# PhishDestroy domain threat record: bontcyclingemporiumco.shop

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/bontcyclingemporiumco.shop/
Machine-readable companion: https://phishdestroy.io/domain/bontcyclingemporiumco.shop/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-24 22:43:39 UTC
- Last availability or vendor check: 2026-10-25 03:44:47 UTC
- Stored record updated: 2026-10-25 08:11:55 UTC
- VirusTotal detections in the stored snapshot: 4/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored infrastructure

- Observed IP address: 212.52.28.132
- Registrar in stored WHOIS data: Dynadot Inc.
- Last stored HTTP status: 200
- Registration date in stored WHOIS data: 2026-04-08 22:00:00 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a17013-db9c-71bf-8d97-19eafbaf11e3/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/bontcyclingemporiumco.shop
- Certificate Transparency search: https://crt.sh/?q=%25.bontcyclingemporiumco.shop
- Web Archive lookup: https://web.archive.org/web/*/https://bontcyclingemporiumco.shop/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
PhishDestroy’s intake AI classified the site as malicious because it pretends to be the official Bont Cycling online store and advertises custom cycling shoes at 70 % off, a pattern typical of counterfeit e‑commerce pages. The page excerpt recorded by PhishDestroy reads “Bont Cycling Online Store: Custom Cycling Shoes for Road, MTB, and Gravel | Bont Cycling Online Store,” confirming the brand impersonation claim. The domain was first seen by PhishDestroy on 2026-10-25 and a live HTTP 200 response was captured on that date.

How the scam works
Fake‑store scams copy a legitimate brand’s name and visual style, then lure shoppers with unrealistically high discounts to collect payment details, personal data, or cryptocurrency. Victims are typically asked to complete a fraudulent checkout that never results in delivery of the advertised goods. The harvested information can be sold or reused for further fraud.

Evidence
VirusTotal’s 2026-10-22 analysis flagged the domain with four detections out of 92 engines, including two malicious (Webroot) and two suspicious (LevelBlue, Gridinsoft, alphaMountain.ai) labels. Google Safe Browsing checked on 2026-10-25 did not flag the site. OTX listed four pulses referencing the domain as of 2026-10-25. urlscan.io’s 2026-10-24 scan gave a malicious overall score of 100, categorising the page as phishing and labeling it a “Fake Shop.” PhishDestroy’s internal blocklist contains the domain, while external blocklists checked on 2026-10-25 reported no listings.

Infrastructure
The domain was registered on 2026-04-09, giving it an age of about 198 days at the time of observation. It is hosted behind Cloudflare, using nameservers lana.ns.cloudflare.com and bradley.ns.cloudflare.com, and resolves to IP 212.52.28.132 (ASN 199242, organization Malakmadze Web LLC, Los Angeles, US). A Let’s Encrypt certificate issued on 2026-10-05 is valid until 2027-01-03, and open ports 22, 80, 443 and 8000 were observed.

What to do
Users should avoid entering any payment or personal information on the site and, if they have already done so, change passwords on any accounts where the same credentials were used. Organizations should block the domain at the firewall or proxy, monitor outbound traffic for connections to the IP, and add the domain to threat‑intel feeds. Since wallet‑related recommendations are not applicable, no wallet‑specific remediation is required.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a17013-db9c-71bf-8d97-19eafbaf11e3/
Cloudflare Radar report: https://radar.cloudflare.com/scan/0c654cfd-fe59-4cc9-aebf-21b68f62196b
URLQuery report: https://urlquery.net/report/09eed83d-a921-47bd-8330-65ab77e2e86f
Stored capture screenshot: https://i.ibb.co/1YNC9mZk/591e42a81162.png
Cloudflare Radar screenshot (2026-10-24T22:44:43Z): https://screenshots.phishdestroy.io/cf/0c654cfd-fe59-4cc9-aebf-21b68f62196b.png
URLQuery screenshot: https://screenshots.phishdestroy.io/uq/09eed83d-a921-47bd-8330-65ab77e2e86f.png
URLScan screenshot (2026-10-24T22:16:45Z): https://screenshots.phishdestroy.io/us/01a16ffc-bf10-737c-861c-c3bcb29f074d.png
URLScan capture report: https://urlscan.io/result/01a16ffc-bf10-737c-861c-c3bcb29f074d/
VirusTotal report: https://www.virustotal.com/gui/domain/bontcyclingemporiumco.shop
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=bontcyclingemporiumco.shop
Archived copy: https://web.archive.org/web/20261024224503/https://bontcyclingemporiumco.shop/
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-24 23:48:39 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/1YNC9mZk/591e42a81162.png
  Captured: 2026-10-24 22:43:39 UTC
- URLScan capture: https://screenshots.phishdestroy.io/01a17013-db9c-71bf-8d97-19eafbaf11e3.png
  Captured: 2026-10-24 22:43:39 UTC
  Source report: https://urlscan.io/result/01a17013-db9c-71bf-8d97-19eafbaf11e3/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/0c654cfd-fe59-4cc9-aebf-21b68f62196b.png
  Captured: 2026-10-24 22:44:43 UTC
  Source report: https://radar.cloudflare.com/scan/0c654cfd-fe59-4cc9-aebf-21b68f62196b
  SHA-256: acc94e0798f9a3392b883271b5766ea590e4426444e002903b0d5e93ecdbd87e
- URLQuery: https://screenshots.phishdestroy.io/uq/09eed83d-a921-47bd-8330-65ab77e2e86f.png
  Source report: https://urlquery.net/report/09eed83d-a921-47bd-8330-65ab77e2e86f
  SHA-256: 7d958b9ff120c02bca51d86a97d31554fda1373b03fd94d40c51cfacbc6c9792
- URLScan · 2026-10-24: https://screenshots.phishdestroy.io/us/01a16ffc-bf10-737c-861c-c3bcb29f074d.png
  Captured: 2026-10-24 22:16:45 UTC
  Source report: https://urlscan.io/result/01a16ffc-bf10-737c-861c-c3bcb29f074d/
  SHA-256: bcca918a7235c5f5a773cb6bcc9e926ed84b40ff36577ce0043e1b80936c1922

