# PhishDestroy domain threat record: fexnuro.shop Content language: English Canonical HTML report: https://phishdestroy.io/domain/fexnuro.shop/ Machine-readable companion: https://phishdestroy.io/domain/fexnuro.shop/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: unknown - First observed by PhishDestroy: 2026-10-26 20:46:09 UTC - Stored record updated: 2026-10-26 21:57:09 UTC - VirusTotal detections in the stored snapshot: 7/92 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: no stored flag ## Stored infrastructure - Observed IP address: 45.151.91.66 ## Evidence links - URLScan report: https://urlscan.io/result/01a1354f-9f32-714a-9515-bebb132c8127/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/fexnuro.shop - Certificate Transparency search: https://crt.sh/?q=%25.fexnuro.shop - Web Archive lookup: https://web.archive.org/web/*/https://fexnuro.shop/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview PhishDestroy listed fexnuro.shop on 2026-10-26 as a suspicious domain based on automated threat assessments. The site returned HTTP 200 with a valid TLS 1.3 certificate when fetched on 2026-10-26, but no page title or content was recorded. How the scam works Detections of newly registered, algorithm‑generated domains are often associated with phishing or malware distribution, where attackers host credential‑stealing forms, malicious downloads, or redirects to harmful payloads. No specific malicious behavior was observed on the captured page for this domain. Evidence VirusTotal scanned the domain on 2026-10-22, flagging it as malicious with 7 detections out of 92 engines (alphaMountain.ai, CRDF, Forcepoint ThreatSeeker, G‑Data, Gridinsoft, SOCRadar, Sophos). Google Safe Browsing checked on 2026-10-26 and did not flag the URL. urlscan.io captured the site on 2026-10-13; its overall verdict was clean, while its engine score was 97 and labeled it malicious. Cloudflare Radar scanned on 2026-10-26 and returned a malicious verdict with categories “dga domains” and “malware”. OTX listed three pulses referencing the domain as of 2026-10-26. PhishDestroy’s internal blocklist contains the domain; external blocklists checked on 2026-10-26 returned zero matches. Infrastructure The domain was first seen on 2026-10-12 and was one day old at the time of observation. The recorded IP is 45.151.91.66, belonging to IP Vendetta Inc. (ASN 209101) with the recorded country SC. Authoritative nameservers are launch1.spaceship.net and launch2.spaceship.net, DNSSEC is enabled, and the TLS certificate (Let’s Encrypt) is valid from 2026-10-12 to 2027-01-10 for fexnuro.shop and www.fexnuro.shop. What to do Visitors should avoid entering credentials, downloading files, or approving any wallet actions on this site; if any information was submitted, change the associated passwords immediately. Defenders should block the exact domain fexnuro.shop, monitor network logs for connections to 45.151.91.66, and apply standard phishing mitigation controls for newly registered domains. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a1354f-9f32-714a-9515-bebb132c8127/ Cloudflare Radar report: https://radar.cloudflare.com/scan/b094a4f2-022c-4381-90db-593f5bcde959 Stored capture screenshot: https://urlscan.io/screenshots/01a1354f-9f32-714a-9515-bebb132c8127.png Cloudflare Radar screenshot (2026-10-26T20:52:35Z): https://screenshots.phishdestroy.io/cf/b094a4f2-022c-4381-90db-593f5bcde959.png URLScan screenshot (2026-10-12T09:00:33Z): https://screenshots.phishdestroy.io/us/01a12f57-7887-735b-bb7d-ac04d611fee7.png URLScan capture report: https://urlscan.io/result/01a12f57-7887-735b-bb7d-ac04d611fee7/ URLScan screenshot (2026-10-12T13:17:20Z): https://screenshots.phishdestroy.io/us/01a13042-9424-713a-8a1b-7b328d41f847.png URLScan capture report: https://urlscan.io/result/01a13042-9424-713a-8a1b-7b328d41f847/ VirusTotal report: https://www.virustotal.com/gui/domain/fexnuro.shop Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=fexnuro.shop Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-26 21:53:38 UTC ## Stored page captures - Primary capture: https://urlscan.io/screenshots/01a1354f-9f32-714a-9515-bebb132c8127.png Captured: 2026-10-26 20:46:09 UTC - URLScan capture 1: https://screenshots.phishdestroy.io/01a1354f-9f32-714a-9515-bebb132c8127.png Source report: https://urlscan.io/result/01a1354f-9f32-714a-9515-bebb132c8127/ - URLScan · 2026-10-12: https://screenshots.phishdestroy.io/us/01a12f57-7887-735b-bb7d-ac04d611fee7.png Captured: 2026-10-12 09:00:33 UTC Source report: https://urlscan.io/result/01a12f57-7887-735b-bb7d-ac04d611fee7/ SHA-256: df3ce695eeda95f111b61246eece94247a44e1cee863fd5d0198a9abfe6c9599 - URLScan · 2026-10-12: