# PhishDestroy domain threat record: drivespa.ru

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/drivespa.ru/
Machine-readable companion: https://phishdestroy.io/domain/drivespa.ru/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-10 23:02:21 UTC
- Last availability or vendor check: 2026-10-22 10:16:54 UTC
- Stored record updated: 2026-10-22 16:07:29 UTC
- VirusTotal detections in the stored snapshot: 15/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: telegram

## Stored infrastructure

- Observed IP address: 5.101.153.83
- Registrar in stored WHOIS data: REGISTRAR_NOT_FOUND
- Last stored HTTP status: 200

## Evidence links

- URLScan report: https://urlscan.io/result/01a0f6cc-a5e0-76ea-9896-0c8e8f8e92ef/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/drivespa.ru
- Certificate Transparency search: https://crt.sh/?q=%25.drivespa.ru
- Web Archive lookup: https://web.archive.org/web/*/https://drivespa.ru/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
drivespa.ru is classified by PhishDestroy as an impersonation phishing page, a site built to pass itself off as a service people already trust. PhishDestroy first flagged it on 2026-10-11. As of 2026-10-19 it was still online and serving live content, so anyone reaching it today can still be exposed. Its page title is simply the domain name and does not reveal which brand it copies.

How the scam works
Impersonation pages copy the look of a familiar brand, including its logo, layout and wording, so visitors believe they are on the real site. The visitor is then asked to sign in, verify an account, confirm a payment or submit personal details. Whatever is typed goes straight to the operators. Stolen credentials are used to take over accounts, card data is used for fraud, and personal details feed follow-up scams. A plain, generic title like this one gives no clue to the deception, so the visual copy of the brand does all the work.

Evidence
Fifteen of 92 VirusTotal engines flagged the domain as of 2026-10-12. That is a minority, but the flagging vendors are independent of one another and include BitDefender, Fortinet, Forcepoint ThreatSeeker, G-Data, Gridinsoft, alphaMountain.ai, CyRadar and Chong Lua Dao. The domain also appears in 33 AlienVault OTX threat pulses, which means many researchers have tied it to malicious activity. PhishDestroy lists it on its own blocklist.

Infrastructure
The site resolves to 5.101.153.83 on the Beget LLC network in Russia. Beget is a mainstream Russian shared-hosting provider, and phishing operators often use low-cost commodity hosting like it to stand up pages quickly. A .ru domain on domestic hosting suggests the operation may be aimed mainly at Russian-speaking users.

What to do
Do not enter anything on drivespa.ru. If you typed a password there, change it right away on the genuine service and on any other account that shares it, then turn on two-factor authentication. If you entered card or banking details, call your bank to block the card and dispute any charges. Watch for follow-up emails, SMS or calls that refer to your submission, because these are a common second stage. Defenders should block the domain and the IP 5.101.153.83 at the DNS, proxy and email-gateway level, and should search logs for any users who visited it.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a0f6cc-a5e0-76ea-9896-0c8e8f8e92ef/
VirusTotal report: https://www.virustotal.com/gui/domain/drivespa.ru
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=drivespa.ru
Archived copy: https://web.archive.org/web/20240109181735/http://drivespa.ru/
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 09:27:15 UTC

## Stored page captures

- Primary capture: https://urlscan.io/screenshots/01a0f6cc-a5e0-76ea-9896-0c8e8f8e92ef.png
  Captured: 2026-10-10 23:02:21 UTC
- URLScan capture: https://screenshots.phishdestroy.io/01a0f6cc-a5e0-76ea-9896-0c8e8f8e92ef.png
  Source report: https://urlscan.io/result/01a0f6cc-a5e0-76ea-9896-0c8e8f8e92ef/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/399073c7-506b-4bdc-a1ce-1f3bc5ea7831.png
  Captured: 2026-10-12 11:21:31 UTC
  Source report: https://radar.cloudflare.com/scan/399073c7-506b-4bdc-a1ce-1f3bc5ea7831
  SHA-256: cfb4e84d93763d19ba2d2ed5ba282c37a055c21813507207dadae97590a841ce
- URLScan · 2026-10-10: https://screenshots.phishdestroy.io/us/01a12825-d17f-7048-a876-fbdb098f5445.png
  Captured: 2026-10-10 23:28:55 UTC
  Source report: https://urlscan.io/result/01a12825-d17f-7048-a876-fbdb098f5445/
  SHA-256: d02abb2a71a4fa62f50bd191aeb29a1863e0184cc4cc47a6ed208d959f72384c
- URLScan · 2026-10-10: https://screenshots.phishdestroy.io/us/01a12830-43c1-736c-a4fe-560cdf7c4491.png
  Captured: 2026-10-10 23:40:20 UTC
  Source report: https://urlscan.io/result/01a12830-43c1-736c-a4fe-560cdf7c4491/
  SHA-256: d02abb2a71a4fa62f50bd191aeb29a1863e0184cc4cc47a6ed208d959f72384c
- URLScan · 2026-10-11: https://screenshots.phishdestroy.io/us/01a12ab6-c45e-7653-96eb-406dc83b1c1f.png
  Captured: 2026-10-11 11:26:29 UTC
  Source report: https://urlscan.io/result/01a12ab6-c45e-7653-96eb-406dc83b1c1f/
  SHA-256: d02abb2a71a4fa62f50bd191aeb29a1863e0184cc4cc47a6ed208d959f72384c