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-24T22:45:03Z",
        "uuid": "01a17013-db9c-71bf-8d97-19eafbaf11e3",
        "scanned_at": "2026-10-24T22:42:01Z",
        "final_url": "https://bontcyclingemporiumco.shop/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://bontcyclingemporiumco.shop/",
                "from": "http://bontcyclingemporiumco.shop/",
                "status": 307
            }
        ],
        "ip": "212.52.28.132",
        "domains": [
            "fonts.gstatic.com",
            "fonts.googleapis.com"
        ],
        "ips": [
            "142.251.14.94",
            "2a00:1450:4001:c1f::5f",
            "212.52.28.132"
        ],
        "asns": [
            "15169",
            "199242"
        ],
        "countries": [
            "US",
            "DE"
        ],
        "doc_hash": "04d05978fdb111358073ab0524e5c1fafc0826615c206987618416b8bd8a4747",
        "script_hashes": [
            "4b3acbbee7d04ee7b0799428c06e80f012d9800263f7f2acdd63a1a5ac970c4d",
            "da1c9803523e7a18f5f93419f7dbf9cab702b5a78564eb9dc0e18c32e492ae4f",
            "56bef185cd5d43be7d55db75e9756858e8a4093525595194b8d3202210013efe",
            "2d9ed79eb6d7a824a49129543fe8712e46fdc8f048e145692492d81f589f33b5",
            "5790cd3ddf6d13150fad9403a3be5269f8bb5c8905966746bca6929477b611e0",
            "9de785ee19ccdf688f837e8bf8d2bbdb4c1dabc04b8ee7166bc1f4057226e49d",
            "91eb4c6e12d5d0f37080b53c6a8b513c579db4854839928eb478164ef6dc1d65",
            "acfed8ce931532ba4fbcdbc534468ab16b1e4ab08c8f8b9859558b9fbfc86d3e",
            "54674023c15e7c7d2c117eacd9399f7e7ff4a224093be6fbd07fba4480b882ba",
            "5594b2dc49c9ed560d32392288f138c9e3f4cccd2c8c71d305060cf653ce80c2"
        ],
        "globals": [
            "__next_f",
            "webpackChunk_N_E",
            "next",
            "_N_E_STYLE_LOAD",
            "Prism"
        ],
        "cookies": [
            "_ksg_cid",
            "_ksg_pv",
            "_ksg_rg",
            "_ksg_rid",
            "_site_domain"
        ],
        "storage_keys": [
            "analytics_session_id",
            "analytics_session_id_ts",
            "__analytics_utm__",
            "analytics_visitor_id"
        ],
        "domain_age_days": 198,
        "apex_age_days": 198,
        "tls_age_days": 19,
        "tls_valid_days": 89,
        "requests": 52,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 88,
                "malicious": true
            },
            "overall": {
                "tags": [
                    "phishing"
                ],
                "score": 100,
                "brands": [
                    "fakeshop"
                ],
                "malicious": true,
                "categories": [
                    "phishing"
                ]
            },
            "urlscan": {
                "tags": [
                    "phishing"
                ],
                "score": 100,
                "brands": [
                    "Fake Shop"
                ],
                "malicious": true,
                "categories": [
                    "phishing"
                ]
            }
        },
        "headers": {
            "content-type": "image/png"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-24T22:45:06Z",
        "uuid": "0c654cfd-fe59-4cc9-aebf-21b68f62196b",
        "scanned_at": "2026-10-24T22:44:43Z",
        "final_url": "https://bontcyclingemporiumco.shop/",
        "status": 200,
        "history": [
            {
                "url": "https://bontcyclingemporiumco.shop/",
                "status": 200
            }
        ],
        "dom_hash": "eabda363b4861d4201bd59c6b42c9c8a53ea711a290d46fc07188fa44eacca1f",
        "doc_hash": "0825840fe598821d4a0fe57d5e23861c78f09a64b8df6b30c7fe40e29fad3789",
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "bontcyclingemporiumco.shop",
                "type": "A",
                "value": "212.52.28.132"
            }
        ],
        "dnssec_valid": false,
        "ip": "212.52.28.132"
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-24T23:47:40Z",
