# PhishDestroy domain threat record: botik.dk

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/botik.dk/
Machine-readable companion: https://phishdestroy.io/domain/botik.dk/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-09-12 17:49:25 UTC
- Last availability or vendor check: 2026-10-22 10:26:21 UTC
- Stored record updated: 2026-10-22 16:07:29 UTC
- VirusTotal detections in the stored snapshot: 17/89
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored infrastructure

- Observed IP address: 92.204.53.215
- Registrar in stored WHOIS data: DANDOMAIN A/S
- Registrar country in stored WHOIS data: Unknown
- Last stored HTTP status: 200
- Registration date in stored WHOIS data: 2002-07-15 22:00:00 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a096bd-86cb-7763-a275-84927b25a90f/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/botik.dk
- Certificate Transparency search: https://crt.sh/?q=%25.botik.dk
- Web Archive lookup: https://web.archive.org/web/*/https://botik.dk/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
botik.dk is a Danish domain that PhishDestroy classifies as an impersonation phishing page, a site built to pass itself off as a legitimate service so visitors trust it with their details. PhishDestroy first flagged it on 2026-09-12. As of 2026-10-19 the site was still online with its content live, so anyone landing on it today can still be exposed.

How the scam works
Impersonation pages copy the look, wording and flow of a familiar brand, then ask visitors to log in, verify an account or confirm personal or payment information. Anything typed in goes straight to the operators, who reuse it to take over accounts, commit fraud or sell it on. The page carries only the generic title "Homepage" and does not name a brand, while our classification is impersonation phishing. That bland label gives a visitor no clear signal that something is wrong, so do not rely on the title to judge the site.

Evidence
On 2026-09-20, 17 of 89 VirusTotal engines flagged the domain as malicious, including ESET, BitDefender, Fortinet, Forcepoint ThreatSeeker, alphaMountain.ai, ADMINUSLabs, CyRadar and Chong Lua Dao. That spread of commercial and community vendors makes a single false positive unlikely. The domain also appears in six AlienVault OTX threat pulses, so other researchers have tracked it as well. It is listed on the PhishDestroy blocklist.

Infrastructure
The domain was registered on 2002-07-16 through DANDOMAIN A/S, more than two decades before it was flagged as phishing. A long registration history can make a domain look established and trustworthy, so its age should not be taken as a sign of safety here. The site is hosted in France on the velia.net Internetdienste GmbH network. It uses a free Let's Encrypt certificate, so the browser padlock only means the connection is encrypted and says nothing about whether the site is honest.

What to do
If you entered a password on botik.dk, change it immediately on the real service and on every other account that uses the same password, then turn on two-factor authentication. If you submitted card or bank details, contact your bank to block the card and dispute any charges. Watch for follow-up emails or calls that refer to your submission, because stolen details are often reused in targeted scams. Defenders should block the domain at DNS, proxy and email gateways, search logs for past visits or form submissions to it, and reset credentials for any affected users.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a096bd-86cb-7763-a275-84927b25a90f/
VirusTotal report: https://www.virustotal.com/gui/domain/botik.dk
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=botik.dk
Archived copy: https://web.archive.org/web/20260912175417/https://botik.dk/
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 09:43:49 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/GvYwXP9n/449402191a96.png
  Captured: 2026-09-12 17:51:18 UTC
- URLScan capture 1: https://screenshots.phishdestroy.io/01a096bd-86cb-7763-a275-84927b25a90f.png
  Captured: 2026-09-12 17:51:18 UTC
  Source report: https://urlscan.io/result/01a096bd-86cb-7763-a275-84927b25a90f/
- URLScan capture 2: https://urlscan.io/screenshots/0199c04b-326b-765e-9678-dbe565a67b14.png
  Captured: 2026-09-12 17:49:25 UTC
  Source report: https://urlscan.io/result/01a096bd-86cb-7763-a275-84927b25a90f/
- URLQuery: https://screenshots.phishdestroy.io/uq/0a6f2c41-8f28-469d-9d84-a21c74242f47.png
  Captured: 2026-09-12 17:52:55 UTC
  Source report: https://urlquery.net/report/0a6f2c41-8f28-469d-9d84-a21c74242f47
  SHA-256: 36aa139f882c6d863ccd719d5bac500d3abbe68b8393b70de1a674a59a083db1
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/c7efc944-4720-4b74-8fcb-f340dd305f20.png
  Captured: 2026-09-12 17:52:23 UTC
  Source report: https://radar.cloudflare.com/scan/c7efc944-4720-4b74-8fcb-f340dd305f20
  SHA-256: c0c95bfd0b2312ce860b20381b3d1dc89a4178d7a2887e166da618ebed29679e

