# PhishDestroy domain threat record: fcdptie.shop

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/fcdptie.shop/
Machine-readable companion: https://phishdestroy.io/domain/fcdptie.shop/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: unknown
- First observed by PhishDestroy: 2026-10-26 20:40:40 UTC
- Stored record updated: 2026-10-26 21:36:47 UTC
- VirusTotal detections in the stored snapshot: 14/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored infrastructure

- Observed IP address: 91.92.35.94

## Evidence links

- URLScan report: https://urlscan.io/result/01a1354f-97dc-77ee-be9b-bbb2ce188397/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/fcdptie.shop
- Certificate Transparency search: https://crt.sh/?q=%25.fcdptie.shop
- Web Archive lookup: https://web.archive.org/web/*/https://fcdptie.shop/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
PhishDestroy listed fcdptie.shop as a suspicious domain based on multiple vendor detections and a redirect to the domain neluora.shop. The domain was first observed by PhishDestroy on 2026-10-26. A request on that date returned HTTP 200 and redirected via HTTP to the target neluora.shop.

How the scam works
The detections suggest the site functions as a redirector, a technique often used to funnel visitors to phishing pages, malware downloads, or other fraudulent content. No specific payload or credential‑stealing form was observed on the page itself.

Evidence
VirusTotal scanned the domain on 2026-10-22 (retrieved 2026-10-26) and reported 14 detections from 92 engines, with 10 classified as malicious and 4 as suspicious. Malicious vendors include alphaMountain.ai, BitDefender, CRDF, Forcepoint ThreatSeeker, G‑Data, Kaspersky, Seclookup, SOCRadar, Sophos and VIPRE. Google Safe Browsing checked on 2026-10-26 and did not flag the domain. URLScan captured the site on 2026-10-13 (retrieved 2026-10-26); engine analysis gave a malicious score of 97 but the overall verdict was non‑malicious. Cloudflare Radar scanned on 2026-10-26 and marked the domain malicious under the malware category. OTX listed one pulse referencing the domain on 2026-10-26. PhishDestroy’s internal blocklist includes the domain as of 2026-10-26, while external blocklists reported zero hits.

Infrastructure
The domain was registered on 2026-10-12, making it one day old at the time of observation. The recorded IP for the domain was 91.92.35.94, associated with ASN 209101 and the country code BG. Nameservers recorded at that time were launch1.spaceship.net and launch2.spaceship.net, and DNSSEC was enabled. TLS used a Let’s Encrypt certificate valid from 2026-10-12 to 2027-01-10, covering fcdptie.shop and www.fcdptie.shop. Cloudflare’s DNS blocklist flagged the domain once, blocked by the CloudFlare Family list.

What to do
Users should avoid following links to fcdptie.shop and should not enter any credentials or personal information if they have already visited the site. If credentials were entered, change the associated passwords immediately. Security teams should block the domain at network perimeters, monitor DNS logs for queries to fcdptie.shop, and treat any traffic to the recorded IP as suspicious.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a1354f-97dc-77ee-be9b-bbb2ce188397/
Cloudflare Radar report: https://radar.cloudflare.com/scan/029a744b-a3e0-4137-b724-bcdb51d90e4c
Stored capture screenshot: https://urlscan.io/screenshots/01a1354f-97dc-77ee-be9b-bbb2ce188397.png
Cloudflare Radar screenshot (2026-10-26T20:41:02Z): https://screenshots.phishdestroy.io/cf/029a744b-a3e0-4137-b724-bcdb51d90e4c.png
URLScan screenshot (2026-10-12T10:00:35Z): https://screenshots.phishdestroy.io/us/01a12f8e-7796-76a8-a697-681f63bb7813.png
URLScan capture report: https://urlscan.io/result/01a12f8e-7796-76a8-a697-681f63bb7813/
URLScan screenshot (2026-10-26T20:41:31Z): https://screenshots.phishdestroy.io/us/01a179f2-4fb9-75be-a003-1a027b75a4c4.png
URLScan capture report: https://urlscan.io/result/01a179f2-4fb9-75be-a003-1a027b75a4c4/
VirusTotal report: https://www.virustotal.com/gui/domain/fcdptie.shop
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=fcdptie.shop
Archived copy: https://web.archive.org/web/20261026204114/https://fcdptie.shop/
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-26 20:43:03 UTC

## Stored page captures

- Primary capture: https://urlscan.io/screenshots/01a1354f-97dc-77ee-be9b-bbb2ce188397.png
  Captured: 2026-10-26 20:40:40 UTC
- URLScan capture 1: https://screenshots.phishdestroy.io/01a1354f-97dc-77ee-be9b-bbb2ce188397.png
  Source report: https://urlscan.io/result/01a1354f-97dc-77ee-be9b-bbb2ce188397/
- URLScan · 2026-10-12: https://screenshots.phishdestroy.io/us/01a12f8e-7796-76a8-a697-681f63bb7813.png
  Captured: 2026-10-12 10:00:35 UTC
  Source report: https://urlscan.io/result/01a12f8e-7796-76a8-a697-681f63bb7813/
  SHA-256: df3ce695eeda95f111b61246eece94247a44e1cee863fd5d0198a9abfe6c9599
- URLScan · 2026-10-26: https://screenshots.phishdestroy.io/us/01a179f2-4fb9-75be-a003-1a027b75a4c4.png
  Captured: 2026-10-26 20:41:31 UTC
  Source report: https://urlscan.io/result/01a179f2-4fb9-75be-a003-1a027b75a4c4/
  SHA-256: df3ce695eeda95f111b61246eece94247a44e1cee863fd5d0198a9abfe6c9599
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/029a744b-a3e0-4137-b724-bcdb51d90e4c.png
  Captured: 2026-10-26 20:41:02 UTC
  Source report: https://radar.cloudflare.com/scan/029a744b-a3e0-4137-b724-bcdb51d90e4c
  SHA-256: e474a175f992442a69e502e42d7748076f7b37bd4715cf7c03ed2b7ff55231c3

