# PhishDestroy domain threat record: booknookworld.shop

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/booknookworld.shop/
Machine-readable companion: https://phishdestroy.io/domain/booknookworld.shop/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-24 22:25:55 UTC
- Last availability or vendor check: 2026-10-25 03:20:52 UTC
- Stored record updated: 2026-10-25 08:11:55 UTC
- VirusTotal detections in the stored snapshot: 1/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored infrastructure

- Observed IP address: 23.252.79.102
- Registrar in stored WHOIS data: Dynadot Inc.
- Last stored HTTP status: 200
- Registration date in stored WHOIS data: 2026-05-26 13:16:24 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a17003-a9f4-70fa-8044-9d6457d5d77c/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/booknookworld.shop
- Certificate Transparency search: https://crt.sh/?q=%25.booknookworld.shop
- Web Archive lookup: https://web.archive.org/web/*/https://booknookworld.shop/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
PhishDestroy’s intake AI classified the site as malicious because it presents itself as an “Official Book Nook” store selling DIY 3D miniature kits with up to 70 % off, a claim that conflicts with any known official Book Nook presence. The domain was first seen by PhishDestroy on 2026-10-25 when a live HTTP 200 response was captured by urlscan.io.

How the scam works
Fake‑store impersonation schemes create a storefront that mimics a legitimate brand, advertise deep discounts to lure shoppers, and then harvest payment details or personal information entered at checkout. Victims may have their credit‑card numbers, email credentials or other data stolen for fraud or credential‑stuffing attacks.

Evidence
urlscan.io’s automated analysis on 2026-10-25 labeled the site malicious with a score of 100, categorising it as phishing and tagging it as a “Fake Shop”. VirusTotal’s scan of the domain on 2026-10-11 reported one suspicious detection from Gridinsoft out of 92 engines; the overall result was not marked malicious. Google Safe Browsing reported no warning on 2026-10-25. OTX listed three pulses mentioning the domain on 2026-10-25. PhishDestroy’s internal blocklist contained the domain as of 2026-10-25, while external blocklists checked on the same day showed zero hits.

Infrastructure
The recorded DNS A record pointed to 23.252.79.102 and the domain used Cloudflare nameservers gabe.ns.cloudflare.com and hazel.ns.cloudflare.com; the IP was listed in ASN 199242 (Malakmadze Web LLC) located in Georgia. The domain was 151 days old at capture and employed a Let’s Encrypt TLS certificate issued on 2026-09-23 and valid until 2026-12-22. Open ports observed included 22, 80, 443 and 8000, and DNSSEC was not enabled.

What to do
Users should avoid entering any payment or login information on the site and, if they have already done so, monitor financial accounts and change associated passwords. Organizations should block the domain at perimeter defenses and review logs for any connections to the recorded IP and ports. The captured TLS certificate and DNS records can be used to correlate related activity, but no broader infrastructure has been linked at this time.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a17003-a9f4-70fa-8044-9d6457d5d77c/
Cloudflare Radar report: https://radar.cloudflare.com/scan/c0aaf970-f86c-4283-a1aa-a0a704edeefa
URLQuery report: https://urlquery.net/report/36ad8d48-f733-4479-9153-dd9b166e3eec
Stored capture screenshot: https://i.ibb.co/QFD9BVXX/38873a31da1c.png
Cloudflare Radar screenshot (2026-10-24T22:57:02Z): https://screenshots.phishdestroy.io/cf/c0aaf970-f86c-4283-a1aa-a0a704edeefa.png
URLQuery screenshot: https://screenshots.phishdestroy.io/uq/36ad8d48-f733-4479-9153-dd9b166e3eec.png
VirusTotal report: https://www.virustotal.com/gui/domain/booknookworld.shop
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=booknookworld.shop
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-24 22:58:16 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/QFD9BVXX/38873a31da1c.png
  Captured: 2026-10-24 22:25:55 UTC
- URLScan capture: https://screenshots.phishdestroy.io/01a17003-a9f4-70fa-8044-9d6457d5d77c.png
  Captured: 2026-10-24 22:25:55 UTC
  Source report: https://urlscan.io/result/01a17003-a9f4-70fa-8044-9d6457d5d77c/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/c0aaf970-f86c-4283-a1aa-a0a704edeefa.png
  Captured: 2026-10-24 22:57:02 UTC
  Source report: https://radar.cloudflare.com/scan/c0aaf970-f86c-4283-a1aa-a0a704edeefa
  SHA-256: c6813b330838f13120987fe1f63f0a760efb1f68beb40797db3223c05ce29065
- URLQuery: https://screenshots.phishdestroy.io/uq/36ad8d48-f733-4479-9153-dd9b166e3eec.png
  Source report: https://urlquery.net/report/36ad8d48-f733-4479-9153-dd9b166e3eec
  SHA-256: b09b21e42269da6fb116a1a84c1464cad1ce030e5230e9a6ec3327f0117fb0a3