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-21T00:18:16Z",
        "uuid": "01a096bd-86cb-7763-a275-84927b25a90f",
        "scanned_at": "2026-09-12T17:50:05Z",
        "final_url": "https://botik.dk/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://botik.dk/",
                "from": "http://botik.dk/",
                "status": 307
            },
            {
                "to": "http://botik.dk/",
                "from": "https://botik.dk/",
                "status": 307
            },
            {
                "to": "https://botik.dk/",
                "from": "http://botik.dk/",
                "status": 301
            }
        ],
        "ip": "92.204.53.215",
        "ptr": "astra7216.startdedicated.net",
        "domains": [
            "a.tile.openstreetmap.org",
            "cartodb-basemaps-a.global.ssl.fastly.net",
            "b.tile.openstreetmap.org",
            "c.tile.openstreetmap.org",
            "cartodb-basemaps-c.global.ssl.fastly.net",
            "cartodb-basemaps-b.global.ssl.fastly.net",
            "unpkg.com",
            "ssl.google-analytics.com",
            "fonts.gstatic.com",
            "www.googletagmanager.com",
            "fonts.googleapis.com"
        ],
        "ips": [
            "151.101.65.194",
            "151.101.129.194",
            "151.101.1.91",
            "151.101.129.91",
            "151.101.65.91",
            "142.251.13.94",
            "142.250.154.97",
            "142.251.20.97",
            "104.18.0.22",
            "142.251.14.95",
            "92.204.53.215"
        ],
        "asns": [
            "54113",
            "15169",
            "13335",
            "29066"
        ],
        "countries": [
            "US",
            "FR"
        ],
        "link_domains": [
            "www.facebook.com",
            "twitter.com",
            "www.linkedin.com",
            "leafletjs.com",
            "www.openstreetmap.org",
            "iwinter.com.hr"
        ],
        "social": [
            "https://www.facebook.com/share.php",
            "https://twitter.com/home"
        ],
        "doc_hash": "d148d0ea1c0125bbbb78c05827fb002bd3bf8d06ba7cd10ec10ab119d9024e99",
        "script_hashes": [
            "2f6477d94bc3b44fbf22260bc663a564dabe23153363b377390220403fca1398",
            "e21b4e6cfeb9d32662b93d78fdbc0363da82f9777d86ef2e6c30fb9fb41828d6"
        ],
        "globals": [
            "L",
            "Leaflet",
            "$",
            "jQuery",
            "noUiSlider",
            "_gaq",
            "dataLayer",
            "support_history_api",
            "custom_number_format",
            "format_number_message",
            "scale_range",
            "ShowStatus",
            "DPGlobal",
            "Tether",
            "blueimp",
            "FooTable",
            "loadImage",
            "cleditor",
            "moment",
            "worldMapTime",
            "html5",
            "Modernizr",
            "yepnope",
            "firstSet",
            "mapRefresh",
            "loadOnTab",
            "zoomOnMapSearch",
            "clusterConfig",
            "markerOptions",
            "mapDisableAutoPan",
            "mapStyle",
            "rent_inc_id",
            "scrollWheelEnabled",
            "myLocationEnabled",
            "rectangleSearchEnabled",
            "mapSearchbox",
            "selectorResults",
            "markers",
            "map",
            "clusters"
        ],
        "cookies": [
            "cisession",
            "__utma",
            "__utmc",
            "__utmz",
            "__utmt",
            "__utmb"
        ],
        "tls": {
            "san": [
                "botik.dk",
                "www.botik.dk"
            ],
            "cipher": "AES_256_GCM",
            "issuer": "YR2",
            "subject": "botik.dk",
            "protocol": "TLS 1.2",
            "valid_to": "2026-10-25T05:11:49Z",
            "valid_from": "2026-07-27T05:11:50Z"
        },
        "domain_age_days": 1731,
        "apex_age_days": 1731,
        "tls_age_days": 47,
        "tls_valid_days": 89,
        "requests": 160,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 56,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "Microsoft-IIS/10.0",
