop"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_count": 0
        },
        "archives": {
            "last": "2026-10-22T01:45:49Z",
            "first": "2026-10-22T01:45:49Z",
            "changes": 0,
            "days_archived": 1,
            "avg_page_bytes": 55918
        },
        "tls_connection": {
            "alpn": "h2",
            "cipher": "TLS_AES_128_GCM_SHA256",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                22,
                80,
                443,
                8000
            ]
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "173.245.59.63",
                    "host": "amit.ns.cloudflare.com"
                },
                {
                    "ip": "108.162.192.92",
                    "host": "deb.ns.cloudflare.com"
                }
            ],
            "zone": "bonanzasatrangistyle.shop"
        },
        "location": {
            "ip": "195.96.130.208",
            "asn": "199242",
            "org": "Malakmadze Web LLC",
            "city": "Los Angeles",
            "country": "US"
        },
        "ssl": {
            "issuer": "Let's Encrypt / YE2",
            "subject": "bonanzasatrangistyle.shop"
        },
        "dns": {
            "A": [
                "195.96.130.208"
            ],
            "NS": [
                "amit.ns.cloudflare.com",
                "deb.ns.cloudflare.com"
            ],
            "SOA": "{\"nsname\": \"amit.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2416784798, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}"
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "get_ip": {
            "ip": "195.96.130.208",
            "family": 4
        }
    }
}
```