# PhishDestroy domain threat record: itunesgifts.xyz Content language: English Canonical HTML report: https://phishdestroy.io/domain/itunesgifts.xyz/ Machine-readable companion: https://phishdestroy.io/domain/itunesgifts.xyz/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-10-23 17:37:17 UTC - Last availability or vendor check: 2026-10-23 17:37:17 UTC - Stored record updated: 2026-10-23 18:45:56 UTC - VirusTotal detections in the stored snapshot: 0/92 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: no stored flag ## Stored classification - Targeted brand: apple id ## Stored infrastructure - Observed IP address: 37.252.1.44 - Registrar in stored WHOIS data: Hosting Concepts B.V. d/b/a Registrar.eu - Registrar country in stored WHOIS data: NL - Last stored HTTP status: 200 - Registration date (registry RDAP, itunesgifts.xyz): 2026-09-26 07:49:33 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a169d5-35a4-73be-a299-3f45ea0832ac/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/itunesgifts.xyz - Certificate Transparency search: https://crt.sh/?q=%25.itunesgifts.xyz - Web Archive lookup: https://web.archive.org/web/*/https://itunesgifts.xyz/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview PhishDestroy’s intake system added itunesgifts.xyz to the internal blocklist on 2026-10-23 after an automated AI assessment identified brand impersonation and a Telegram‑based payment channel. The recorded page title reads “Подарочные карты App Store & iTunes — США, Турция, Индия, Россия”, which claims to sell Apple App Store and iTunes gift cards for multiple regions. A fetch on the same day returned HTTP 200. The domain was registered on 2026-09-26, 27 days before first sighting. How the scam works Fake‑gift‑card scams create a storefront that mimics a legitimate brand, display digital code listings and promise instant delivery after payment. They typically collect funds through untraceable channels such as Telegram bots, leaving victims without a valid code and with no recourse. Evidence VirusTotal scanned the domain on 2026-10-23 and reported zero detections from 92 engines. Google Safe Browsing returned a clean result on the same date, while OTX listed four pulses referencing the domain. urlscan.io captured the site on 2026-10-23, its engine analysis gave a malicious score of 99 with tags “urlscan‑ml”, but the overall verdict was non‑malicious; the scan recorded the page title and a Telegram link. PhishDestroy’s internal blocklist marks the domain as malicious, and no external blocklists flagged it on the check date. Infrastructure The domain was created on 2026-09-26 through Hosting Concepts B.V. d/b/a Registrar.eu and resolves to IP 37.252.1.44, which belongs to Netrocks LLC in Russia. DNS is served by Cloudflare nameservers hunts.ns.cloudflare.com and lady.ns.cloudflare.com. The site uses a Let’s Encrypt TLS certificate valid until 2026-12-26. What to do Visitors should not provide personal or payment information to the site; if they have already done so, they should treat any transferred funds as lost and monitor financial accounts for unauthorized activity. Organizations can block the domain at the network perimeter and watch for outbound connections to the associated Telegram bot. Since no cryptocurrency wallet interaction was observed, no wallet‑specific remediation is required. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a169d5-35a4-73be-a299-3f45ea0832ac/ Cloudflare Radar report: https://radar.cloudflare.com/scan/737d88b8-6a5a-4a41-ad1c-4329a2724b94 URLQuery report: https://urlquery.net/report/70cc274d-1977-4aef-8826-62bb307c65cb Stored capture screenshot: https://i.ibb.co/LXM31tP7/53ae832d15a0.png Cloudflare Radar screenshot (2026-10-23T18:14:11Z): https://screenshots.phishdestroy.io/cf/737d88b8-6a5a-4a41-ad1c-4329a2724b94.png URLQuery screenshot: https://screenshots.phishdestroy.io/uq/70cc274d-1977-4aef-8826-62bb307c65cb.png URLScan screenshot (2026-09-27T08:35:11Z): https://screenshots.phishdestroy.io/us/01a0e200-e451-7372-8ce3-08b5e83ed695.png URLScan capture report: https://urlscan.io/result/01a0e200-e451-7372-8ce3-08b5e83ed695/ URLScan screenshot (2026-09-27T17:04:26Z): https://screenshots.phishdestroy.io/us/01a0e3d3-2453-74c3-96a4-cb9799ae5980.png URLScan capture report: https://urlscan.io/result/01a0e3d3-2453-74c3-96a4-cb9799ae5980/ VirusTotal report: https://www.virustotal.com/gui/domain/itunesgifts.xyz Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=itunesgifts.xyz Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-23 18:44:56 UTC ## Stored page captures - Primary capture: https://i.ibb.co/LXM31tP7/53ae832d15a0.png Captured: 2026-10-23 17:37:17 UTC - URLScan capture: https://screenshots.phishdestroy.io/01a169d5-35a4-73be-a299-3f45ea0832ac.png Captured: 2026-10-23 17:37:17 UTC Source report: https://urlscan.io/result/01a169d5-35a4-73be-a299-3f45ea0832ac/ - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/737d88b8-6a5a-4a41-ad1c-4329a2724b94.png Captured: 2026-10-23 18:14:11 UTC Source report: https://radar.cloudflare.com/scan/737d88b8-6a5a-4a41-ad1c-4329a2724b94 SHA-256: 1e292966ea06e367c10322df46ed48fdb74775298e56d8b058c5cced81edcda3 - URLQuery: https://screenshots.phishdestroy.io/uq/70cc274d-1977-4aef-8826-62bb307c65cb.png Source report: https://urlquery.net/report/70cc274d-1977-4aef-8826-62bb307c65cb SHA-256: 686a5210ecfc4c5eab472f59a452404adb15dc4abc519847fa55707065355a44 - URLScan · 2026-09-27: https://screenshots.phishdestroy.io/us/01a0e200-e451-7372-8ce3-08b5e83ed695.png Captured: 2026-09-27 08:35:11 UTC Source report: https://urlscan.io/result/01a0e200-e451-7372-8ce3-08b5e83ed695/ SHA-256: bc7796f675d2c7e7ffec76f0c3e2870e93b11b36e780a3b7d0ed7257881af7b1 - URLScan · 2026-09-27: https://screenshots.phishdestroy.io/us/01a0e3d3-2453-74c3-96a4-cb9799ae5980.png Captured: 2026-09-27 17:04:26 UTC Source report: https://urlscan.io/result/01a0e3d3-2453-74c3-96a4-cb9799ae5980/ SHA-256: a962d9e777cac90c0d654adbbca7fd6e14cb03412c11afd38a8316ed53362ca5 ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-23T18:04:07Z", "uuid": "01a169d5-35a4-73be-a299-3f45ea0832ac", "scanned_at": "2026-10-23T17:35:50Z", "final_url": "https://itunesgifts.xyz/", "status": 200, "ip": "37.252.1.44", "domains": [ "region1.google-analytics.com", "www.googletagmanager.com" ], "ips": [ "2001:4860:4802:32::36", "2a00:1450:4001:c17::61", "37.252.1.44" ], "asns": [ "15169", "212667" ], "countries": [ "US", "DE", "RU" ], "link_domains": [ "t.me" ], "social": [ "https://t.me/itunesgiftsen_bot" ], "doc_hash": "3b3ecd496f7f118c6f8bc1fa67f11a5b2a928316ea16c2d7d71cbbaf1c9a29b1", "script_hashes": [ "db05db37f7227c01de4eaca94be9411ba0107ad86b7ae53668a9c5a47d1065f3", "feb75a6b4206cd3c780fe46f158d783836a18467422cb10db8e0148d9a87c3c7" ], "globals": [ "gtag", "dataLayer", "el", "fmtMoney", "getJSON", "loadCart", "saveCart", "cartCount", "siteCheckout", "maxItems", "startPayload", "notice", "addToCart", "changeQty", "renderCart", "openCart", "closeCart", "regionChip", "productCard", "selectRegion", "initBrands", "renderBrandPills", "setCategory", "brandLabel", "setBrand", "renderTabs", "loadPages", "applyConfig", "submitOrder", "orderFromUrl", "rememberedOrder", "rememberOrder", "resumeOrder", "showCodes", "trackOrder", "priceRange", "promoList", "promoCard", "renderPromos", "subState" ], "cookies": [ "_ga_DEN4DNWBVG", "_ga" ], "tls": { "san": [ "itunesgifts.xyz" ], "cipher": "AES_256_GCM", "issuer": "YE2", "subject": "itunesgifts.xyz", "protocol": "TLS 1.3", "valid_to": "2026-12-26T01:16:34Z", "valid_from": "2026-09-27T01:16:35Z" }, "domain_age_days": 27, "apex_age_days": 27, "tls_age_days": 26, "tls_valid_days": 89, "requests": 20, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 99, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "nginx", "content-type": "text/html; charset=utf-8", "strict-transport-security": "max-age=31536000", "content-security-policy": "default-src 'self'; img-src 'self' data:; style-src 'self'; script-src 'self' https://www.googletagmanager.com; connect-src 'self' https://www.google-analytics.com https://*.google-analytics.com https", "x-content-type-options": "nosniff", "referrer-policy": "strict-origin-when-cross-origin", "permissions-policy": "camera=(), microphone=(), geolocation=(), payment=()" } }, "cf": { "v": 1, "fetched_at": "2026-10-23T18:14:50Z", "uuid": "737d88b8-6a5a-4a41-ad1c-4329a2724b94", "scanned_at": "2026-10-23T18:14:11Z", "final_url": "https://itunesgifts.xyz/", "status": 200, "history": [ { "url": "https://itunesgifts.xyz/", "status": 200 } ], "dom_hash": "170b8b7219fe3cf3b5b57d62c97790c94095b3385f2e18a7aaaf10ea7f3be4ad", "doc_hash": "3b3ecd496f7f118c6f8bc1fa67f11a5b2a928316ea16c2d7d71cbbaf1c9a29b1", "domain_risks": [ "Newly Seen Domains", "Security Risks", "New Domains" ], "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "itunesgifts.xyz", "type": "A", "value": "37.252.1.44" } ], "dnssec_valid": false, "ip": "37.252.1.44", "whois": { "registrar": "Hosting Concepts B.V. d/b/a Registrar.eu", "created": "2026-09-26T07:49:33Z", "updated": "2026-09-26T07:49:37Z", "expires": "2027-09-26T23:59:59Z", "nameservers": [ "hunts.ns.cloudflare.com", "lady.ns.cloudflare.com" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-23T18:43:50Z", "analysis_at": "2026-10-23T18:15:23Z", "stats": { "timeout": 0, "harmless": 55, "malicious": 0, "suspicious": 0, "undetected": 37 }, "reputation": 0, "registrar": "Hosting Concepts B.V. d/b/a Registrar.eu", "created": "2026-09-26T07:49:33Z", "expires": "2027-09-26T23:59:59Z", "updated": "2026-09-26T10:48:15Z", "first_seen": "2026-09-26T16:13:39Z", "dns": [ { "ttl": 21600, "type": "NS", "value": "hunts.ns.cloudflare.com" }, { "ttl": 21600, "type": "NS", "value": "lady.ns.cloudflare.com" }, { "ttl": 