# PhishDestroy domain threat record: devipsale.com

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/devipsale.com/
Machine-readable companion: https://phishdestroy.io/domain/devipsale.com/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-25 06:20:28 UTC
- Last availability or vendor check: 2026-10-25 06:34:55 UTC
- Stored record updated: 2026-10-25 11:10:41 UTC
- VirusTotal detections in the stored snapshot: 17/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: flagged

## Stored classification

- Targeted brand: Orca

## Stored infrastructure

- Observed IP address: 34.160.145.2
- Registrar in stored WHOIS data: Spaceship, Inc.
- Last stored HTTP status: 200
- Registration date in stored WHOIS data: 2026-09-24 12:14:29 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a171c3-6c4c-7669-bbd4-f115f18b061e/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/devipsale.com
- Certificate Transparency search: https://crt.sh/?q=%25.devipsale.com
- Web Archive lookup: https://web.archive.org/web/*/https://devipsale.com/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
PhishDestroy listed devipsale.com as a suspicious domain because Google Safe Browsing flagged it for social engineering. The page fetched on 2026-10-25 returned HTTP 200 with a title showing “500 Internal Server Error”. The domain first appeared in PhishDestroy’s records on 2026-10-25.

How the scam works
The detections point to a generic phishing or social‑engineering risk, where an attacker may try to trick visitors into revealing credentials, personal data, or clicking malicious links. No specific credential‑harvesting form or wallet‑draining code was observed on the captured page, so the exact tactic remains undefined.

Evidence
VirusTotal recorded 17 detections (14 malicious, 3 suspicious) from 92 engines on 2026-10-25, including BitDefender, Fortinet, G‑Data and others labeling the domain as phishing. Google Safe Browsing flagged the domain for social engineering on the same date. URLScan’s analysis on 2026-09-30 and 2026-10-25 gave a malicious verdict with a 100‑point score, categorising it as phishing and a fake shop. OTX listed four pulses mentioning the domain. PhishDestroy’s internal blocklist marks it as blocked, while external blocklists returned zero hits. Spamhaus DBL did not list the domain. Cloudflare Radar also returned a malicious verdict, tagging it as malware.

Infrastructure
The recorded DNS A record pointed to 34.160.145.2 and the domain used the Cloudflare nameservers algin.ns.cloudflare.com and elinore.ns.cloudflare.com. The domain was registered with Spaceship, Inc. on 2026-09-24, giving it a 30‑day age at the time of observation. TLS was provided by Google Trust Services, valid from 2026-09-24 to 2026-12-23, and the IP belongs to ASN 396982 (Google LLC).

