# PhishDestroy domain threat record: faskulo.shop

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/faskulo.shop/
Machine-readable companion: https://phishdestroy.io/domain/faskulo.shop/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: unknown
- First observed by PhishDestroy: 2026-10-26 02:06:12 UTC
- Stored record updated: 2026-10-26 03:52:01 UTC
- VirusTotal detections in the stored snapshot: 15/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored infrastructure

- Observed IP address: 91.92.35.94
- Last stored HTTP status: 200

## Evidence links

- URLScan report: https://urlscan.io/result/01a14426-9490-73bd-80ef-ccbd6de74acd/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/faskulo.shop
- Certificate Transparency search: https://crt.sh/?q=%25.faskulo.shop
- Web Archive lookup: https://web.archive.org/web/*/https://faskulo.shop/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
PhishDestroy added faskulo.shop to its internal blocklist on 2026-10-26. The domain responded with HTTP 200 and performed a cross‑site HTTP redirect to neluora.shop; no page title was recorded during the capture. The domain was first seen by PhishDestroy on the same date.

How the scam works
Cross‑site redirects are frequently used to conceal the final destination and can funnel visitors to phishing pages, malware downloads, or other fraudulent content. The presence of such a redirect, combined with multiple security detections, raises a risk even though no specific payload was observed on this page.

Evidence
VirusTotal scanned the domain on 2026-10-25 and returned 15 detections from 92 engines, with 11 malicious and 4 suspicious labels from vendors including alphaMountain.ai, BitDefender, CRDF, Forcepoint ThreatSeeker, G‑Data, Kaspersky, Lionic, Seclookup, Sophos and VIPRE. Google Safe Browsing checked the domain on 2026-10-26 and did not flag it. URLScan captured the page on 2026-10-16, gave an overall clean verdict but its engine score marked it malicious (score 96). Cloudflare Radar scanned the site on 2026-10-26 and issued a malicious verdict in the malware category. OTX listed three pulses referencing the domain, and PhishDestroy’s internal blocklist marked it as malicious while external blocklists showed no matches on the check date.

Infrastructure
The domain was registered less than a day before first observation and uses a Let’s Encrypt certificate valid from 2026-10-15 to 2027-01-13. The recorded IP is 91.92.35.94 (ASN 209101, IP Vendetta Inc.) located in Bulgaria. Nameservers are launch1.spaceship.net and launch2.spaceship.net with DNSSEC enabled. Open ports 22, 80 and 443 were observed and the site sent an HSTS header with a max‑age of 63072000 seconds.

What to do
Avoid interacting with the site or submitting any credentials. If you visited the page, verify that no login, payment or wallet information was entered and run a security scan on your device. Defenders should block faskulo.shop in network filters and monitor logs for any connections to this domain or its IP address.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a14426-9490-73bd-80ef-ccbd6de74acd/
Cloudflare Radar report: https://radar.cloudflare.com/scan/5d32f987-9ab9-426a-85a7-af0e0f829b85
Stored capture screenshot: https://urlscan.io/screenshots/01a14426-9490-73bd-80ef-ccbd6de74acd.png
Cloudflare Radar screenshot (2026-10-26T02:09:32Z): https://screenshots.phishdestroy.io/cf/5d32f987-9ab9-426a-85a7-af0e0f829b85.png
URLScan screenshot (2026-10-15T14:00:28Z): https://screenshots.phishdestroy.io/us/01a13fdd-1bae-7169-9cb4-b92b72b1040d.png
URLScan capture report: https://urlscan.io/result/01a13fdd-1bae-7169-9cb4-b92b72b1040d/
VirusTotal report: https://www.virustotal.com/gui/domain/faskulo.shop
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=faskulo.shop
Archived copy: https://web.archive.org/web/20261026020802/https://faskulo.shop/
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-26 02:45:19 UTC

