# PhishDestroy domain threat record: bupagroup.org.uk Content language: English Canonical HTML report: https://phishdestroy.io/domain/bupagroup.org.uk/ Machine-readable companion: https://phishdestroy.io/domain/bupagroup.org.uk/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: not observed active - First observed by PhishDestroy: 2026-09-15 16:40:09 UTC - Last availability or vendor check: 2026-10-21 01:16:15 UTC - Stored record updated: 2026-10-22 14:21:24 UTC - VirusTotal detections in the stored snapshot: 4/89 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: no stored flag ## Stored infrastructure - Registrar in stored WHOIS data: Checkdomain GmbH - Registration date in stored WHOIS data: 2026-08-27 03:33:58 UTC ## Evidence links - VirusTotal domain view: https://www.virustotal.com/gui/domain/bupagroup.org.uk - Certificate Transparency search: https://crt.sh/?q=%25.bupagroup.org.uk - Web Archive lookup: https://web.archive.org/web/*/https://bupagroup.org.uk/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview bupagroup.org.uk is a short-lived .org.uk domain whose name reads like a corporate group address. It sits on the PhishDestroy blocklist. PhishDestroy first saw it on 2026-09-15, less than three weeks after registration. The domain has been offline since 2026-09-21, and as of 2026-10-19 its DNS no longer resolves, so the site cannot currently be reached. How the scam works There is no confirmed scheme type or captured page for this domain, so its exact lure is not established. Its shape is still a familiar risk. A freshly registered name styled as an official group domain can carry fake login portals, invoice or payment pages, or emails that pass as a real organisation's correspondence. Anyone who received a message, link or payment request using this name should treat it as untrustworthy, whatever it claimed to be. Evidence On 2026-09-23, VirusTotal showed 4 of 89 engines flagging the domain: alphaMountain.ai, CRDF, PhishFort and SOCRadar. That is a small share of engines, but PhishFort and SOCRadar specialise in phishing and brand-abuse monitoring, which gives their verdicts weight. The domain also appears in 3 AlienVault OTX threat pulses, so other researchers have tracked it independently. Among blocklists, it is listed by PhishDestroy only. Infrastructure The domain was registered on 2026-08-27 through Checkdomain GmbH. It was flagged 19 days later and went dark six days after that. That short lifespan, from registration to detection to disappearance within a month, fits a disposable domain rather than a long-running website. With DNS now inactive, the domain no longer resolves to any server. What to do If you entered a username and password on a page at this domain, change that password at once on the genuine service and anywhere you reused it, and turn on two-factor authentication. If you submitted card or bank details, contact your bank to block the card and dispute any unfamiliar charges. If you shared personal information, watch for follow-up phishing that cites it. Defenders should block the domain at DNS and mail gateways and search logs and inboxes for past contact with it. They should also monitor for lookalike registrations, since retired domains of this kind are often replaced quickly. Useful links VirusTotal report: https://www.virustotal.com/gui/domain/bupagroup.org.uk Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=bupagroup.org.uk Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-19 10:52:19 UTC ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "cf": { "v": 1, "fetched_at": "2026-10-20T22:30:06Z", "uuid": "3d3edcd3-13c1-4690-8952-510c68f444ac", "scanned_at": "2026-09-23T02:52:15Z" }, "vt": { "v": 1, "fetched_at": "2026-10-22T00:31:39Z", "analysis_at": "2026-10-15T09:14:58Z", "stats": { "timeout": 0, "harmless": 52, "malicious": 4, "suspicious": 0, "undetected": 36 }, "detections": { "CRDF": "malicious", "SOCRadar": "phishing", "alphaMountain.ai": "phishing", "Forcepoint ThreatSeeker": "phishing" }, "reputation": 0, "first_seen": "2026-09-15T09:31:10Z", "dns": [ { "ttl": 300, "type": "MX", "value": "mx03.secure-mailgate.com", "priority": 10 }, { "ttl": 300, "type": "SOA", "rname": "hostmaster.checkdomain.de", "value": "ns.checkdomain.de" }, { "ttl": 21600, "type": "NS", "value": "ns.checkdomain.de" }, { "ttl": 300, "type": "MX", "value": "mx04.secure-mailgate.com", "priority": 20 }, { "ttl": 180, "type": "TXT", "value": "v=spf1 include:secure-mailgate.com ?all" }, { "ttl": 21600, "type": "NS", "value": "ns2.checkdomain.de" }, { "ttl": 300, "type": "A", "value": "31.47.255.205" } ], "dns_at": "2026-09-15T17:13:17Z", "jarm": "29d29d00029d29d00042d42d0000002059a3b916699461c5923779b77cf06b", "cert": { "san": [ "*.checkdomain.de", "checkdomain.de" ], "issuer": "Sectigo Limited / Sectigo Public Server Authentication CA DV R36", "serial": "6cf3048748fae337bb1abf3eec371b16", "sha256": "8acb3af5836cf5bffb51e2eec8cf3d6afd2f3739526cbda05040a5ab37a347e0", "subject": "*.checkdomain.de", "valid_to": "2027-01-25T23:59:59Z", "valid_from": "2026-01-15T00:00:00Z" } } } ```