What to do
Visitors should avoid entering any credentials or personal information on the site and, if they have already done so, change affected passwords and monitor accounts for suspicious activity. Defenders should block devipsale.com at network perimeters, add the domain to threat‑intel feeds, and review logs for any connections to 34.160.145.2 or the associated Cloudflare nameservers.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a171c3-6c4c-7669-bbd4-f115f18b061e/
Cloudflare Radar report: https://radar.cloudflare.com/scan/9ffe9765-ac17-4ce7-8d97-e64098cdc026
URLQuery report: https://urlquery.net/report/e97692f8-e55b-4a1c-9627-b6dbd73f3a9e
Stored capture screenshot: https://i.ibb.co/606gks7v/ed9330f4b97f.png
Cloudflare Radar screenshot (2026-10-25T06:23:34Z): https://screenshots.phishdestroy.io/cf/9ffe9765-ac17-4ce7-8d97-e64098cdc026.png
URLQuery screenshot: https://screenshots.phishdestroy.io/uq/e97692f8-e55b-4a1c-9627-b6dbd73f3a9e.png
URLScan screenshot (2026-09-29T10:45:20Z): https://screenshots.phishdestroy.io/us/01a0ecc4-c7d9-700e-9996-25210d9aa9d8.png
URLScan capture report: https://urlscan.io/result/01a0ecc4-c7d9-700e-9996-25210d9aa9d8/
URLScan screenshot (2026-09-29T10:51:19Z): https://screenshots.phishdestroy.io/us/01a0ecca-3fa7-733b-b095-6da48a2d2917.png
URLScan capture report: https://urlscan.io/result/01a0ecca-3fa7-733b-b095-6da48a2d2917/
URLScan screenshot (2026-09-29T11:29:19Z): https://screenshots.phishdestroy.io/us/01a0eced-0a81-7665-99c3-01ee809a0193.png
URLScan capture report: https://urlscan.io/result/01a0eced-0a81-7665-99c3-01ee809a0193/
URLScan screenshot (2026-09-30T12:02:02Z): https://screenshots.phishdestroy.io/us/01a0f231-5ace-745d-9f1a-df05f25ea983.png
URLScan capture report: https://urlscan.io/result/01a0f231-5ace-745d-9f1a-df05f25ea983/
VirusTotal report: https://www.virustotal.com/gui/domain/devipsale.com
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=devipsale.com
Archived copy: https://web.archive.org/web/20261025062220/https://devipsale.com/
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-25 07:35:23 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/606gks7v/ed9330f4b97f.png
  Captured: 2026-10-25 06:34:55 UTC
- URLScan capture 1: https://urlscan.io/screenshots/01a171c3-6c4c-7669-bbd4-f115f18b061e.png
  Captured: 2026-10-25 06:34:55 UTC
  Source report: https://urlscan.io/result/01a171c3-6c4c-7669-bbd4-f115f18b061e/
- URLScan capture 2: https://screenshots.phishdestroy.io/01a0f231-5ace-745d-9f1a-df05f25ea983.png
  Captured: 2026-10-25 06:20:28 UTC
  Source report: https://urlscan.io/result/01a171c3-6c4c-7669-bbd4-f115f18b061e/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/9ffe9765-ac17-4ce7-8d97-e64098cdc026.png
  Captured: 2026-10-25 06:23:34 UTC
  Source report: https://radar.cloudflare.com/scan/9ffe9765-ac17-4ce7-8d97-e64098cdc026
  SHA-256: 4446fc8449ad7a7204007921519c3745012374c5b33e0c8a1b52dd394d2cb0c9
- URLQuery: https://screenshots.phishdestroy.io/uq/e97692f8-e55b-4a1c-9627-b6dbd73f3a9e.png
  Source report: https://urlquery.net/report/e97692f8-e55b-4a1c-9627-b6dbd73f3a9e
  SHA-256: 420926f9355708ed99a108c90632df0df6779b74700ae72003b3368cac0dfa67
- URLScan · 2026-09-29: https://screenshots.phishdestroy.io/us/01a0ecc4-c7d9-700e-9996-25210d9aa9d8.png
  Captured: 2026-09-29 10:45:20 UTC
  Source report: https://urlscan.io/result/01a0ecc4-c7d9-700e-9996-25210d9aa9d8/
  SHA-256: f98f6407bcc29292846b94a5988659e60e3b2d5d5339772d4c82f8faa5909132
- URLScan · 2026-09-29: https://screenshots.phishdestroy.io/us/01a0ecca-3fa7-733b-b095-6da48a2d2917.png
  Captured: 2026-09-29 10:51:19 UTC
  Source report: https://urlscan.io/result/01a0ecca-3fa7-733b-b095-6da48a2d2917/
  SHA-256: 2bf6a81efbbd0e838b5f4a4bcc2a54d068b2ab4dcbadda671ef1b05743cb9abf
- URLScan · 2026-09-29: https://screenshots.phishdestroy.io/us/01a0eced-0a81-7665-99c3-01ee809a0193.png
  Captured: 2026-09-29 11:29:19 UTC
  Source report: https://urlscan.io/result/01a0eced-0a81-7665-99c3-01ee809a0193/
  SHA-256: f98f6407bcc29292846b94a5988659e60e3b2d5d5339772d4c82f8faa5909132
- URLScan · 2026-09-30: https://screenshots.phishdestroy.io/us/01a0f231-5ace-745d-9f1a-df05f25ea983.png
  Captured: 2026-09-30 12:02:02 UTC
  Source report: https://urlscan.io/result/01a0f231-5ace-745d-9f1a-df05f25ea983/
  SHA-256: 2bf6a81efbbd0e838b5f4a4bcc2a54d068b2ab4dcbadda671ef1b05743cb9abf