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-24T22:57:23Z",
        "uuid": "01a17003-a9f4-70fa-8044-9d6457d5d77c",
        "scanned_at": "2026-10-24T22:24:19Z",
        "final_url": "https://booknookworld.shop/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://booknookworld.shop/",
                "from": "http://booknookworld.shop/",
                "status": 307
            }
        ],
        "ip": "23.252.79.102",
        "domains": [
            "www.official-booknook.co.uk",
            "fonts.gstatic.com",
            "fonts.googleapis.com"
        ],
        "ips": [
            "142.251.20.94",
            "192.178.183.95",
            "23.227.38.74",
            "23.252.79.102"
        ],
        "asns": [
            "15169",
            "13335",
            "199242"
        ],
        "countries": [
            "US",
            "CA",
            "GE"
        ],
        "doc_hash": "85e7ed953153f6e66849085cebec23afcbb42f4c2fc4e886b0c340c86baa5bd7",
        "script_hashes": [
            "be3abaf73302844027635dc12b56530ab053282192c916f09f24d15871e00704",
            "da1c9803523e7a18f5f93419f7dbf9cab702b5a78564eb9dc0e18c32e492ae4f",
            "56bef185cd5d43be7d55db75e9756858e8a4093525595194b8d3202210013efe",
            "2d9ed79eb6d7a824a49129543fe8712e46fdc8f048e145692492d81f589f33b5",
            "5790cd3ddf6d13150fad9403a3be5269f8bb5c8905966746bca6929477b611e0",
            "9de785ee19ccdf688f837e8bf8d2bbdb4c1dabc04b8ee7166bc1f4057226e49d",
            "91eb4c6e12d5d0f37080b53c6a8b513c579db4854839928eb478164ef6dc1d65",
            "acfed8ce931532ba4fbcdbc534468ab16b1e4ab08c8f8b9859558b9fbfc86d3e",
            "54674023c15e7c7d2c117eacd9399f7e7ff4a224093be6fbd07fba4480b882ba",
            "5594b2dc49c9ed560d32392288f138c9e3f4cccd2c8c71d305060cf653ce80c2"
        ],
        "globals": [
            "__next_f",
            "webpackChunk_N_E",
            "next",
            "_N_E_STYLE_LOAD",
            "Prism"
        ],
        "cookies": [
            "_jre_cid",
            "_jre_pv",
            "_jre_rg",
            "_jre_rid",
            "_site_domain"
        ],
        "storage_keys": [
            "analytics_session_id",
            "analytics_session_id_ts",
            "__analytics_utm__",
            "analytics_visitor_id"
        ],
        "tls": {
            "san": [
                "booknookworld.shop"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "YE1",
            "subject": "booknookworld.shop",
            "protocol": "TLS 1.3",
            "valid_to": "2026-12-22T01:39:17Z",
            "valid_from": "2026-09-23T01:39:18Z"
        },
        "domain_age_days": 151,
        "apex_age_days": 151,
        "tls_age_days": 31,
        "tls_valid_days": 89,
        "requests": 55,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 87,
                "malicious": true
            },
            "overall": {
                "tags": [
                    "phishing"
                ],
                "score": 100,
                "brands": [
                    "fakeshop"
                ],
                "malicious": true,
                "categories": [
                    "phishing"
                ]
            },
            "urlscan": {
                "tags": [
                    "phishing"
                ],
                "score": 100,
                "brands": [
                    "Fake Shop"
                ],
                "malicious": true,
                "categories": [
                    "phishing"
                ]
            }
        },
        "headers": {
            "content-type": "text/html; charset=utf-8",
            "x-frame-options": "SAMEORIGIN",
            "x-content-type-options": "nosniff",
            "referrer-policy": "strict-origin-when-cross-origin"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-24T22:57:26Z",
        "uuid": "c0aaf970-f86c-4283-a1aa-a0a704edeefa",
        "scanned_at": "2026-10-24T22:57:02Z",
        "final_url": "https://booknookworld.shop/",
        "status": 200,
        "history": [
            {