## Stored page captures

- Primary capture: https://urlscan.io/screenshots/01a14426-9490-73bd-80ef-ccbd6de74acd.png
  Captured: 2026-10-26 02:06:12 UTC
- URLScan capture: https://screenshots.phishdestroy.io/01a14426-9490-73bd-80ef-ccbd6de74acd.png
  Source report: https://urlscan.io/result/01a14426-9490-73bd-80ef-ccbd6de74acd/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/5d32f987-9ab9-426a-85a7-af0e0f829b85.png
  Captured: 2026-10-26 02:09:32 UTC
  Source report: https://radar.cloudflare.com/scan/5d32f987-9ab9-426a-85a7-af0e0f829b85
  SHA-256: e474a175f992442a69e502e42d7748076f7b37bd4715cf7c03ed2b7ff55231c3
- URLScan · 2026-10-15: https://screenshots.phishdestroy.io/us/01a13fdd-1bae-7169-9cb4-b92b72b1040d.png
  Captured: 2026-10-15 14:00:28 UTC
  Source report: https://urlscan.io/result/01a13fdd-1bae-7169-9cb4-b92b72b1040d/
  SHA-256: df3ce695eeda95f111b61246eece94247a44e1cee863fd5d0198a9abfe6c9599

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-26T02:08:47Z",
        "uuid": "01a14426-9490-73bd-80ef-ccbd6de74acd",
        "scanned_at": "2026-10-16T09:59:08Z",
        "final_url": "https://faskulo.shop/",
        "status": 200,
        "redirected": "https-only",
        "ip": "91.92.35.94",
        "ips": [
            "91.92.35.94"
        ],
        "asns": [
            "209101"
        ],
        "countries": [
            "BG"
        ],
        "doc_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
        "tls": {
            "san": [
                "faskulo.shop",
                "www.faskulo.shop"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "YE1",
            "subject": "faskulo.shop",
            "protocol": "TLS 1.3",
            "valid_to": "2027-01-13T12:12:01Z",
            "valid_from": "2026-10-15T12:12:02Z"
        },
        "domain_age_days": 0,
        "apex_age_days": 0,
        "tls_age_days": 0,
        "tls_valid_days": 89,
        "requests": 2,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 96,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "LiteSpeed",
            "content-type": "text/html; charset=UTF-8",
            "strict-transport-security": "max-age=63072000; includeSubDomains; preload",
            "x-frame-options": "SAMEORIGIN",
            "x-content-type-options": "nosniff",
            "referrer-policy": "strict-origin-when-cross-origin"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-26T02:11:41Z",
        "uuid": "5d32f987-9ab9-426a-85a7-af0e0f829b85",
        "scanned_at": "2026-10-26T02:09:32Z",
        "final_url": "https://faskulo.shop/",
        "status": 200,
        "history": [
            {
                "url": "https://faskulo.shop/",
                "status": 200
            }
        ],
        "dom_hash": "a7fe83ec64bb23eb28090598db3d166ed98e52e39d1afbbfd74c579553f93e4e",
        "domain_risks": [
            "Malware",
            "Security threats",
            "New Domains",
            "Security Risks",
            "CIPA Filter",
            "CIPA"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "faskulo.shop",
                "type": "A",
                "value": "91.92.35.94"
            }
        ],
        "dnssec_valid": true,
        "ip": "91.92.35.94",
        "verdict": {
            "tags": [
                "malware"
            ],
            "malicious": true,
            "categories": [
                "malware"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-26T02:39:53Z",
        "analysis_at": "2026-10-25T15:20:05Z",
        "stats": {
            "timeout": 0,
            "harmless": 46,
            "malicious": 11,
            "suspicious": 4,
            "undetected": 31
        },
        "detections": {
            "CRDF": "malicious",
            "DNS8": "suspicious",
            "ESET": "suspicious",
            "VIPRE": "malware",
            "G-Data": "phishing",
            "Lionic": "phishing",
            "Sophos": "phishing",
            "Fortinet": "spam",
            "SOCRadar": "phishing",
            "Kaspersky": "phishing",
            "Seclookup": "malicious",
            "Gridinsoft": "suspicious",
            "BitDefender": "phishing",
            "alphaMountain.ai": "phishing",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "categories": {
            "alphaMountain.ai": "Phishing, Spam (alphaMountain.ai)"
        },
        "first_seen": "2026-10-15T13:27:29Z",
        "dns": [
            {
                "ttl": 1800,
                "type": "NS",
                "value": "launch1.spaceship.net"
            },
            {
                "ttl": 1800,
                "type": "SOA",
                "rname": "support.spaceship.com",