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-25T06:53:41Z",
        "uuid": "01a171c3-6c4c-7669-bbd4-f115f18b061e",
        "scanned_at": "2026-10-25T06:33:22Z",
        "final_url": "https://devipsale.com/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://devipsale.com/",
                "from": "http://devipsale.com/",
                "status": 307
            }
        ],
        "ip": "34.160.145.2",
        "ptr": "2.145.160.34.bc.googleusercontent.com",
        "domains": [
            "fonts.gstatic.com"
        ],
        "ips": [
            "142.251.20.94",
            "34.160.145.2"
        ],
        "asns": [
            "15169",
            "396982"
        ],
        "countries": [
            "US"
        ],
        "doc_hash": "33fadf02d1a3e75f80608fdb4f7f52c6a85a3c2032f203a91596cd3c34922c04",
        "script_hashes": [
            "749fc96cb07b13141550e29be8f92aa34aac2d030310d8ffd53650c840f917a7",
            "a62af29258561126c7c2449bdd589c0957fa816724f6698eac471bf24b5f5034",
            "9cb40cc24dd24b49dbadc70d4864265d97012727e68f8455fa1bcfd5920920bf",
            "b3f765e90760aff4067c6e5af670e525e9f80c2509f9abaa6d86fd771f4cccb6",
            "80aee297b48f36ae4e1dd311da2000f882cef2d1d56c75f58d84607cf73365a1",
            "29a17a048536ed2057070a6e9ca51afcb97e53cbe63a27d48688d2fbbc26aa2f"
        ],
        "globals": [
            "_devipsalecom_",
            "_BBDIIGD_",
            "themeConfig",
            "shop_theme",
            "storeConfig",
            "shop_config",
            "lang",
            "shop_lang",
            "C_SETTINGS",
            "_GET_C_SETTING_",
            "oemcart_client_browser",
            "oemcart_current_template",
            "oemcart_store_id",
            "oemcart_user_id",
            "oemcart_time_zone",
            "oemcart_page_ca",
            "oemcart_user_email",
            "oemcart_pv_id",
            "oemcart_data_from",
            "oemcart_user",
            "oemcart_currency",
            "oemcart_currency_code",
            "oemcart_currency_rate",
            "oemcart_currency_lcoin",
            "oemcart_currency_rcoin",
            "oemcart_currency_decimal",
            "oemcart_base_currency",
            "oemcart_base_currency_code",
            "oemcart_base_currency_rate",
            "oemcart_base_currency_lcoin",
            "oemcart_base_currency_rcoin",
            "oemcart_base_currency_decimal",
            "oemcart_website_domain",
            "oemcart_real_domain",
            "oemcart_site_type",
            "oemcart_client_country",
            "oemcart_protocal_type",
            "oemcart_website_language",
            "oemcart_utm_source",
            "oemcart_utm_medium"
        ],
        "cookies": [
            "_bbgizh_vid",
            "_bbgizh_cvid",
            "_bbgizh_vs",
            "utm_source",
            "utm_medium",
            "order_utm_history",
            "landing_page",
            "_bbgizh_ka",
            "first_http_referer",
            "first_visit_time",
            "PHPSESSID",
            "_BBDIIGD_ua",
            "_BBDIIGD_pu",
            "_BBDIIGD_tz",
            "_BBDIIGD_ss",
            "_BBDIIGD_lang",
            "_BBDIIGD_vs",
            "_BBDIIGD_dt"
        ],
        "tls": {
            "san": [
                "devipsale.com"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "WR3",
            "subject": "devipsale.com",
            "protocol": "TLS 1.3",
            "valid_to": "2026-12-23T19:38:02Z",
            "valid_from": "2026-09-24T18:45:29Z"
        },
        "domain_age_days": 30,
        "apex_age_days": 30,
        "tls_age_days": 30,
        "tls_valid_days": 90,
        "requests": 39,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 100,
                "malicious": true
            },
            "overall": {
                "tags": [
                    "phishing"
                ],
                "score": 100,
                "brands": [
                    "fakeshop"
                ],
                "malicious": true,
                "categories": [
                    "phishing"
                ]
            },
            "urlscan": {
                "tags": [
                    "phishing"
                ],
                "score": 100,
                "brands": [
                    "Fake Shop"
                ],
                "malicious": true,
                "categories": [
                    "phishing"
                ]
            }
        },
        "headers": {
            "server": "nginx",
            "content-type": "text/html; charset=utf-8"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-25T06:25:41Z",
        "uuid": "9ffe9765-ac17-4ce7-8d97-e64098cdc026",
        "scanned_at": "2026-10-25T06:23:34Z",
        "final_url": "https://devipsale.com/",
        "status": 200,
        "history": [
            {
                "url": "https://devipsale.com/",
                "status": 200
            }
        ],
        "dom_hash": "f2a939cf332d0227b358e7a897d2bfc650735a612713a114b5b5d7d77c2f9695",
        "doc_hash": "e41b38a98fd6f52c3b61fa0654a2e63e75de47e98450f9e348cf166f201ccf0a",
        "phishing_v2": [
            "phishing"
        ],
        "domain_risks": [
