# PhishDestroy domain threat record: books2doorbooks.shop

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/books2doorbooks.shop/
Machine-readable companion: https://phishdestroy.io/domain/books2doorbooks.shop/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-24 22:47:20 UTC
- Last availability or vendor check: 2026-10-25 03:48:33 UTC
- Stored record updated: 2026-10-25 08:11:55 UTC
- VirusTotal detections in the stored snapshot: 5/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored infrastructure

- Observed IP address: 212.52.28.53
- Registrar in stored WHOIS data: Dynadot Inc.
- Last stored HTTP status: 200
- Registration date in stored WHOIS data: 2026-05-16 01:16:58 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a17018-04ff-773b-8d86-73bf2714c884/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/books2doorbooks.shop
- Certificate Transparency search: https://crt.sh/?q=%25.books2doorbooks.shop
- Web Archive lookup: https://web.archive.org/web/*/https://books2doorbooks.shop/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
PhishDestroy’s intake AI on 2026-10-24 classified books2doorbooks.shop as malicious because the site copies the Books2Door brand, uses its logo and product copy on a different domain, and advertises unrealistically high discounts together with generic reviews that do not match a book retailer. The recorded page title reads “More story time, less screen time | Books2Door” and the HTTP fetch on 2026-10-24 returned a 200 response. PhishDestroy first observed the domain on 2026-10-25.

How the scam works
Fake‑store impersonation typically presents a trusted brand’s visual identity and offers deep discounts to lure shoppers into entering payment or login details, which can then be harvested or used for fraudulent purchases. The operator relies on the brand’s reputation to gain trust while the underlying domain is unrelated to the legitimate business.

Evidence
VirusTotal scanned the domain on 2026-10-23 and returned five detections from 92 engines, labeling it as malware, malicious or phishing. Google Safe Browsing checked on 2026-10-25 and did not flag the site. No external blocklists listed the domain as of that date. urlscan.io captured the site on 2026-10-24, assigning a malicious score of 100 and categorising it as phishing and a fake shop.

Infrastructure
The domain was registered 161 days before the observation and used a Let’s Encrypt certificate issued on 2026-09-12 that was valid until 2026-12-11. The recorded DNS observation showed the domain pointing to IP 212.52.28.53, with the network name listed as Malakmadze Web LLC in the United States, and the domain was delegated to Cloudflare name servers at that time.

What to do
Visitors should avoid submitting any personal, payment or login information and delete any credentials that may have been entered; change passwords on other sites if reused. Defenders can block the domain at network perimeters and review logs for any connections to the recorded IP 212.52.28.53.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a17018-04ff-773b-8d86-73bf2714c884/
Cloudflare Radar report: https://radar.cloudflare.com/scan/47433390-e657-432f-8859-31c459f1c83b
Stored capture screenshot: https://i.ibb.co/gZ4x48qN/d3b662ec99f1.png
Cloudflare Radar screenshot (2026-10-24T22:48:11Z): https://screenshots.phishdestroy.io/cf/47433390-e657-432f-8859-31c459f1c83b.png
URLScan screenshot (2026-10-24T22:25:00Z): https://screenshots.phishdestroy.io/us/01a17004-21f1-75cf-a7a1-bdb9e685bdbf.png
URLScan capture report: https://urlscan.io/result/01a17004-21f1-75cf-a7a1-bdb9e685bdbf/
URLScan screenshot (2026-10-24T22:27:55Z): https://screenshots.phishdestroy.io/us/01a17006-dfec-74e0-8663-cc0a61c14795.png
URLScan capture report: https://urlscan.io/result/01a17006-dfec-74e0-8663-cc0a61c14795/
VirusTotal report: https://www.virustotal.com/gui/domain/books2doorbooks.shop
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=books2doorbooks.shop
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-24 22:49:19 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/gZ4x48qN/d3b662ec99f1.png
  Captured: 2026-10-24 22:47:20 UTC
- URLScan capture: https://screenshots.phishdestroy.io/01a17018-04ff-773b-8d86-73bf2714c884.png
  Captured: 2026-10-24 22:47:20 UTC
  Source report: https://urlscan.io/result/01a17018-04ff-773b-8d86-73bf2714c884/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/47433390-e657-432f-8859-31c459f1c83b.png
  Captured: 2026-10-24 22:48:11 UTC
  Source report: https://radar.cloudflare.com/scan/47433390-e657-432f-8859-31c459f1c83b
  SHA-256: d547c2d1654081b148d583579932e97bca48960448ee8751491b1bc84203a1be
- URLQuery: https://screenshots.phishdestroy.io/uq/6164008c-8de8-4256-9bd5-13db6bed905d.png
  Source report: https://urlquery.net/report/6164008c-8de8-4256-9bd5-13db6bed905d
  SHA-256: 0eb2896a8f829071db08a8508a9840bbcf9930f6f4b9a3973a8cfd8307d56103
- URLScan · 2026-10-24: https://screenshots.phishdestroy.io/us/01a17004-21f1-75cf-a7a1-bdb9e685bdbf.png
  Captured: 2026-10-24 22:25:00 UTC
  Source report: https://urlscan.io/result/01a17004-21f1-75cf-a7a1-bdb9e685bdbf/
  SHA-256: 3956763be76a72b4f7c745d975307b49854707d3d45eab8e4be5aa4fbf9d7ff5
- URLScan · 2026-10-24: https://screenshots.phishdestroy.io/us/01a17006-dfec-74e0-8663-cc0a61c14795.png
  Captured: 2026-10-24 22:27:55 UTC
  Source report: https://urlscan.io/result/01a17006-dfec-74e0-8663-cc0a61c14795/
  SHA-256: 3885fa8a32c16427cd92bb3999ea59ab2a9ec2a159c64ce9ac634437439173ea