                "value": "launch1.spaceship.net"
            },
            {
                "ttl": 3600,
                "type": "A",
                "value": "91.92.35.94"
            },
            {
                "ttl": 1800,
                "type": "NS",
                "value": "launch2.spaceship.net"
            }
        ],
        "dns_at": "2026-10-25T15:25:22Z",
        "jarm": "1dd40d40d00040d00042d43d000000ffd4768d0539f26c1eea462bed21f172",
        "cert": {
            "san": [
                "faskulo.shop",
                "www.faskulo.shop"
            ],
            "issuer": "Let's Encrypt / YE1",
            "serial": "6de0be7dced522a133bec52fafd71bd7ee2",
            "sha256": "3ed768a4f7e0458c265d454e52568aa904b12470598161be5bad6e6e3940feab",
            "subject": "faskulo.shop",
            "valid_to": "2027-01-13T12:12:01Z",
            "valid_from": "2026-10-15T12:12:02Z"
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-26T02:12:03Z",
        "mail_config": {
            "spf_lookups": 0
        },
        "caa_records": {
            "domain": "faskulo.shop"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_by": [
                "CloudFlare Family"
            ],
            "blocked_count": 1
        },
        "archives": {
            "last": "2026-10-26T02:08:02Z",
            "first": "2026-10-15T20:47:20Z",
            "changes": 0,
            "days_archived": 2,
            "scans_per_day": 0.1,
            "avg_page_bytes": 619
        },
        "trackers": {
            "requests": 1
        },
        "mixed_content": {
            "third_party_scripts": 0
        },
        "status": {
            "up": true,
            "code": 200,
            "timings": {
                "dns": 245,
                "tls": 28,
                "wait": 36,
                "connect": 12,
                "download": 0
            },
            "response_ms": 321
        },
        "tls_connection": {
            "alpn": "h2",
            "cipher": "TLS_AES_256_GCM_SHA384",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                22,
                80,
                443
            ]
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "162.159.26.38",
                    "host": "launch1.spaceship.net"
                },
                {
                    "ip": "162.159.27.32",
                    "host": "launch2.spaceship.net"
                }
            ],
            "zone": "faskulo.shop"
        },
        "location": {
            "ip": "91.92.35.94",
            "asn": "209101",
            "org": "IP Vendetta Inc.",
            "country": "BG"
        },
        "ssl": {
            "issuer": "Let's Encrypt / YE1",
            "subject": "faskulo.shop"
        },
        "dns": {
            "A": [
                "91.92.35.94"
            ],
            "NS": [
                "launch1.spaceship.net",
                "launch2.spaceship.net"
            ],
            "SOA": "{\"nsname\": \"launch1.spaceship.net\", \"hostmaster\": \"support.spaceship.com\", \"serial\": 1792069727, \"refresh\": 43200, \"retry\": 3600, \"expire\": 604800, \"minttl\": 3600}"
        },
        "dnssec": {
            "ds": true,
            "rrsig": true,
            "dnskey": true
        },
        "hsts": {
            "header": "max-age=63072000; includeSubDomains; preload",
            "message": "Site is compatible with the HSTS preload list!",
            "compatible": true
        },
        "http_security": {
            "xFrameOptions": "SAMEORIGIN",
            "referrerPolicy": "strict-origin-when-cross-origin",
            "xXSSProtection": false,
            "permissionsPolicy": false,
            "xContentTypeOptions": "nosniff",
            "contentSecurityPolicy": false,
            "strictTransportPolicy": "max-age=63072000; includeSubDomains; preload",
            "crossOriginOpenerPolicy": false,
            "crossOriginEmbedderPolicy": false,
            "crossOriginResourcePolicy": false
        },
        "get_ip": {
            "ip": "91.92.35.94",
            "family": 4
        },
        "redirects": {
            "chain": [
                "https://faskulo.shop"
            ]
        },
        "headers": {
            "headers": {
                "server": "LiteSpeed",
                "content-type": "text/html; charset=UTF-8",
                "strict-transport-security": "max-age=63072000; includeSubDomains; preload",
                "x-frame-options": "SAMEORIGIN",
                "x-content-type-options": "nosniff",
                "referrer-policy": "strict-origin-when-cross-origin"
            }
        }
    }
}
```