            "Malware",
            "Security threats",
            "CIPA Filter",
            "CIPA"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "devipsale.com",
                "type": "A",
                "value": "34.160.145.2"
            }
        ],
        "dnssec_valid": false,
        "ip": "34.160.145.2",
        "verdict": {
            "tags": [
                "malware"
            ],
            "malicious": true,
            "categories": [
                "malware"
            ]
        },
        "whois": {
            "registrar": "Spaceship, Inc.",
            "created": "2026-09-24T14:14:29Z",
            "updated": "2026-09-24T14:17:24Z",
            "expires": "2027-09-24T14:14:29Z",
            "nameservers": [
                "algin.ns.cloudflare.com",
                "elinore.ns.cloudflare.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-25T07:32:58Z",
        "analysis_at": "2026-10-19T14:44:43Z",
        "stats": {
            "timeout": 0,
            "harmless": 43,
            "malicious": 14,
            "suspicious": 3,
            "undetected": 32
        },
        "detections": {
            "CRDF": "malicious",
            "DNS8": "suspicious",
            "ESET": "suspicious",
            "VIPRE": "phishing",
            "G-Data": "phishing",
            "Lionic": "phishing",
            "Sophos": "malware",
            "Fortinet": "phishing",
            "Netcraft": "malicious",
            "SOCRadar": "phishing",
            "Kaspersky": "phishing",
            "Seclookup": "malicious",
            "Gridinsoft": "suspicious",
            "BitDefender": "phishing",
            "alphaMountain.ai": "phishing",
            "Google Safe Browsing": "phishing",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "categories": {
            "alphaMountain.ai": "Phishing (alphaMountain.ai)"
        },
        "registrar": "Spaceship, Inc.",
        "created": "2026-09-24T14:14:29Z",
        "expires": "2027-09-24T14:14:29Z",
        "updated": "2026-09-24T14:17:24Z",
        "first_seen": "2026-09-24T15:32:30Z",
        "dns": [
            {
                "ttl": 21600,
                "type": "NS",
                "value": "elinore.ns.cloudflare.com"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "algin.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "34.160.145.2"
            },
            {
                "ttl": 1800,
                "type": "SOA",
                "rname": "dns.cloudflare.com",
                "value": "algin.ns.cloudflare.com"
            }
        ],
        "dns_at": "2026-10-19T14:49:57Z",
        "jarm": "29d3fd00029d29d00042d43d00041d6f940079659edb62e1c38c38bd26ee84",
        "cert": {
            "san": [
                "devipsale.com"
            ],
            "issuer": "Google Trust Services / WR3",
            "serial": "ef25b81810e1ccb21067a640f89264c7",
            "sha256": "0fa637ace51eb063c3cad8951d7c21fead6f33a4332b065f10f2086d719de3c2",
            "subject": "devipsale.com",
            "valid_to": "2026-12-23T19:38:02Z",
            "valid_from": "2026-09-24T18:45:29Z"
        },
        "whois": {
            "registrar": "Spaceship, Inc.",
            "registrar_iana_id": "3862",
            "registrar_url": "http://www.spaceship.com",
            "created": "2026-09-24T14:14:29Z",
            "updated": "2026-09-24T14:17:24Z",
            "expires": "2027-09-24T14:14:29Z",
            "status": [
                "clientTransferProhibited"
            ],
            "nameservers": [
                "algin.ns.cloudflare.com",
                "elinore.ns.cloudflare.com"
            ],
            "dnssec": "unsigned"
        },
        "rdap": {
            "status": [
                "client transfer prohibited",
                "add period"
            ],
            "events": {
                "last changed": "2026-09-24T14:17:24Z",
                "registration": "2026-09-24T14:14:29Z",
                "registrar expiration": "2027-09-24T14:14:29Z",
                "last update of RDAP database": "2026-10-19T14:49:56Z"
            }
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-25T06:25:57Z",
        "mail_config": {
            "spf_lookups": 0
        },
        "caa_records": {
            "domain": "devipsale.com"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_by": [
                "CloudFlare Family"
            ],
            "blocked_count": 1
        },
        "archives": {
            "last": "2026-10-25T06:22:20Z",
            "first": "2026-10-10T01:01:42Z",
            "changes": 1,
            "days_archived": 2,
            "scans_per_day": 0.07,
            "avg_page_bytes": 117758
        },
        "social_tags": {
            "title": "500 Internal Server Error",
            "robots": "noindex, nofollow"
        },
        "trackers": {
            "requests": 34,
            "trackers": [
                {
                    "name": "Google Static",
                    "company": "Google",
                    "country": "US",
                    "category": "Hosting",
                    "requests": 2
                }
            ]
        },
        "mixed_content": {
            "third_party_scripts": 0
        },
