# PhishDestroy domain threat record: farvuni.shop Content language: English Canonical HTML report: https://phishdestroy.io/domain/farvuni.shop/ Machine-readable companion: https://phishdestroy.io/domain/farvuni.shop/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-10-26 02:05:36 UTC - Last availability or vendor check: 2026-10-26 11:00:23 UTC - Stored record updated: 2026-10-26 21:01:00 UTC - VirusTotal detections in the stored snapshot: 8/92 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: no stored flag ## Stored infrastructure - Observed IP address: 91.92.35.94 - Registrar in stored WHOIS data: Spaceship, Inc. - Last stored HTTP status: 302 - Registration date in stored WHOIS data: 2026-10-04 18:46:40 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a13b76-ee6e-7229-a6c9-ecad38bc78cd/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/farvuni.shop - Certificate Transparency search: https://crt.sh/?q=%25.farvuni.shop - Web Archive lookup: https://web.archive.org/web/*/https://farvuni.shop/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview PhishDestroy added farvuni.shop to its internal blocklist on 2026-10-26 following an intake that highlighted six VirusTotal vendors labeling the domain malicious and noting a redirect to neluora.shop. The site returned HTTP 200 on the same day and redirected cross‑site via HTTP to the different domain. No page title was recorded during the fetch. How the scam works The detections suggest the domain may be used as a redirector in phishing campaigns, where visitors are sent to another site that could harvest credentials or install malware. Because the page content was not captured, the exact malicious behavior cannot be confirmed, and the listing reflects a risk category rather than observed theft or fraud. Evidence VirusTotal scanned the domain on 2026-10-24 and 2026-10-26, reporting eight detections from 92 engines: six malicious (alphaMountain.ai, CRDF, Forcepoint ThreatSeeker, G-Data, SOCRadar, Sophos) and two suspicious (DNS8, Gridinsoft). Google Safe Browsing checked on 2026-10-26 and did not flag the domain. urlscan.io captured the page on 2026-10-14, giving an overall clean verdict but engine scores marked it malicious (score 97, tags urlscan-ml). Cloudflare Radar scanned on 2026-10-26 and marked the domain malicious under the malware category. OTX listed one pulse referencing the domain on 2026-10-26. PhishDestroy’s internal blocklist is true, while external blocklists showed no matches on the check date. Infrastructure The domain was registered nine days before the first scan and uses a Let's Encrypt TLS certificate issued on 2026-10-14, valid until 2027-01-12. Nameservers are launch1.spaceship.net and launch2.spaceship.net. The recorded IP address is 91.92.35.94, belonging to ASN 209101 (IP Vendetta Inc.) with a reported location in Victoria, SC. DNSSEC is enabled, and port 22 was observed open. What to do Visitors should avoid interacting with the site and refrain from entering credentials; if credentials were entered, change them immediately. Administrators should block farvuni.shop at the firewall or proxy, monitor DNS queries for the domain, and review logs for connections to 91.92.35.94. Continue to watch for updates from security feeds, as the current evidence reflects a suspicious but unconfirmed malicious activity. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a13b76-ee6e-7229-a6c9-ecad38bc78cd/ Cloudflare Radar report: https://radar.cloudflare.com/scan/d84ef0fe-ba6b-4d7a-a53e-937acae98e44 Stored capture screenshot: https://urlscan.io/screenshots/01a13b76-ee6e-7229-a6c9-ecad38bc78cd.png Cloudflare Radar screenshot (2026-10-26T02:09:33Z): https://screenshots.phishdestroy.io/cf/d84ef0fe-ba6b-4d7a-a53e-937acae98e44.png VirusTotal report: https://www.virustotal.com/gui/domain/farvuni.shop Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=farvuni.shop Archived copy: https://web.archive.org/web/20261026020849/https://farvuni.shop/ Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-26 02:12:42 UTC ## Stored page captures - Primary capture: https://urlscan.io/screenshots/01a13b76-ee6e-7229-a6c9-ecad38bc78cd.png Captured: 2026-10-26 02:05:36 UTC - URLScan capture: https://screenshots.phishdestroy.io/01a13b76-ee6e-7229-a6c9-ecad38bc78cd.png Captured: 2026-10-26 04:30:35 UTC Source report: https://urlscan.io/result/01a13b76-ee6e-7229-a6c9-ecad38bc78cd/ - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/d84ef0fe-ba6b-4d7a-a53e-937acae98e44.png Captured: 2026-10-26 02:09:33 UTC Source report: https://radar.cloudflare.com/scan/d84ef0fe-ba6b-4d7a-a53e-937acae98e44 SHA-256: e474a175f992442a69e502e42d7748076f7b37bd4715cf7c03ed2b7ff55231c3 ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-26T02:08:46Z", "uuid": "01a13b76-ee6e-7229-a6c9-ecad38bc78cd", "scanned_at": "2026-10-14T17:30:19Z", "final_url": "https://farvuni.shop/", "status": 200, "redirected": "https-only", "ip": "91.92.35.94", "ips": [ "91.92.35.94" ], "asns": [ "209101" ], "countries": [ "BG" ], "doc_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "tls": { "san": [ "farvuni.shop", "www.farvuni.shop" ], "cipher": "AES_128_GCM", "issuer": "YE1", "subject": "farvuni.shop", "protocol": "TLS 1.3", "valid_to": "2027-01-12T15:39:13Z", "valid_from": "2026-10-14T15:39:14Z" }, "domain_age_days": 9, "apex_age_days": 9, "tls_age_days": 0, "tls_valid_days": 89, "requests": 2, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 97, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "LiteSpeed", "content-type": "text/html; charset=UTF-8", "strict-transport-security": "max-age=63072000; includeSubDomains; preload", "x-frame-options": "SAMEORIGIN", "x-content-type-options": "nosniff", "referrer-policy": "strict-origin-when-cross-origin" } }, "cf": { "v": 1, "fetched_at": "2026-10-26T02:11:56Z", "uuid": "d84ef0fe-ba6b-4d7a-a53e-937acae98e44", "scanned_at": "2026-10-26T02:09:33Z", "final_url": "https://farvuni.shop/", "status": 200, "history": [ { "url": "https://farvuni.shop/", "status": 200 } ], "dom_hash": "a7fe83ec64bb23eb28090598db3d166ed98e52e39d1afbbfd74c579553f93e4e", "domain_risks": [ "Newly Seen Domains", "Security Risks", "New Domains", "Malware", "Security threats", "CIPA Filter", "CIPA" ], "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "farvuni.shop", "type": "A", "value": "91.92.35.94" } ], "dnssec_valid": true, "ip": "91.92.35.94", "verdict": { "tags": [ "malware" ], "malicious": true, "categories": [ "malware" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-26T02:08:20Z", "analysis_at": "2026-10-24T18:18:07Z", "stats": { "timeout": 0, "harmless": 49, "malicious": 6, "suspicious": 2, "undetected": 35 }, "detections": { "CRDF": "malicious", "DNS8": "suspicious", "G-Data": "phishing", "Sophos": "phishing", "SOCRadar": "phishing", "Gridinsoft": "suspicious", "alphaMountain.ai": "phishing", "Forcepoint ThreatSeeker": "phishing" }, "reputation": 0, "first_seen": "2026-10-06T06:16:59Z", "dns": [ { "ttl": 1800, "type": "NS", "value": "launch2.spaceship.net" }, { "ttl": 1800, "type": "NS", "value": "launch1.spaceship.net" }, { "ttl": 1800, "type": "SOA", "rname": "support.spaceship.com", "value": "launch1.spaceship.net" }, { "ttl": 3600, "type": "A", "value": "91.92.35.94" } ], "dns_at": "2026-10-24T18:23:27Z", "jarm": "1dd40d40d00040d00042d43d000000ffd4768d0539f26c1eea462bed21f172", "cert": { "san": [ "farvuni.shop", "www.farvuni.shop" ], "issuer": "Let's Encrypt / YE1", "serial": "508b01684c98426ce9491360ed1136d1934", "sha256": "f7746ece23f55415526a1bd9a627b919e79b607697cdf3ef1fd78938ed2db9ad", "subject": "farvuni.shop", "valid_to": "2027-01-12T15:39:13Z", "valid_from": "2026-10-14T15:39:14Z" } }, "webcheck": { "v": 1, "fetched_at": "2026-10-26T02:12:27Z", "mail_config": { "spf_lookups": 0 }, "caa_records": { "domain": "farvuni.shop" }, "block_lists": { "resolvers": 12, "blocked_by": [ "CloudFlare Family" ], "blocked_count": 1 }, "archives": { "last": "2026-10-26T02:08:49Z", "first": "2026-10-05T10:31:18Z", "changes": 1, "days_archived": 2, "scans_per_day": 0.05, "avg_page_bytes": 757 }, "trackers": { "requests": 1 }, "ports": { "open": [ 22 ] }, "dns_server": { "ns": [ { "ip": "162.159.27.32", "host": "launch2.spaceship.net" }, { "ip": "162.159.26.38", "host": "launch1.spaceship.net" } ], "zone": "farvuni.shop" }, "location": { "ip": "91.92.35.94", "asn": "209101", "org": "IP Vendetta Inc.", "city": "Victoria", "country": "SC" }, "dns": { "A": [ "91.92.35.94" ], "NS": [ "launch2.spaceship.net", "launch1.spaceship.net" ], "SOA": "{\"nsname\": \"launch1.spaceship.net\", \"hostmaster\": \"support.spaceship.com\", \"serial\": 1791995762, \"refresh\": 43200, \"retry\": 3600, \"expire\": 604800, \"minttl\": 3600}" }, "dnssec": { "ds": true, "rrsig": true, "dnskey": true }, "get_ip": { "ip": "91.92.35.94", "family": 4 } } } ```