# PhishDestroy domain threat record: brishelf.shop Content language: English Canonical HTML report: https://phishdestroy.io/domain/brishelf.shop/ Machine-readable companion: https://phishdestroy.io/domain/brishelf.shop/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-10-23 14:27:45 UTC - Last availability or vendor check: 2026-10-23 14:39:29 UTC - Stored record updated: 2026-10-23 18:30:20 UTC - VirusTotal detections in the stored snapshot: 9/92 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: no stored flag ## Stored infrastructure - Observed IP address: 104.18.19.207 - Registrar in stored WHOIS data: Dynadot Inc. - Last stored HTTP status: 200 - Registration date in stored WHOIS data: 2026-10-06 12:00:39 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a16931-ee93-767d-a0d8-7d6b8f464bd5/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/brishelf.shop - Certificate Transparency search: https://crt.sh/?q=%25.brishelf.shop - Web Archive lookup: https://web.archive.org/web/*/https://brishelf.shop/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview PhishDestroy added brishelf.shop to its internal blocklist on 2026-10-23 after an automated URLScan scan returned a malicious verdict. An earlier AI assessment on the same day found insufficient page content to determine specific malicious behavior. The page fetched on 2026-10-23 presented the title “ALDI”. The domain was first seen by PhishDestroy on 2026-10-23. How the scam works The domain is flagged as phishing‑related, meaning it could be used to trick visitors into revealing credentials or personal data. No concrete credential‑harvesting form or other payload was observed on the captured page. Evidence URLScan captured on 2026-10-23 labeled the site malicious with a score of 100, categorising it as phishing and tagging it as a fake shop. VirusTotal analysis on 2026-10-23 reported 9 detections across 92 engines, including 6 malicious and 3 suspicious labels from vendors such as ESET, Kaspersky and Netcraft. Google Safe Browsing checked on 2026-10-23 did not flag the domain. OTX listed 5 pulses mentioning the domain on 2026-10-23, and external blocklists showed zero hits on that date. PhishDestroy’s internal blocklist marked the domain as malicious on 2026-10-23. Infrastructure The domain was registered on 2026-10-06 through Dynadot Inc., giving it an age of 16 days at the time of observation. The recorded IP address 104.18.19.207 belongs to Cloudflare, Inc. and resolves to Canada. TLS 1.3 was observed with a certificate issued by Google Trust Services, valid until 2027-01-06, and DNSSEC was not enabled. What to do Visitors should avoid entering any login credentials or personal information on the site; if they have already done so, they should change affected passwords and monitor accounts for suspicious activity. Defenders can block the exact domain name in web filters and review access logs for connections to 104.18.19.207. Continue to monitor security feeds for any updates on the domain’s status. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a16931-ee93-767d-a0d8-7d6b8f464bd5/ Cloudflare Radar report: https://radar.cloudflare.com/scan/2f1b8bc6-ee4f-4d07-b7a2-a7026be64e74 Stored capture screenshot: https://urlscan.io/screenshots/01a16931-ee93-767d-a0d8-7d6b8f464bd5.png Cloudflare Radar screenshot (2026-10-23T14:33:11Z): https://screenshots.phishdestroy.io/cf/2f1b8bc6-ee4f-4d07-b7a2-a7026be64e74.png URLScan screenshot (2026-10-10T19:45:55Z): https://screenshots.phishdestroy.io/us/01a12759-4ab8-755b-a3be-2432823dcd0e.png URLScan capture report: https://urlscan.io/result/01a12759-4ab8-755b-a3be-2432823dcd0e/ VirusTotal report: https://www.virustotal.com/gui/domain/brishelf.shop Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=brishelf.shop Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-23 17:20:43 UTC ## Stored page captures - Primary capture: https://urlscan.io/screenshots/01a16931-ee93-767d-a0d8-7d6b8f464bd5.png Captured: 2026-10-23 14:39:29 UTC - URLScan capture 1: https://screenshots.phishdestroy.io/01a16931-ee93-767d-a0d8-7d6b8f464bd5.png Captured: 2026-10-23 14:39:29 UTC Source report: https://urlscan.io/result/01a16931-ee93-767d-a0d8-7d6b8f464bd5/ - URLScan capture 2: https://urlscan.io/screenshots/01a12ab9-be71-7730-aade-9c7f64693982.png Captured: 2026-10-23 14:27:45 UTC Source report: https://urlscan.io/result/01a16931-ee93-767d-a0d8-7d6b8f464bd5/ - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/2f1b8bc6-ee4f-4d07-b7a2-a7026be64e74.png Captured: 2026-10-23 14:33:11 UTC Source report: https://radar.cloudflare.com/scan/2f1b8bc6-ee4f-4d07-b7a2-a7026be64e74 SHA-256: af68c6081fc2b762c301fb12a10f904fd343772224a7c67e792b4b6eed84ce09 - URLScan · 2026-10-10: https://screenshots.phishdestroy.io/us/01a12759-4ab8-755b-a3be-2432823dcd0e.png Captured: 2026-10-10 19:45:55 UTC Source report: https://urlscan.io/result/01a12759-4ab8-755b-a3be-2432823dcd0e/ SHA-256: 8b0e86ddd3c67a4c08b9dc37f5fa8ca556ba47002c5f4902b25ff02614e0f2e4 ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-23T14:41:55Z", "uuid": "01a16931-ee93-767d-a0d8-7d6b8f464bd5", "scanned_at": "2026-10-23T14:39:18Z", "final_url": "https://brishelf.shop/", "status": 200, "redirected": "https-only", "redirects": [ { "to": "https://brishelf.shop/", "from": "http://brishelf.shop/", "status": 307 } ], "ip": "104.18.19.207", "domains": [ "fonts.gstatic.com", "corahub.shop" ], "ips": [ "142.251.211.195", "104.18.19.207" ], "asns": [ "15169", "13335" ], "countries": [ "US" ], "link_domains": [ "www.facebook.com", "www.twitter.com", "www.pinterest.com" ], "social": [ "https://www.facebook.com", "https://www.twitter.com" ], "doc_hash": "a2305492ed2595ba79d453b68d717acad7a1aa1cdf48d7e3389559d3ddc18ba3", "script_hashes": [ "4787905a41f536ee3b29a27d9a98acc519c610fada07e0e803bd1a6fd26a4570", "2b69989521de63c7784bb1f38045e9912665312cc010cf68db4661834fdc6dd2", "97b3b4331eda57a049d1875b8085742967797770702e521c43d3dfb1b043144e", "2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8" ], "globals": [ "_brishelfshop_", "_DCAAG_", "themeConfig", "shop_theme", "storeConfig", "shop_config", "lang", "shop_lang", "C_SETTINGS", "_GET_C_SETTING_", "oemcart_client_browser", "oemcart_current_template", "oemcart_store_id", "oemcart_user_id", "oemcart_time_zone", "oemcart_page_ca", "oemcart_user_email", "oemcart_pv_id", "oemcart_data_from", "oemcart_user", "oemcart_currency", "oemcart_currency_code", "oemcart_currency_rate", "oemcart_currency_lcoin", "oemcart_currency_rcoin", "oemcart_currency_decimal", "oemcart_base_currency", "oemcart_base_currency_code", "oemcart_base_currency_rate", "oemcart_base_currency_lcoin", "oemcart_base_currency_rcoin", "oemcart_base_currency_decimal", "oemcart_website_domain", "oemcart_real_domain", "oemcart_site_type", "oemcart_client_country", "oemcart_protocal_type", "oemcart_website_language", "oemcart_utm_source", "oemcart_utm_medium" ], "cookies": [ "_bcgazz_vid", "_bcgazz_cvid", "_bcgazz_vs", "utm_source", "utm_medium", "order_utm_history", "landing_page", "_bcgazz_ka", "first_http_referer", "first_visit_time", "PHPSESSID", "__cf_bm", "_DCAAG_ua", "_DCAAG_pu", "_DCAAG_tz", "_DCAAG_ss", "_DCAAG_lang", "_DCAAG_vs", "_DCAAG_dt" ], "tls": { "san": [ "brishelf.shop" ], "cipher": "AES_128_GCM", "issuer": "WE1", "subject": "brishelf.shop", "protocol": "TLS 1.3", "valid_to": "2027-01-06T06:30:55Z", "valid_from": "2026-10-08T05:30:58Z" }, "domain_age_days": 16, "apex_age_days": 16, "tls_age_days": 15, "tls_valid_days": 90, "requests": 48, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 100, "malicious": true }, "overall": { "tags": [ "phishing" ], "score": 100, "brands": [ "fakeshop" ], "malicious": true, "categories": [ "phishing" ] }, "urlscan": { "tags": [ "phishing" ], "score": 100, "brands": [ "Fake Shop" ], "malicious": true, "categories": [ "phishing" ] } }, "headers": { "server": "cloudflare", "content-type": "text/html; charset=utf-8" } }, "cf": { "v": 1, "fetched_at": "2026-10-23T14:36:27Z", "uuid": "2f1b8bc6-ee4f-4d07-b7a2-a7026be64e74", "scanned_at": "2026-10-23T14:33:11Z", "final_url": "https://brishelf.shop/", "status": 200, "history": [ { "url": "https://brishelf.shop/", "status": 200 } ], "dom_hash": "6f5e5728d32108ec0efa19e4dacef9f56f6423a56e052284677f2e19c0a278ef", "doc_hash": "d92ec5f6986b09474346b73f758310955a5de0c725a17192edb48738ab6ff428", "phishing_v2": [ "phishing" ], "domain_risks": [ "Newly Seen Domains", "Security Risks", "New Domains", "Malware", "Security threats", "CIPA Filter", "CIPA" ], "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "brishelf.shop", "type": "A", "value": "104.18.19.207" } ], "dnssec_valid": false, "ip": "104.18.19.207", "verdict": { "tags": [ "malware" ], "malicious": true, "categories": [ "malware" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-23T17:16:43Z", "analysis_at": "2026-10-23T14:39:11Z", "stats": { "timeout": 0, "harmless": 49, "malicious": 6, "suspicious": 3, "undetected": 34 }, "detections": { "ESET": "suspicious", "G-Data": "phishing", "Sophos": "phishing", "Fortinet": "spam", "Netcraft": "malicious", "SOCRadar": "phishing", "Kaspersky": "phishing", "Gridinsoft": "suspicious", "Forcepoint ThreatSeeker": "phishing" }, "reputation": 0, "first_seen": "2026-10-06T16:38:37Z", "dns": [ { "ttl": 21600, "type": "NS", "value": "christina.ns.cloudflare.com" }, { "ttl": 300, "type": "A", "value": "104.18.19.207" }, { "ttl": 21600, "type": "NS", "value": "jerome.ns.cloudflare.com" }, { "ttl": 1800, "type": "SOA", "rname": "dns.cloudflare.com", "value": "christina.ns.cloudflare.com" } ], "dns_at": "2026-10-23T14:42:06Z", "jarm": "27d40d40d00040d00042d43d00041df04c41293ba84f6efe3a613b22f983e6", "cert": { "san": [ "brishelf.shop" ], "issuer": "Google Trust Services / WE1", "serial": "6a1f40c8c2bf3f6513af48b9b92455fd", "sha256": "9045db86598bc57aa86f526b04fc0ef2f8ad006a42e78df6c63b724f5171c702", "subject": "brishelf.shop", "valid_to": "2027-01-06T06:30:55Z", "valid_from": "2026-10-08T05:30:58Z" } }, "webcheck": { "v": 1, "fetched_at": "2026-10-23T14:36:48Z", "mail_config": { "spf_lookups": 0 }, "caa_records": { "domain": "brishelf.shop" }, "block_lists": { "resolvers": 12, "blocked_by": [ "CloudFlare Family" ], "blocked_count": 1 }, "archives": { "last": "2026-10-23T14:29:13Z", "first": "2026-10-23T14:29:13Z", "changes": 0, "days_archived": 1, "avg_page_bytes": 101236 }, "robots_txt": { "agents": [ "*" ], "present": true }, "social_tags": { "ogUrl": "https://brishelf.shop", "title": "ALDI", "ogType": "website", "ogTitle": "ALDI", "keywords": "ALDI", "ogSiteName": "ALDI", "description": "ALDI", "twitterCard": "summary_large_image", "twitterSite": "https://brishelf.shop", "canonicalUrl": "https://brishelf.shop", "ogDescription": "ALDI" }, "trackers": { "requests": 43, "trackers": [ { "name": "Google Static", "company": "Google", "country": "US", "category": "Hosting", "requests": 2 } ] }, "mixed_content": { "third_party_scripts": 0 }, "status": { "up": true, "code": 200, "timings": { "dns": 2, "tls": 26, "wait": 146, "connect": 6, "download": 21 }, "response_ms": 201 }, "tls_connection": { "alpn": "h2", "cipher": "TLS_AES_256_GCM_SHA384", "protocol": "TLSv1.3", "versions": [ "TLSv1.2", "TLSv1.3" ], "authorized": true, "forward_secrecy": true }, "ports": { "open": [ 80, 443, 8080 ] }, "carbon": { "bytes": 636825, "co2_grams": 0.0233, "cleaner_than": 1 }, "dns_server": { "ns": [ { "ip": "173.245.59.181", "host": "jerome.ns.cloudflare.com" }, { "ip": "172.64.34.193", "host": "christina.ns.cloudflare.com" } ], "zone": "brishelf.shop" }, "cookies": { "cookies": [ { "name": "_bcgazz_vid" }, { "name": "_bcgazz_cvid" }, { "name": "_bcgazz_vs" }, { "name": "utm_source" }, { "name": "utm_medium" }, { "name": "order_utm_history" }, { "name": "landing_page" }, { "name": "_bcgazz_ka" }, { "name": "first_http_referer" }, { "name": "first_visit_time" }, { "name": "PHPSESSID", "session": true }, { "name": "__cf_bm", "secure": true, "http_only": true, "same_site": "None" }, { "name": "_DCAAG_ua", "secure": true, "same_site": "None" }, { "name": "_DCAAG_pu", "secure": true, "same_site": "None" }, { "name": "_DCAAG_tz", "secure": true, "same_site": "None" }, { "name": "_DCAAG_ss", "secure": true, "same_site": "None" }, { "name": "_DCAAG_lang", "secure": true, "same_site": "None" }, { "name": "_DCAAG_vs", "secure": true, "same_site": "None" }, { "name": "_DCAAG_dt", "secure": true, "same_site": "None" }, { "name": "__cf_bm", "secure": true, "http_only": true, "same_site": "None" } ] }, "location": { "ip": "104.18.19.207", "asn": "13335", "org": "Cloudflare, Inc.", "city": "Toronto", "country": "CA" }, "ssl": { "issuer": "Google Trust Services / WE1", "subject": "brishelf.shop" }, "dns": { "A": [ "104.18.19.207" ], "NS": [ "jerome.ns.cloudflare.com", "christina.ns.cloudflare.com" ], "SOA": "{\"nsname\": \"christina.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2416926702, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}" }, "dnssec": { "ds": false, "rrsig": false, "dnskey": false }, "hsts": { "message": "Site does not serve any HSTS headers." }, "http_security": { "xFrameOptions": false, "referrerPolicy": false, "xXSSProtection": false, "permissionsPolicy": false, "xContentTypeOptions": false, "contentSecurityPolicy": false, "strictTransportPolicy": false, "crossOriginOpenerPolicy": false, "crossOriginEmbedderPolicy": false, "crossOriginResourcePolicy": false }, "firewall": { "waf": "Cloudflare", "has_waf": true }, "get_ip": { "ip": "104.18.19.207", "family": 4 }, "redirects": { "chain": [ "https://brishelf.shop" ] }, "subdomains": { "count": 1, "subdomains": [ "www.brishelf.shop" ] }, "linked_pages": { "external": [ "https://www.facebook.com/", "https://www.twitter.com/", "https://www.pinterest.com/" ], "external_count": 3, "internal_count": 67 }, "headers": { "headers": { "server": "cloudflare", "content-type": "text/html; charset=utf-8" } } } } ```