https://screenshots.phishdestroy.io/us/01a13042-9424-713a-8a1b-7b328d41f847.png Captured: 2026-10-12 13:17:20 UTC Source report: https://urlscan.io/result/01a13042-9424-713a-8a1b-7b328d41f847/ SHA-256: df3ce695eeda95f111b61246eece94247a44e1cee863fd5d0198a9abfe6c9599 - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/b094a4f2-022c-4381-90db-593f5bcde959.png Captured: 2026-10-26 20:52:35 UTC Source report: https://radar.cloudflare.com/scan/b094a4f2-022c-4381-90db-593f5bcde959 SHA-256: dd8a7a1229ca354c2cc511c13970625f6cd085af4e692d0be1a96aabf74b95fe ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-26T20:53:36Z", "uuid": "01a1354f-9f32-714a-9515-bebb132c8127", "scanned_at": "2026-10-13T12:49:41Z", "final_url": "https://fexnuro.shop/", "status": 200, "redirected": "https-only", "ip": "45.151.91.66", "ips": [ "45.151.91.66" ], "asns": [ "209101" ], "countries": [ "BG" ], "doc_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "tls": { "san": [ "fexnuro.shop", "www.fexnuro.shop" ], "cipher": "AES_128_GCM", "issuer": "YE2", "subject": "fexnuro.shop", "protocol": "TLS 1.3", "valid_to": "2027-01-10T07:09:41Z", "valid_from": "2026-10-12T07:09:42Z" }, "domain_age_days": 1, "apex_age_days": 1, "tls_age_days": 1, "tls_valid_days": 89, "requests": 2, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 97, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "LiteSpeed", "content-type": "text/html; charset=UTF-8", "strict-transport-security": "max-age=63072000; includeSubDomains; preload", "x-frame-options": "SAMEORIGIN", "x-content-type-options": "nosniff", "referrer-policy": "strict-origin-when-cross-origin" } }, "cf": { "v": 1, "fetched_at": "2026-10-26T21:23:21Z", "uuid": "b094a4f2-022c-4381-90db-593f5bcde959", "scanned_at": "2026-10-26T20:52:35Z", "final_url": "https://fexnuro.shop/", "history": [ { "url": "https://fexnuro.shop/", "status": 0 } ], "dom_hash": "7521dd1697cd0f17a987eb978720f077c48a3ce93b06de3b6289d1cfa9a50dcd", "domain_risks": [ "Newly Seen Domains", "Security Risks", "DGA Domains", "Security threats", "New Domains", "Malware", "CIPA Filter", "CIPA" ], "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "fexnuro.shop", "type": "A", "value": "45.151.91.66" } ], "dnssec_valid": true, "verdict": { "tags": [ "dga domains", "malware" ], "malicious": true, "categories": [ "dga domains", "malware" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-26T21:51:35Z", "analysis_at": "2026-10-22T10:04:25Z", "stats": { "timeout": 0, "harmless": 50, "malicious": 7, "suspicious": 0, "undetected": 35 }, "detections": { "CRDF": "malicious", "G-Data": "phishing", "Sophos": "phishing", "SOCRadar": "phishing", "Gridinsoft": "phishing", "alphaMountain.ai": "phishing", "Forcepoint ThreatSeeker": "phishing" }, "reputation": 0, "tags": [ "dga" ], "categories": { "alphaMountain.ai": "Phishing (alphaMountain.ai)" }, "first_seen": "2026-10-12T08:41:28Z", "dns": [ { "ttl": 3600, "type": "A", "value": "45.151.91.66" }, { "ttl": 1800, "type": "SOA", "rname": "support.spaceship.com", "value": "launch1.spaceship.net" }, { "ttl": 1800, "type": "NS", "value": "launch1.spaceship.net" }, { "ttl": 1800, "type": "NS", "value": "launch2.spaceship.net" } ], "dns_at": "2026-10-22T10:09:43Z", "jarm": "1dd40d40d00040d00042d43d000000ffd4768d0539f26c1eea462bed21f172", "cert": { "san": [ "fexnuro.shop", "www.fexnuro.shop" ], "issuer": "Let's Encrypt / YE2", "serial": "5c3b494542a9305b54a7cf900f91e3f5211", "sha256": "1eee01946015a595b6c7dd18f6d7deca763294bb008afc07d679a7162f2c17e8", "subject": "fexnuro.shop", "valid_to": "2027-01-10T07:09:41Z", "valid_from": "2026-10-12T07:09:42Z" } }, "webcheck": { "v": 1, "fetched_at": "2026-10-26T20:54:18Z", "mail_config": { "spf_lookups": 0 }, "caa_records": { "domain": "fexnuro.shop" }, "block_lists": { "resolvers": 12, "blocked_by": [ "CloudFlare Family" ], "blocked_count": 1 }, "archives": { "last": "2026-10-12T07:51:27Z", "first": "2026-10-12T07:51:27Z", "changes": 0, "days_archived": 1, "avg_page_bytes": 908 }, "dns_server": { "ns": [ { "ip": "162.159.26.38", "host": "launch1.spaceship.net" }, { "ip": "162.159.27.32", "host": "launch2.spaceship.net" } ], "zone": "fexnuro.shop" }, "location": { "ip": "45.151.91.66", "asn": "209101", "org": "IP Vendetta Inc.", "city": "Victoria", "country": "SC" }, "dns": { "A": [ "45.151.91.66" ], "NS": [ "launch2.spaceship.net", "launch1.spaceship.net" ], "SOA": "{\"nsname\": \"launch1.spaceship.net\", \"hostmaster\": \"support.spaceship.com\", \"serial\": 1791792385, \"refresh\": 43200, \"retry\": 3600, \"expire\": 604800, \"minttl\": 3600}" }, "dnssec": { "ds": true, "rrsig": true, "dnskey": true }, "get_ip": { "ip": "45.151.91.66", "family": 4 } } } ```