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-24T22:48:32Z",
        "uuid": "01a17018-04ff-773b-8d86-73bf2714c884",
        "scanned_at": "2026-10-24T22:46:38Z",
        "final_url": "https://books2doorbooks.shop/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://books2doorbooks.shop/",
                "from": "http://books2doorbooks.shop/",
                "status": 307
            }
        ],
        "ip": "212.52.28.53",
        "domains": [
            "fonts.gstatic.com",
            "fonts.googleapis.com"
        ],
        "ips": [
            "173.194.45.94",
            "142.251.179.95",
            "212.52.28.53"
        ],
        "asns": [
            "15169",
            "199242"
        ],
        "countries": [
            "US"
        ],
        "doc_hash": "37cbfb6135142f33da452344925d75a8bb2b6e02f312c83913af44db8bd56d77",
        "script_hashes": [
            "6e917a13f6078d76a4ea30a45c1e5355c865a7d3d88b105056e5632ad838ed1d",
            "da1c9803523e7a18f5f93419f7dbf9cab702b5a78564eb9dc0e18c32e492ae4f",
            "56bef185cd5d43be7d55db75e9756858e8a4093525595194b8d3202210013efe",
            "2d9ed79eb6d7a824a49129543fe8712e46fdc8f048e145692492d81f589f33b5",
            "5790cd3ddf6d13150fad9403a3be5269f8bb5c8905966746bca6929477b611e0",
            "9de785ee19ccdf688f837e8bf8d2bbdb4c1dabc04b8ee7166bc1f4057226e49d",
            "91eb4c6e12d5d0f37080b53c6a8b513c579db4854839928eb478164ef6dc1d65",
            "acfed8ce931532ba4fbcdbc534468ab16b1e4ab08c8f8b9859558b9fbfc86d3e",
            "54674023c15e7c7d2c117eacd9399f7e7ff4a224093be6fbd07fba4480b882ba",
            "5594b2dc49c9ed560d32392288f138c9e3f4cccd2c8c71d305060cf653ce80c2"
        ],
        "globals": [
            "__next_f",
            "webpackChunk_N_E",
            "next",
            "_N_E_STYLE_LOAD",
            "Prism"
        ],
        "cookies": [
            "_lsz_cid",
            "_lsz_rg",
            "_lsz_rid",
            "_site_domain"
        ],
        "storage_keys": [
            "analytics_session_id",
            "analytics_session_id_ts",
            "__analytics_utm__",
            "analytics_visitor_id"
        ],
        "tls": {
            "san": [
                "books2doorbooks.shop"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "YE1",
            "subject": "books2doorbooks.shop",
            "protocol": "TLS 1.3",
            "valid_to": "2026-12-11T00:29:48Z",
            "valid_from": "2026-09-12T00:29:49Z"
        },
        "domain_age_days": 161,
        "apex_age_days": 161,
        "tls_age_days": 42,
        "tls_valid_days": 89,
        "requests": 52,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 94,
                "malicious": true
            },
            "overall": {
                "tags": [
                    "phishing"
                ],
                "score": 100,
                "brands": [
                    "fakeshop"
                ],
                "malicious": true,
                "categories": [
                    "phishing"
                ]
            },
            "urlscan": {
                "tags": [
                    "phishing"
                ],
                "score": 100,
                "brands": [
                    "Fake Shop"
                ],
                "malicious": true,
                "categories": [
                    "phishing"
                ]
            }
        },
        "headers": {
            "content-type": "text/html; charset=utf-8",
            "x-frame-options": "SAMEORIGIN",
            "x-content-type-options": "nosniff",
            "referrer-policy": "strict-origin-when-cross-origin"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-24T22:48:34Z",
        "uuid": "47433390-e657-432f-8859-31c459f1c83b",
        "scanned_at": "2026-10-24T22:48:11Z",
        "final_url": "https://books2doorbooks.shop/",
        "status": 200,
        "history": [
            {
                "url": "https://books2doorbooks.shop/",
                "status": 200
            }
        ],
        "dom_hash": "36d33efe8ecdd8b9f5d4874c87873a01ac6109e847e21d588874fb5b79a3d173",
        "doc_hash": "5e1eb2ff41474b7c8971073b3f0f9d434ba4a393af26afb8c2a26d0331ca4d67",