        "status": {
            "up": true,
            "code": 200,
            "timings": {
                "dns": 20,
                "tls": 26,
                "wait": 189,
                "connect": 6,
                "download": 0
            },
            "response_ms": 241
        },
        "tls_connection": {
            "alpn": "h2",
            "cipher": "TLS_AES_256_GCM_SHA384",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                80,
                443
            ]
        },
        "carbon": {
            "bytes": 219,
            "co2_grams": 0,
            "cleaner_than": 95
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "173.245.59.61",
                    "host": "algin.ns.cloudflare.com"
                },
                {
                    "ip": "172.64.32.153",
                    "host": "elinore.ns.cloudflare.com"
                }
            ],
            "zone": "devipsale.com"
        },
        "cookies": {
            "cookies": [
                {
                    "name": "_bbgizh_vid"
                },
                {
                    "name": "_bbgizh_cvid"
                },
                {
                    "name": "_bbgizh_vs"
                },
                {
                    "name": "utm_source"
                },
                {
                    "name": "utm_medium"
                },
                {
                    "name": "order_utm_history"
                },
                {
                    "name": "landing_page"
                },
                {
                    "name": "_bbgizh_ka"
                },
                {
                    "name": "first_http_referer"
                },
                {
                    "name": "first_visit_time"
                },
                {
                    "name": "PHPSESSID",
                    "session": true
                },
                {
                    "name": "_BBDIIGD_ua",
                    "secure": true,
                    "same_site": "None"
                },
                {
                    "name": "_BBDIIGD_pu",
                    "secure": true,
                    "same_site": "None"
                },
                {
                    "name": "_BBDIIGD_tz",
                    "secure": true,
                    "same_site": "None"
                },
                {
                    "name": "_BBDIIGD_ss",
                    "secure": true,
                    "same_site": "None"
                },
                {
                    "name": "_BBDIIGD_lang",
                    "secure": true,
                    "same_site": "None"
                },
                {
                    "name": "_BBDIIGD_vs",
                    "secure": true,
                    "same_site": "None"
                },
                {
                    "name": "_BBDIIGD_dt",
                    "secure": true,
                    "same_site": "None"
                }
            ]
        },
        "location": {
            "ip": "34.160.145.2",
            "asn": "396982",
            "org": "Google LLC",
            "city": "Kansas City",
            "country": "US"
        },
        "ssl": {
            "issuer": "Google Trust Services / WR3",
            "subject": "devipsale.com"
        },
        "dns": {
            "A": [
                "34.160.145.2"
            ],
            "NS": [
                "algin.ns.cloudflare.com",
                "elinore.ns.cloudflare.com"
            ],
            "SOA": "{\"nsname\": \"algin.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2415833041, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}"
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "hsts": {
            "message": "Site does not serve any HSTS headers."
        },
        "http_security": {
            "xFrameOptions": false,
            "referrerPolicy": false,
            "xXSSProtection": false,
            "permissionsPolicy": false,
            "xContentTypeOptions": false,
            "contentSecurityPolicy": false,
            "strictTransportPolicy": false,
            "crossOriginOpenerPolicy": false,
            "crossOriginEmbedderPolicy": false,
            "crossOriginResourcePolicy": false
        },
        "get_ip": {
            "ip": "34.160.145.2",
            "family": 4
        },
        "redirects": {
            "chain": [
                "https://devipsale.com"
            ]
        },
        "subdomains": {
            "count": 1,
            "subdomains": [
                "www.devipsale.com"
            ]
        },
        "whois": {
            "registrar": "Spaceship, Inc.",
            "created": "2026-09-24T14:14:29Z",
            "updated": "2026-09-24T14:17:24Z",
            "expires": "2027-09-24T14:14:29Z",
            "status": [
                "clientTransferProhibited https://icann.org/epp"
            ],
            "nameservers": [
                "algin.ns.cloudflare.com",
                "elinore.ns.cloudflare.com"
            ]
        },
        "headers": {
            "headers": {
                "server": "nginx",
                "content-type": "text/html; charset=utf-8"
            }
        }
    }
}
```