# PhishDestroy domain threat record: evzvfpd.shop

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/evzvfpd.shop/
Machine-readable companion: https://phishdestroy.io/domain/evzvfpd.shop/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: unknown
- First observed by PhishDestroy: 2026-10-26 00:25:32 UTC
- Stored record updated: 2026-10-26 03:57:06 UTC
- VirusTotal detections in the stored snapshot: 14/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored infrastructure

- Observed IP address: 45.151.91.66

## Evidence links

- URLScan report: https://urlscan.io/result/01a139ef-72b7-75b2-9fb7-056bad7aa369/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/evzvfpd.shop
- Certificate Transparency search: https://crt.sh/?q=%25.evzvfpd.shop
- Web Archive lookup: https://web.archive.org/web/*/https://evzvfpd.shop/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
PhishDestroy listed evzvfpd.shop on 2026-10-26 after an intake review that cited ten malicious VirusTotal detections. The page fetched on that date returned HTTP 200 but no page title was recorded. The domain appears in PhishDestroy’s internal blocklist but not on external blocklists at the time of checking.

How the scam works
The detections suggest the domain could be used for typical phishing or malware distribution activities, but no specific payload, credential‑phishing form, or wallet‑draining mechanism was observed on the page. Domains flagged by many vendors are often employed as short‑lived landing pages that redirect users to malicious content or harvest data. Without concrete evidence, the risk remains a generic suspicion of abuse rather than a confirmed scheme.

Evidence
VirusTotal (analysis 2026-10-23) reported 10 malicious and 4 suspicious detections out of 92 engines, with vendors such as BitDefender, G‑Data and Kaspersky labeling it phishing or malicious. Google Safe Browsing (checked 2026-10-26) did not flag the site. urlscan.io captured the site on 2026-10-14; its overall verdict was clean, but its engine score was 96 % malicious with tags indicating suspicious content. OTX listed one pulse referencing the domain as of 2026-10-26. PhishDestroy’s internal blocklist marks the domain as blocked, while external blocklists showed zero hits, though CloudFlare Family blocked the IP once.

Infrastructure
The domain was registered on 2026-10-13 and was one day old at the time of observation. The recorded DNS A record pointed to 45.151.91.66 (ASN 209101, IP Vendetta Inc.) in Bulgaria; DNSSEC was observed, and the nameservers were launch1.spaceship.net and launch2.spaceship.net. The site used a Let’s Encrypt TLS certificate that was valid from 2026-10-13 to 2027-01-11, employing TLS 1.3 and AES‑128‑GCM.

What to do
Visitors should avoid entering credentials, downloading files, or approving any wallet actions on this site; if any information was submitted, change passwords and monitor accounts for unusual activity. Defenders should add evzvfpd.shop to blocklists, monitor DNS queries for the domain and its IP, and enforce strict TLS verification for any connections. No confirmed compromise is known, but the high vendor detection count warrants precautionary blocking and logging.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a139ef-72b7-75b2-9fb7-056bad7aa369/
Cloudflare Radar report: https://radar.cloudflare.com/scan/5856633e-eedf-43d2-818b-388305ebdb51
Stored capture screenshot: https://urlscan.io/screenshots/01a139ef-72b7-75b2-9fb7-056bad7aa369.png
URLScan screenshot (2026-10-13T10:15:21Z): https://screenshots.phishdestroy.io/us/01a134c2-5651-733b-9378-45f9ff7543ce.png
URLScan capture report: https://urlscan.io/result/01a134c2-5651-733b-9378-45f9ff7543ce/
URLScan screenshot (2026-10-13T12:49:31Z): https://screenshots.phishdestroy.io/us/01a1354f-7b93-77ba-b236-26a97dc5c8f1.png
URLScan capture report: https://urlscan.io/result/01a1354f-7b93-77ba-b236-26a97dc5c8f1/
VirusTotal report: https://www.virustotal.com/gui/domain/evzvfpd.shop
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=evzvfpd.shop
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-26 00:39:02 UTC

## Stored page captures

- Primary capture: https://urlscan.io/screenshots/01a139ef-72b7-75b2-9fb7-056bad7aa369.png
  Captured: 2026-10-26 00:25:32 UTC
- URLScan capture: https://screenshots.phishdestroy.io/01a139ef-72b7-75b2-9fb7-056bad7aa369.png
  Source report: https://urlscan.io/result/01a139ef-72b7-75b2-9fb7-056bad7aa369/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/5856633e-eedf-43d2-818b-388305ebdb51.png
  Captured: 2026-10-26 00:33:32 UTC
  Source report: https://radar.cloudflare.com/scan/5856633e-eedf-43d2-818b-388305ebdb51
  SHA-256: 968361ac9863122719b9456a11b533c55d59ba000f192b6629dba23d4ecd8bfc
- URLScan · 2026-10-13: https://screenshots.phishdestroy.io/us/01a134c2-5651-733b-9378-45f9ff7543ce.png
  Captured: 2026-10-13 10:15:21 UTC
  Source report: https://urlscan.io/result/01a134c2-5651-733b-9378-45f9ff7543ce/
  SHA-256: df3ce695eeda95f111b61246eece94247a44e1cee863fd5d0198a9abfe6c9599
- URLScan · 2026-10-13: https://screenshots.phishdestroy.io/us/01a1354f-7b93-77ba-b236-26a97dc5c8f1.png
  Captured: 2026-10-13 12:49:31 UTC
  Source report: https://urlscan.io/result/01a1354f-7b93-77ba-b236-26a97dc5c8f1/
  SHA-256: df3ce695eeda95f111b61246eece94247a44e1cee863fd5d0198a9abfe6c9599