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-26T20:42:01Z",
        "uuid": "01a1354f-97dc-77ee-be9b-bbb2ce188397",
        "scanned_at": "2026-10-13T12:49:41Z",
        "final_url": "https://fcdptie.shop/",
        "status": 200,
        "redirected": "https-only",
        "ip": "91.92.35.94",
        "ips": [
            "91.92.35.94"
        ],
        "asns": [
            "209101"
        ],
        "countries": [
            "BG"
        ],
        "doc_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
        "tls": {
            "san": [
                "fcdptie.shop",
                "www.fcdptie.shop"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "YE2",
            "subject": "fcdptie.shop",
            "protocol": "TLS 1.3",
            "valid_to": "2027-01-10T07:54:15Z",
            "valid_from": "2026-10-12T07:54:16Z"
        },
        "domain_age_days": 1,
        "apex_age_days": 1,
        "tls_age_days": 1,
        "tls_valid_days": 89,
        "requests": 2,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 97,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "LiteSpeed",
            "content-type": "text/html; charset=UTF-8",
            "strict-transport-security": "max-age=63072000; includeSubDomains; preload",
            "x-frame-options": "SAMEORIGIN",
            "x-content-type-options": "nosniff",
            "referrer-policy": "strict-origin-when-cross-origin"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-26T20:42:03Z",
        "uuid": "029a744b-a3e0-4137-b724-bcdb51d90e4c",
        "scanned_at": "2026-10-26T20:41:02Z",
        "final_url": "https://fcdptie.shop/",
        "status": 200,
        "history": [
            {
                "url": "https://fcdptie.shop/",
                "status": 200
            }
        ],
        "dom_hash": "a7fe83ec64bb23eb28090598db3d166ed98e52e39d1afbbfd74c579553f93e4e",
        "domain_risks": [
            "New Domains",
            "Security Risks",
            "Malware",
            "Security threats",
            "CIPA Filter",
            "CIPA"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "fcdptie.shop",
                "type": "A",
                "value": "91.92.35.94"
            }
        ],
        "dnssec_valid": true,
        "ip": "91.92.35.94",
        "verdict": {
            "tags": [
                "malware"
            ],
            "malicious": true,
            "categories": [
                "malware"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-26T20:40:58Z",
        "analysis_at": "2026-10-22T11:03:23Z",
        "stats": {
            "timeout": 0,
            "harmless": 46,
            "malicious": 10,
            "suspicious": 4,
            "undetected": 32
        },
        "detections": {
            "CRDF": "malicious",
            "DNS8": "suspicious",
            "ESET": "suspicious",
            "VIPRE": "malware",
            "G-Data": "phishing",
            "Sophos": "phishing",
            "Fortinet": "spam",
            "SOCRadar": "phishing",
            "Kaspersky": "phishing",
            "Seclookup": "malicious",
            "Gridinsoft": "suspicious",
            "BitDefender": "phishing",
            "alphaMountain.ai": "phishing",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "tags": [
            "dga"
        ],
        "first_seen": "2026-10-12T09:07:55Z",
        "dns": [
            {
                "ttl": 1800,
                "type": "SOA",
                "rname": "support.spaceship.com",
                "value": "launch1.spaceship.net"
            },
            {
                "ttl": 1800,
                "type": "NS",
                "value": "launch1.spaceship.net"
            },
            {
                "ttl": 3600,
                "type": "A",
                "value": "91.92.35.94"
            },
            {
                "ttl": 1800,
                "type": "NS",
                "value": "launch2.spaceship.net"
            }
        ],
        "dns_at": "2026-10-22T11:08:40Z",
        "jarm": "1dd40d40d00040d00042d43d000000ffd4768d0539f26c1eea462bed21f172",
        "cert": {
            "san": [
                "fcdptie.shop",
                "www.fcdptie.shop"
            ],
            "issuer": "Let's Encrypt / YE2",
            "serial": "5b90512ee652f18f3e4f234f7c05c32627",
            "sha256": "8adf82b69b4bc0fccd26eaa4b0dbd07aed5235d7cdc9d9953fbd402bbe76a2ef",
            "subject": "fcdptie.shop",
            "valid_to": "2027-01-10T07:54:15Z",
            "valid_from": "2026-10-12T07:54:16Z"
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-26T20:42:44Z",
        "mail_config": {
            "spf_lookups": 0
        },
        "caa_records": {
            "domain": "fcdptie.shop"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_by": [
                "CloudFlare Family"
            ],
            "blocked_count": 1
        },
        "trackers": {
            "requests": 1
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "162.159.26.38",
                    "host": "launch1.spaceship.net"
                },
                {
                    "ip": "162.159.27.32",
                    "host": "launch2.spaceship.net"
                }
            ],
            "zone": "fcdptie.shop"
        },
        "dns": {
            "A": [
                "91.92.35.94"
            ],
            "NS": [
                "launch2.spaceship.net",
                "launch1.spaceship.net"
            ],
            "SOA": "{\"nsname\": \"launch1.spaceship.net\", \"hostmaster\": \"support.spaceship.com\", \"serial\": 1791795060, \"refresh\": 43200, \"retry\": 3600, \"expire\": 604800, \"minttl\": 3600}"
        }
    }
}
```