# PhishDestroy domain threat record: botticellifoodsdirect.shop Content language: English Canonical HTML report: https://phishdestroy.io/domain/botticellifoodsdirect.shop/ Machine-readable companion: https://phishdestroy.io/domain/botticellifoodsdirect.shop/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-10-27 06:20:07 UTC - Last availability or vendor check: 2026-10-28 00:30:16 UTC - Stored record updated: 2026-10-28 00:30:16 UTC - VirusTotal detections in the stored snapshot: 8/92 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: no stored flag ## Stored infrastructure - Observed IP address: 146.19.203.219 - Registrar in stored WHOIS data: Dynadot Inc. - Registration date in stored WHOIS data: 2026-05-13 03:23:37 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a17c03-1b12-700d-801d-af7a783c6fac/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/botticellifoodsdirect.shop - Certificate Transparency search: https://crt.sh/?q=%25.botticellifoodsdirect.shop - Web Archive lookup: https://web.archive.org/web/*/https://botticellifoodsdirect.shop/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview PhishDestroy added botticellifoodsdirect.shop to its internal blocklist on 2026-10-27 after intake flagged the domain because five VirusTotal vendors marked it malicious. The recorded page title reads "Botticelli Foods | Botticelli Foods". The site responded with a 307 redirect to HTTPS and returned HTTP 200 on the same day. No external blocklist listed the domain at the time of checking. How the scam works The domain is categorized as a phishing site, meaning it could be used to mimic a legitimate online shop to harvest login credentials or payment details. Such fake‑shop pages typically display a convincing storefront while silently collecting user data submitted through forms. Evidence VirusTotal reported eight detections on 2026-10-27, with five vendors (BitDefender, CRDF, CyRadar, G-Data, LevelBlue) labeling the domain malicious and three labeling it suspicious. Google Safe Browsing checked the domain on 2026-10-27 and did not flag it. urlscan captured the site on 2026-10-27, assigning a malicious score of 100 and categorising it as phishing under the "Fake Shop" brand. OTX listed three pulses referencing the domain, and PhishDestroy's internal list marked it as blocked while external blocklists returned zero hits. Infrastructure The recorded IP was 146.19.203.219 and the network was identified as Malakmadze Web LLC in Georgia. The domain was registered 167 days ago and uses a Let's Encrypt TLS certificate issued on 2026-09-09, valid until 2026-12-08. DNS is served by Cloudflare nameservers ariadne.ns.cloudflare.com and maciej.ns.cloudflare.com, with no DNSSEC signatures. Open ports observed were 22, 80, and 443. What to do Visitors should avoid entering any credentials or payment information on the site and, if they have already done so, change related passwords and monitor financial accounts for unauthorized activity. Network defenders should block the domain at the perimeter and review logs for any connections to the host. Continue to monitor security feeds for any new indicators related to this domain. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a17c03-1b12-700d-801d-af7a783c6fac/ Cloudflare Radar report: https://radar.cloudflare.com/scan/5f092a04-4555-4104-bca2-42a4aa846597 URLQuery report: https://urlquery.net/report/68e4b80f-f15a-471f-958d-8356602eba92 Stored capture screenshot: https://i.ibb.co/r2PDD1fv/381234de0dcc.png Cloudflare Radar screenshot (2026-10-27T06:21:50Z): https://screenshots.phishdestroy.io/cf/5f092a04-4555-4104-bca2-42a4aa846597.png URLQuery screenshot: https://screenshots.phishdestroy.io/uq/68e4b80f-f15a-471f-958d-8356602eba92.png VirusTotal report: https://www.virustotal.com/gui/domain/botticellifoodsdirect.shop Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=botticellifoodsdirect.shop Archived copy: https://web.archive.org/web/20261027062216/https://botticellifoodsdirect.shop/ Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-27 06:54:28 UTC ## Stored page captures - Primary capture: https://i.ibb.co/r2PDD1fv/381234de0dcc.png Captured: 2026-10-27 06:20:07 UTC - URLScan capture: https://screenshots.phishdestroy.io/01a17c03-1b12-700d-801d-af7a783c6fac.png Captured: 2026-10-27 06:20:07 UTC Source report: https://urlscan.io/result/01a17c03-1b12-700d-801d-af7a783c6fac/ - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/5f092a04-4555-4104-bca2-42a4aa846597.png Captured: 2026-10-27 06:21:50 UTC Source report: https://radar.cloudflare.com/scan/5f092a04-4555-4104-bca2-42a4aa846597 SHA-256: 0f843f2b1a88fbf514e2725c4c4dcaab7a1b3bd2c0f56d4a00fa55bd2ce74f2e - URLQuery: https://screenshots.phishdestroy.io/uq/68e4b80f-f15a-471f-958d-8356602eba92.png Source report: https://urlquery.net/report/68e4b80f-f15a-471f-958d-8356602eba92 SHA-256: 051b7a2337bb6f0c9c68c7bbb73564fb7424d45a73fff80aedc5719dcb696f77 ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-27T06:22:11Z", "uuid": "01a17c03-1b12-700d-801d-af7a783c6fac", "scanned_at": "2026-10-27T06:19:09Z", "final_url": "https://botticellifoodsdirect.shop/", "status": 200, "redirected": "https-only", "redirects": [ { "to": "https://botticellifoodsdirect.shop/", "from": "http://botticellifoodsdirect.shop/", "status": 307 } ], "ip": "146.19.203.219", "domains": [ "fonts.gstatic.com", "fonts.googleapis.com" ], "ips": [ "142.251.127.94", "142.251.127.95", "146.19.203.219" ], "asns": [ "15169", "199242" ], "countries": [ "US", "GE" ], "doc_hash": "8a53eb29fdf419840ce887e24df3f1312fe07dbee833f209a5eae6f0ddb2b794", "script_hashes": [ "6e917a13f6078d76a4ea30a45c1e5355c865a7d3d88b105056e5632ad838ed1d", "da1c9803523e7a18f5f93419f7dbf9cab702b5a78564eb9dc0e18c32e492ae4f", "56bef185cd5d43be7d55db75e9756858e8a4093525595194b8d3202210013efe", "2d9ed79eb6d7a824a49129543fe8712e46fdc8f048e145692492d81f589f33b5", "5790cd3ddf6d13150fad9403a3be5269f8bb5c8905966746bca6929477b611e0", "9de785ee19ccdf688f837e8bf8d2bbdb4c1dabc04b8ee7166bc1f4057226e49d", "91eb4c6e12d5d0f37080b53c6a8b513c579db4854839928eb478164ef6dc1d65", "acfed8ce931532ba4fbcdbc534468ab16b1e4ab08c8f8b9859558b9fbfc86d3e", "54674023c15e7c7d2c117eacd9399f7e7ff4a224093be6fbd07fba4480b882ba", "5594b2dc49c9ed560d32392288f138c9e3f4cccd2c8c71d305060cf653ce80c2" ], "globals": [ "__next_f", "webpackChunk_N_E", "next", "_N_E_STYLE_LOAD", "Prism" ], "cookies": [ "_3di_cid", "_3di_rg", "_3di_rid", "_site_domain" ], "storage_keys": [ "analytics_session_id", "analytics_session_id_ts", "__analytics_utm__", "analytics_visitor_id" ], "tls": { "san": [ "botticellifoodsdirect.shop" ], "cipher": "AES_128_GCM", "issuer": "YE1", "subject": "botticellifoodsdirect.shop", "protocol": "TLS 1.3", "valid_to": "2026-12-08T13:49:53Z", "valid_from": "2026-09-09T13:49:54Z" }, "domain_age_days": 167, "apex_age_days": 167, "tls_age_days": 47, "tls_valid_days": 89, "requests": 56, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 97, "malicious": true }, "overall": { "tags": [ "phishing" ], "score": 100, "brands": [ "fakeshop" ], "malicious": true, "categories": [ "phishing" ] }, "urlscan": { "tags": [ "phishing" ], "score": 100, "brands": [ "Fake Shop" ], "malicious": true, "categories": [ "phishing" ] } }, "headers": { "content-type": "text/html; charset=utf-8", "x-frame-options": "SAMEORIGIN", "x-content-type-options": "nosniff", "referrer-policy": "strict-origin-when-cross-origin" } }, "cf": { "v": 1, "fetched_at": "2026-10-27T06:24:40Z", "uuid": "5f092a04-4555-4104-bca2-42a4aa846597", "scanned_at": "2026-10-27T06:21:50Z", "final_url": "https://botticellifoodsdirect.shop/", "status": 200, "history": [ { "url": "https://botticellifoodsdirect.shop/", "status": 200 } ], "dom_hash": "2b4a0e40a6042e8097b15ac2709ce42e3ef6e5924dde4e6442b2ebbbdb62e9f3", "doc_hash": "7f8c7656edf6f80900d96ce0f7b277e6800411288c215cf4f918b7df1d5591f8", "domain_risks": [ "Food & Drink", "Society & Lifestyle", "Ecommerce", "Shopping & Auctions" ], "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "botticellifoodsdirect.shop", "type": "A", "value": "146.19.203.219" } ], "dnssec_valid": false, "ip": "146.19.203.219" }, "vt": { "v": 1, "fetched_at": "2026-10-27T06:51:53Z", "analysis_at": "2026-10-27T06:30:36Z", "stats": { "timeout": 0, "harmless": 49, "malicious": 5, "suspicious": 3, "undetected": 35 }, "detections": { "CRDF": "malicious", "ESET": "suspicious", "G-Data": "malware", "CyRadar": "phishing", "LevelBlue": "phishing", "Gridinsoft": "suspicious", "BitDefender": "phishing", "alphaMountain.ai": "suspicious" }, "reputation": 0, "first_seen": "2026-05-13T06:05:01Z", "dns": [ { "ttl": 300, "type": "A", "value": "146.19.203.219" }, { "ttl": 1800, "type": "SOA", "rname": "dns.cloudflare.com", "value": "ariadne.ns.cloudflare.com" }, { "ttl": 21600, "type": "NS", "value": "maciej.ns.cloudflare.com" }, { "ttl": 21600, "type": "NS", "value": "ariadne.ns.cloudflare.com" } ], "dns_at": "2026-10-27T06:37:03Z", "jarm": "40d40d40d00000000043d43d00043d6aff5ab0f4fc31897186312c9e639319", "cert": { "san": [ "botticellifoodsdirect.shop" ], "issuer": "Let's Encrypt / YE1", "serial": "6ad79de776ff6224dabe0ea8adef1939378", "sha256": "e18acaefc01f866b134f6939255df68c158df08473e87e95c15c32fe3f7e6da2", "subject": "botticellifoodsdirect.shop", "valid_to": "2026-12-08T13:49:53Z", "valid_from": "2026-09-09T13:49:54Z" } }, "webcheck": { "v": 1, "fetched_at": "2026-10-27T06:22:33Z", "mail_config": { "spf_lookups": 0 }, "caa_records": { "domain": "botticellifoodsdirect.shop" }, "block_lists": { "resolvers": 12, "blocked_count": 0 }, "archives": { "last": "2026-10-27T06:22:16Z", "first": "2026-10-27T06:22:16Z", "changes": 0, "days_archived": 1, "avg_page_bytes": 65265 }, "trackers": { "requests": 53, "trackers": [ { "name": "Google Fonts", "company": "Google", "country": "US", "category": "Hosting", "requests": 1 }, { "name": "Google Static", "company": "Google", "country": "US", "category": "Hosting", "requests": 1 } ] }, "tls_connection": { "alpn": "h2", "cipher": "TLS_AES_128_GCM_SHA256", "protocol": "TLSv1.3", "versions": [ "TLSv1.2", "TLSv1.3" ], "authorized": true, "forward_secrecy": true }, "ports": { "open": [ 22, 80, 443 ] }, "dns_server": { "ns": [ { "ip": "162.159.44.42", "host": "maciej.ns.cloudflare.com" }, { "ip": "162.159.38.225", "host": "ariadne.ns.cloudflare.com" } ], "zone": "botticellifoodsdirect.shop" }, "location": { "ip": "146.19.203.219", "asn": "199242", "org": "Malakmadze Web LLC", "country": "GE" }, "ssl": { "issuer": "Let's Encrypt / YE1", "subject": "botticellifoodsdirect.shop" }, "dns": { "A": [ "146.19.203.219" ], "NS": [ "ariadne.ns.cloudflare.com", "maciej.ns.cloudflare.com" ], "SOA": "{\"nsname\": \"ariadne.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2415356947, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}" }, "dnssec": { "ds": false, "rrsig": false, "dnskey": false }, "get_ip": { "ip": "146.19.203.219", "family": 4 } } } ```