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-26T00:38:07Z",
        "uuid": "01a139ef-72b7-75b2-9fb7-056bad7aa369",
        "scanned_at": "2026-10-14T10:22:45Z",
        "final_url": "https://evzvfpd.shop/",
        "status": 200,
        "redirected": "https-only",
        "ip": "45.151.91.66",
        "ips": [
            "45.151.91.66"
        ],
        "asns": [
            "209101"
        ],
        "countries": [
            "BG"
        ],
        "doc_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
        "tls": {
            "san": [
                "evzvfpd.shop",
                "www.evzvfpd.shop"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "YE1",
            "subject": "evzvfpd.shop",
            "protocol": "TLS 1.3",
            "valid_to": "2027-01-11T08:24:10Z",
            "valid_from": "2026-10-13T08:24:11Z"
        },
        "domain_age_days": 1,
        "apex_age_days": 1,
        "tls_age_days": 1,
        "tls_valid_days": 89,
        "requests": 2,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 96,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "LiteSpeed",
            "content-type": "text/html; charset=UTF-8",
            "strict-transport-security": "max-age=63072000; includeSubDomains; preload",
            "x-frame-options": "SAMEORIGIN",
            "x-content-type-options": "nosniff",
            "referrer-policy": "strict-origin-when-cross-origin"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-26T01:00:11Z",
        "uuid": "5856633e-eedf-43d2-818b-388305ebdb51",
        "scanned_at": "2026-10-26T00:33:32Z",
        "final_url": "https://evzvfpd.shop/",
        "history": [
            {
                "url": "https://evzvfpd.shop/",
                "status": 0
            }
        ],
        "dom_hash": "222edc6576ce4f900a55dd02c5523f77c5fa64ee8b4e540f3ff8452026c169a8",
        "domain_risks": [
            "DGA Domains",
            "Security threats",
            "New Domains",
            "Security Risks",
            "Malware",
            "Newly Seen Domains",
            "CIPA Filter",
            "CIPA"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "evzvfpd.shop",
                "type": "A",
                "value": "45.151.91.66"
            }
        ],
        "dnssec_valid": true,
        "verdict": {
            "tags": [
                "dga domains",
                "malware"
            ],
            "malicious": true,
            "categories": [
                "dga domains",
                "malware"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-26T00:32:02Z",
        "analysis_at": "2026-10-23T11:08:10Z",
        "stats": {
            "timeout": 0,
            "harmless": 46,
            "malicious": 10,
            "suspicious": 4,
            "undetected": 32
        },
        "detections": {
            "CRDF": "malicious",
            "DNS8": "suspicious",
            "ESET": "suspicious",
            "VIPRE": "malware",
            "G-Data": "phishing",
            "Sophos": "phishing",
            "Fortinet": "spam",
            "SOCRadar": "phishing",
            "Kaspersky": "phishing",
            "Seclookup": "malicious",
            "Gridinsoft": "suspicious",
            "BitDefender": "phishing",
            "alphaMountain.ai": "phishing",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "tags": [
            "dga"
        ],
        "first_seen": "2026-10-13T09:56:37Z",
        "dns": [
            {
                "ttl": 1800,
                "type": "NS",
                "value": "launch2.spaceship.net"
            },
            {
                "ttl": 1800,
                "type": "SOA",
                "rname": "support.spaceship.com",
                "value": "launch1.spaceship.net"
            },
            {
                "ttl": 1800,
                "type": "NS",
                "value": "launch1.spaceship.net"
            },
            {
                "ttl": 3600,
                "type": "A",
                "value": "45.151.91.66"
            }
        ],
        "dns_at": "2026-10-23T11:13:32Z",
        "jarm": "1dd40d40d00040d00042d43d000000ffd4768d0539f26c1eea462bed21f172",
        "cert": {
            "san": [
                "evzvfpd.shop",
                "www.evzvfpd.shop"
            ],
            "issuer": "Let's Encrypt / YE1",
            "serial": "690226b6681781e3aa38424e9193364f3cc",
            "sha256": "30cf8f4ab9c4ea5c97a3b53d3a13ec8ce790d94d218087fab75a1b1c2a662022",
            "subject": "evzvfpd.shop",
            "valid_to": "2027-01-11T08:24:10Z",
            "valid_from": "2026-10-13T08:24:11Z"
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-26T00:38:44Z",
        "mail_config": {
            "spf_lookups": 0
        },
        "caa_records": {
            "domain": "evzvfpd.shop"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_by": [
                "CloudFlare Family"
            ],
            "blocked_count": 1
        },
        "archives": {
            "last": "2026-10-12T05:45:06Z",
            "first": "2026-10-12T05:45:06Z",
            "changes": 0,
            "days_archived": 1,
            "avg_page_bytes": 911
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "162.159.27.32",
                    "host": "launch2.spaceship.net"
                },
                {
                    "ip": "162.159.26.38",
                    "host": "launch1.spaceship.net"
                }
            ],
            "zone": "evzvfpd.shop"
        },
        "location": {
            "ip": "45.151.91.66",
            "asn": "209101",
            "org": "IP Vendetta Inc.",
            "country": "BG"
        },
        "dns": {
            "A": [
                "45.151.91.66"
            ],
            "NS": [
                "launch1.spaceship.net",
                "launch2.spaceship.net"
            ],
            "SOA": "{\"nsname\": \"launch1.spaceship.net\", \"hostmaster\": \"support.spaceship.com\", \"serial\": 1791883253, \"refresh\": 43200, \"retry\": 3600, \"expire\": 604800, \"minttl\": 3600}"
        },
        "dnssec": {
            "ds": true,
            "rrsig": true,
            "dnskey": true
        },
        "get_ip": {
            "ip": "45.151.91.66",
            "family": 4
        }
    }
}
```