                "url": "https://booknookworld.shop/",
                "status": 200
            }
        ],
        "dom_hash": "257f556265cb2543015ee5146e7fd22609b8a2c195e855f9aeea439c8fc3dc78",
        "doc_hash": "0bf83f08ad56727a8c67b4b089fde099c18484dc63461031c29754de0f7b903b",
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "booknookworld.shop",
                "type": "A",
                "value": "23.252.79.102"
            }
        ],
        "dnssec_valid": false,
        "ip": "23.252.79.102"
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-24T22:56:41Z",
        "analysis_at": "2026-10-11T16:01:51Z",
        "stats": {
            "timeout": 0,
            "harmless": 55,
            "malicious": 0,
            "suspicious": 1,
            "undetected": 36
        },
        "detections": {
            "Gridinsoft": "suspicious"
        },
        "reputation": 0,
        "first_seen": "2026-05-26T15:57:57Z",
        "dns": [
            {
                "ttl": 1800,
                "type": "SOA",
                "rname": "dns.cloudflare.com",
                "value": "gabe.ns.cloudflare.com"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "gabe.ns.cloudflare.com"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "hazel.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "23.252.79.102"
            }
        ],
        "dns_at": "2026-10-11T17:02:40Z",
        "jarm": "40d40d40d00000000043d43d00043d6aff5ab0f4fc31897186312c9e639319",
        "cert": {
            "san": [
                "booknookworld.shop"
            ],
            "issuer": "Let's Encrypt / YE1",
            "serial": "5b3d35a85b50a568e961d12f30606cf777e",
            "sha256": "ee5d3d6f31f7e235985708e500ca6acb2a9ad0ab1638cef80503e6c68d5dc106",
            "subject": "booknookworld.shop",
            "valid_to": "2026-12-22T01:39:17Z",
            "valid_from": "2026-09-23T01:39:18Z"
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-24T22:58:25Z",
        "mail_config": {
            "spf_lookups": 0
        },
        "caa_records": {
            "domain": "booknookworld.shop"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_count": 0
        },
        "trackers": {
            "requests": 37,
            "trackers": [
                {
                    "name": "Google Fonts",
                    "company": "Google",
                    "country": "US",
                    "category": "Hosting",
                    "requests": 1
                },
                {
                    "name": "Google Static",
                    "company": "Google",
                    "country": "US",
                    "category": "Hosting",
                    "requests": 1
                }
            ]
        },
        "tls_connection": {
            "alpn": "h2",
            "cipher": "TLS_AES_128_GCM_SHA256",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                22,
                80,
                443,
                8000
            ]
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "172.64.34.157",
                    "host": "hazel.ns.cloudflare.com"
                },
                {
                    "ip": "172.64.33.114",
                    "host": "gabe.ns.cloudflare.com"
                }
            ],
            "zone": "booknookworld.shop"
        },
        "location": {
            "ip": "23.252.79.102",
            "asn": "199242",
            "org": "Malakmadze Web LLC",
            "country": "GE"
        },
        "ssl": {
            "issuer": "Let's Encrypt / YE1",
            "subject": "booknookworld.shop"
        },
        "dns": {
            "A": [
                "23.252.79.102"
            ],
            "NS": [
                "gabe.ns.cloudflare.com",
                "hazel.ns.cloudflare.com"
            ],
            "SOA": "{\"nsname\": \"gabe.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2415486322, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}"
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "get_ip": {
            "ip": "23.252.79.102",
            "family": 4
        }
    }
}
```