        "analysis_at": "2026-10-22T15:40:46Z",
        "stats": {
            "timeout": 0,
            "harmless": 54,
            "malicious": 2,
            "suspicious": 2,
            "undetected": 34
        },
        "detections": {
            "Webroot": "malicious",
            "LevelBlue": "phishing",
            "Gridinsoft": "suspicious",
            "alphaMountain.ai": "suspicious"
        },
        "reputation": 0,
        "created": "2026-04-09T00:00:00Z",
        "updated": "2026-04-09T00:00:00Z",
        "first_seen": "2026-04-09T06:48:06Z",
        "dns": [
            {
                "ttl": 21600,
                "type": "NS",
                "value": "lana.ns.cloudflare.com"
            },
            {
                "ttl": 1800,
                "type": "SOA",
                "rname": "dns.cloudflare.com",
                "value": "bradley.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "212.52.28.132"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "bradley.ns.cloudflare.com"
            }
        ],
        "dns_at": "2026-10-22T16:08:54Z",
        "jarm": "40d40d40d00000000043d43d00043d6aff5ab0f4fc31897186312c9e639319",
        "cert": {
            "san": [
                "bontcyclingemporiumco.shop"
            ],
            "issuer": "Let's Encrypt / YE2",
            "serial": "52c1e519d6aa85772480f12685d6a7282b",
            "sha256": "744bcff70b539f60146993f90a46f64d72f4d82155b209e3cce6bff0b70b7b27",
            "subject": "bontcyclingemporiumco.shop",
            "valid_to": "2027-01-03T06:37:30Z",
            "valid_from": "2026-10-05T06:37:31Z"
        },
        "whois": []
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-24T22:45:21Z",
        "mail_config": {
            "spf_lookups": 0
        },
        "caa_records": {
            "domain": "bontcyclingemporiumco.shop"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_count": 0
        },
        "archives": {
            "last": "2026-10-24T22:45:03Z",
            "first": "2026-10-24T22:45:03Z",
            "changes": 0,
            "days_archived": 1,
            "avg_page_bytes": 48840
        },
        "trackers": {
            "requests": 36,
            "trackers": [
                {
                    "name": "Google Fonts",
                    "company": "Google",
                    "country": "US",
                    "category": "Hosting",
                    "requests": 1
                },
                {
                    "name": "Google Static",
                    "company": "Google",
                    "country": "US",
                    "category": "Hosting",
                    "requests": 1
                }
            ]
        },
        "tls_connection": {
            "alpn": "h2",
            "cipher": "TLS_AES_128_GCM_SHA256",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                22,
                80,
                443,
                8000
            ]
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "172.64.35.35",
                    "host": "bradley.ns.cloudflare.com"
                },
                {
                    "ip": "172.64.32.182",
                    "host": "lana.ns.cloudflare.com"
                }
            ],
            "zone": "bontcyclingemporiumco.shop"
        },
        "location": {
            "ip": "212.52.28.132",
            "asn": "199242",
            "org": "Malakmadze Web LLC",
            "city": "Los Angeles",
            "country": "US"
        },
        "ssl": {
            "issuer": "Let's Encrypt / YE2",
            "subject": "bontcyclingemporiumco.shop"
        },
        "dns": {
            "A": [
                "212.52.28.132"
            ],
            "NS": [
                "lana.ns.cloudflare.com",
                "bradley.ns.cloudflare.com"
            ],
            "SOA": "{\"nsname\": \"bradley.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2417068173, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}"
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "get_ip": {
            "ip": "212.52.28.132",
            "family": 4
        }
    }
}
```