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "books2doorbooks.shop",
                "type": "A",
                "value": "212.52.28.53"
            }
        ],
        "dnssec_valid": false,
        "ip": "212.52.28.53"
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-24T22:47:56Z",
        "analysis_at": "2026-10-23T17:53:16Z",
        "stats": {
            "timeout": 0,
            "harmless": 52,
            "malicious": 3,
            "suspicious": 2,
            "undetected": 35
        },
        "detections": {
            "G-Data": "malware",
            "Netcraft": "malicious",
            "LevelBlue": "phishing",
            "Gridinsoft": "suspicious",
            "alphaMountain.ai": "suspicious"
        },
        "reputation": 0,
        "categories": {
            "alphaMountain.ai": "Suspicious (alphaMountain.ai)"
        },
        "first_seen": "2026-05-16T04:54:00Z",
        "dns": [
            {
                "ttl": 21600,
                "type": "NS",
                "value": "dax.ns.cloudflare.com"
            },
            {
                "ttl": 1800,
                "type": "SOA",
                "rname": "dns.cloudflare.com",
                "value": "dax.ns.cloudflare.com"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "magnolia.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "212.52.28.53"
            }
        ],
        "dns_at": "2026-10-23T17:53:36Z",
        "jarm": "40d40d40d00000000043d43d00043d6aff5ab0f4fc31897186312c9e639319",
        "cert": {
            "san": [
                "books2doorbooks.shop"
            ],
            "issuer": "Let's Encrypt / YE1",
            "serial": "6acd33f6faf6fb64ae99acf0e173dccb30c",
            "sha256": "6822a47fc9fc7bda13c21be05fb15eaee4a0df4beb7903cab55b3cd00b039b95",
            "subject": "books2doorbooks.shop",
            "valid_to": "2026-12-11T00:29:48Z",
            "valid_from": "2026-09-12T00:29:49Z"
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-24T22:48:52Z",
        "mail_config": {
            "spf_lookups": 0
        },
        "caa_records": {
            "domain": "books2doorbooks.shop"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_count": 0
        },
        "trackers": {
            "requests": 38,
            "trackers": [
                {
                    "name": "Google Fonts",
                    "company": "Google",
                    "country": "US",
                    "category": "Hosting",
                    "requests": 1
                },
                {
                    "name": "Google Static",
                    "company": "Google",
                    "country": "US",
                    "category": "Hosting",
                    "requests": 1
                }
            ]
        },
        "tls_connection": {
            "alpn": "h2",
            "cipher": "TLS_AES_128_GCM_SHA256",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                22,
                80,
                443
            ]
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "162.159.44.133",
                    "host": "dax.ns.cloudflare.com"
                },
                {
                    "ip": "108.162.194.214",
                    "host": "magnolia.ns.cloudflare.com"
                }
            ],
            "zone": "books2doorbooks.shop"
        },
        "location": {
            "ip": "212.52.28.53",
            "asn": "199242",
            "org": "Malakmadze Web LLC",
            "city": "Los Angeles",
            "country": "US"
        },
        "ssl": {
            "issuer": "Let's Encrypt / YE1",
            "subject": "books2doorbooks.shop"
        },
        "dns": {
            "A": [
                "212.52.28.53"
            ],
            "NS": [
                "magnolia.ns.cloudflare.com",
                "dax.ns.cloudflare.com"
            ],
            "SOA": "{\"nsname\": \"dax.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2416511780, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}"
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "get_ip": {
            "ip": "212.52.28.53",
            "family": 4
        }
    }
}
```