            "content-type": "text/html; charset=UTF-8",
            "x-powered-by": "ASP.NET"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-21T02:31:31Z",
        "uuid": "c7efc944-4720-4b74-8fcb-f340dd305f20",
        "scanned_at": "2026-09-12T17:52:23Z",
        "final_url": "https://botik.dk/",
        "status": 200,
        "history": [
            {
                "url": "https://botik.dk/",
                "status": 200
            }
        ],
        "dom_hash": "083f0a1a7e03b3c2b03322a9ee0c4511c838ca48a887bc55b39463eb95df083a",
        "doc_hash": "d148d0ea1c0125bbbb78c05827fb002bd3bf8d06ba7cd10ec10ab119d9024e99",
        "domain_risks": [
            "Forums",
            "Internet Communication"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "botik.dk",
                "type": "A",
                "value": "92.204.53.215"
            }
        ],
        "dnssec_valid": true,
        "ip": "92.204.53.215",
        "whois": {
            "registrar": "DANDOMAIN A/S",
            "created": "2002-07-16T00:00:00Z",
            "expires": "2026-09-30T00:00:00Z",
            "nameservers": [
                "ns.dandomain.dk",
                "ns2.dandomain.dk"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-22T16:20:04Z",
        "analysis_at": "2026-10-21T09:02:40Z",
        "stats": {
            "timeout": 0,
            "harmless": 47,
            "malicious": 14,
            "suspicious": 0,
            "undetected": 31
        },
        "detections": {
            "ESET": "phishing",
            "VIPRE": "malware",
            "G-Data": "phishing",
            "Lionic": "phishing",
            "Sophos": "phishing",
            "Webroot": "malicious",
            "Fortinet": "phishing",
            "SOCRadar": "phishing",
            "Gridinsoft": "phishing",
            "SafeToOpen": "phishing",
            "ADMINUSLabs": "malicious",
            "BitDefender": "phishing",
            "alphaMountain.ai": "phishing",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "categories": {
            "alphaMountain.ai": "Phishing (alphaMountain.ai)"
        },
        "popularity": {
            "Cloudflare Radar": 1000000
        },
        "registrar": "DANDOMAIN A/S",
        "expires": "2026-09-30T00:00:00Z",
        "first_seen": "2023-10-05T23:19:29Z",
        "dns": [
            {
                "ttl": 100,
                "type": "A",
                "value": "92.204.53.215"
            },
            {
                "ttl": 3600,
                "type": "TXT",
                "value": "google-site-verification=hQZmD-NMXl_CHcuvzurkbPaOdyuVIZnLvOZXYUSGqeo"
            },
            {
                "ttl": 3600,
                "type": "MX",
                "value": "mx2.dandomain.dk",
                "priority": 20
            },
            {
                "ttl": 3600,
                "type": "TXT",
                "value": "v=spf1 include:spf.dandomain.dk ~all"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "ns.dandomain.dk"
            },
            {
                "ttl": 3600,
                "type": "MX",
                "value": "mx1.dandomain.dk",
                "priority": 10
            },
            {
                "ttl": 3600,
                "type": "SOA",
                "rname": "hostmaster.dandomain.dk",
                "value": "ns.dandomain.dk"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "ns2.dandomain.dk"
            }
        ],
        "dns_at": "2026-10-21T09:11:21Z",
        "jarm": "2ad2ad16d00000022c2ad2ad2ad2adc08b3be7d1a4f5f4d1fd42f049726e8a",
        "cert": {
            "san": [
                "botik.dk",
                "www.botik.dk"
            ],
            "issuer": "Let's Encrypt / YR2",
            "serial": "65d031eec5a51a878c962db003353f7e299",
            "sha256": "dd036fec233be9a2651fdc7040879dabdb7d7b0f56280d059ff7dc4869ca55f9",
            "subject": "botik.dk",
            "valid_to": "2027-01-06T13:11:48Z",
            "valid_from": "2026-10-08T13:11:49Z"
        },
        "whois": {
            "registrar": "DANDOMAIN A/S",
            "dnssec": "Signed delegation"
        }
    }
}
```