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-20T17:52:19Z",
        "uuid": "01a0f6cc-a5e0-76ea-9896-0c8e8f8e92ef",
        "scanned_at": "2026-10-01T09:30:27Z",
        "final_url": "http://drivespa.ru/",
        "status": 200,
        "redirects": [
            {
                "to": "https://drivespa.ru/",
                "from": "http://drivespa.ru/",
                "status": 307
            },
            {
                "to": "http://drivespa.ru/",
                "from": "https://drivespa.ru/",
                "status": 307
            }
        ],
        "ip": "5.101.153.83",
        "ptr": "m2.bober.beget.com",
        "domains": [
            "cp.beget.com",
            "fonts.gstatic.com",
            "use.fontawesome.com",
            "cdnjs.cloudflare.com",
            "fonts.googleapis.com",
            "code.jquery.com"
        ],
        "ips": [
            "142.251.110.94",
            "178.248.232.144",
            "2606:4700:3033::ac43:8ef5",
            "2a00:1450:400a:1001::5f",
            "2a04:4e42:400::411",
            "104.17.25.14",
            "5.101.153.83"
        ],
        "asns": [
            "15169",
            "51115",
            "13335",
            "54113",
            "198610"
        ],
        "countries": [
            "US",
            "RU",
            "CH"
        ],
        "link_domains": [
            "beget.com",
            "cp.beget.com",
            "join.skype.com"
        ],
        "doc_hash": "558b25e93f64fdd42eed0dac7cb7509e3d65668d4ee9fdf3ab40ff4729f6349c",
        "globals": [
            "_",
            "$",
            "jQuery",
            "browser",
            "instructions",
            "clearCache",
            "toggleInstruction",
            "language",
            "ru",
            "en",
            "mainDiv",
            "data"
        ],
        "domain_age_days": 3892,
        "apex_age_days": 3892,
        "requests": 19,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 97,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "nginx-reuseport/1.21.1",
            "content-type": "text/html"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-20T18:03:14Z",
        "uuid": "399073c7-506b-4bdc-a1ce-1f3bc5ea7831",
        "scanned_at": "2026-10-12T11:21:31Z",
        "final_url": "https://drivespa.ru/",
        "history": [
            {
                "url": "https://drivespa.ru/",
                "status": 0
            }
        ],
        "dom_hash": "433a5e367a2aeb4769756ee4cc70d4ffb3e81ed2c2fddf9de5834d9d14dd2a4d",
        "domain_risks": [
            "Parked & For Sale Domains",
            "Security Risks"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "drivespa.ru",
                "type": "A",
                "value": "5.101.153.83"
            }
        ],
        "dnssec_valid": false,
        "whois": {
            "registrar": "REGRU-RU",
            "created": "2018-03-07T14:18:46Z",
            "expires": "2027-03-07T14:18:46Z",
            "nameservers": [
                "ns1.beget.com",
                "ns2.beget.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-21T00:29:05Z",
        "analysis_at": "2026-10-11T23:57:39Z",
        "stats": {
            "timeout": 0,
            "harmless": 45,
            "malicious": 15,
            "suspicious": 0,
            "undetected": 32
        },
        "detections": {
            "VIPRE": "malware",
            "G-Data": "phishing",
            "Lionic": "malicious",
            "Sophos": "phishing",
            "CyRadar": "phishing",
            "Fortinet": "malware",
            "SOCRadar": "phishing",
            "Kaspersky": "phishing",
            "LevelBlue": "phishing",
            "Seclookup": "malicious",
            "Gridinsoft": "malicious",
            "BitDefender": "phishing",
            "Chong Lua Dao": "malicious",
            "alphaMountain.ai": "phishing",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "categories": {
            "alphaMountain.ai": "Phishing (alphaMountain.ai)"
        },
        "popularity": {
            "Cisco Umbrella": 889222
        },
        "registrar": "REGRU-RU",
        "first_seen": "2023-10-05T12:48:46Z",
        "dns": [
            {
                "ttl": 300,
                "type": "NS",
                "value": "ns1.beget.com"
            },
            {
                "ttl": 300,
                "type": "NS",
                "value": "ns1.beget.pro"
            },
            {
                "ttl": 300,
                "type": "NS",
                "value": "ns2.beget.com"
            },
            {
                "ttl": 300,
                "type": "NS",
                "value": "ns1.beget.ru"
            },
            {
                "ttl": 300,
                "type": "NS",
                "value": "ns2.beget.ru"
            },
            {
                "ttl": 300,
                "type": "NS",
                "value": "ns2.beget.pro"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "5.101.153.83"
            },
            {
                "ttl": 300,
                "type": "SOA",
                "rname": "hostmaster.beget.com",
                "value": "ns1.beget.com"
            }
        ],
        "dns_at": "2026-10-11T23:57:52Z",
        "jarm": "2ad2ad16d2ad2ad0002ad2ad2ad2ade58cf93292ac388f015f112b48278862",
        "cert": {
            "issuer": "NO",
            "serial": "2794d3500b2507032ef680820a9287ddf9ec82f",
            "sha256": "05573c3897ab2516e43142797e73bc5d58c6ef6a883d43da761d05d7c66bdda5",
            "valid_to": "2022-07-17T11:11:39Z",
            "valid_from": "2019-07-18T11:11:39Z"
        },
        "whois": {
            "registrar": "REGRU-RU"
        }
    }
}
```