1800, "type": "SOA", "rname": "dns.cloudflare.com", "value": "hunts.ns.cloudflare.com" }, { "ttl": 60, "type": "A", "value": "37.252.1.44" } ], "dns_at": "2026-10-23T18:20:44Z", "jarm": "28d28d28d00028d00042d42d000000e1ea2a807a629b496b664cf07ad7c08d", "cert": { "san": [ "itunesgifts.xyz" ], "issuer": "Let's Encrypt / YE2", "serial": "6a537e2018bc7605553dd8fec414d1017af", "sha256": "854fb8193044ce554fcaf88994d6038f31ca7e48e37021c3ad76b4597fbb99a2", "subject": "itunesgifts.xyz", "valid_to": "2026-12-26T01:16:34Z", "valid_from": "2026-09-27T01:16:35Z" }, "whois": { "registrar": "Hosting Concepts B.V. d/b/a Registrar.eu", "registrar_iana_id": "1647", "registrar_url": "https://www.openprovider.com/", "created": "2026-09-26T07:49:33Z", "updated": "2026-09-26T07:49:37Z", "expires": "2027-09-26T23:59:59Z", "status": [ "addPeriod", "clientTransferProhibited", "serverTransferProhibited" ], "nameservers": [ "hunts.ns.cloudflare.com", "lady.ns.cloudflare.com" ], "dnssec": "unsigned" } }, "webcheck": { "v": 1, "fetched_at": "2026-10-23T18:14:51Z", "mail_config": { "spf_lookups": 0 }, "caa_records": { "domain": "itunesgifts.xyz" }, "block_lists": { "resolvers": 12, "blocked_count": 0 }, "archives": { "last": "2026-10-23T17:39:26Z", "first": "2026-09-26T23:59:53Z", "changes": 2, "days_archived": 3, "scans_per_day": 0.07, "avg_page_bytes": 5165 }, "social_tags": { "ogUrl": "https://itunesgifts.xyz/", "title": "Подарочные карты App Store & iTunes — США, Турция, Индия, Россия", "ogType": "website", "ogImage": "https://itunesgifts.xyz/assets/img/og-image.jpg", "ogTitle": "Подарочные карты App Store & iTunes — США, Турция, Индия, Россия", "themeColor": "#7c3aed", "description": "Цифровые подарочные карты App Store & iTunes для разных регионов. Выберите регион и номинал — код появится на странице заказа сразу после оплаты.", "twitterCard": "summary_large_image", "ogDescription": "Выберите регион и номинал — код появится на странице заказа сразу после оплаты." }, "trackers": { "requests": 16, "trackers": [ { "name": "Google Tag", "company": "Google", "country": "US", "category": "Advertising", "requests": 1 }, { "name": "Google Analytics", "company": "Google", "country": "US", "category": "Site Analytics", "requests": 1 } ] }, "mixed_content": { "no_sri": [ "https://www.googletagmanager.com/gtag/js" ], "third_party_scripts": 1 }, "status": { "up": true, "code": 200, "timings": { "dns": 13, "tls": 65, "wait": 112, "connect": 59, "download": 0 }, "response_ms": 249 }, "tls_connection": { "alpn": "h2", "cipher": "TLS_AES_256_GCM_SHA384", "protocol": "TLSv1.3", "versions": [ "TLSv1.2", "TLSv1.3" ], "authorized": true, "forward_secrecy": true }, "ports": { "open": [ 22, 80, 443 ] }, "carbon": { "bytes": 17053, "co2_grams": 0.0006, "cleaner_than": 60 }, "dns_server": { "ns": [ { "ip": "108.162.192.127", "host": "lady.ns.cloudflare.com" }, { "ip": "172.64.35.46", "host": "hunts.ns.cloudflare.com" } ], "zone": "itunesgifts.xyz" }, "cookies": { "cookies": [ { "name": "_ga_DEN4DNWBVG" }, { "name": "_ga" } ] }, "location": { "ip": "37.252.1.44", "asn": "212667", "org": "Netrocks LLC | .ru", "city": "Moscow", "country": "RU" }, "ssl": { "issuer": "Let's Encrypt / YE2", "subject": "itunesgifts.xyz" }, "dns": { "A": [ "37.252.1.44" ], "NS": [ "hunts.ns.cloudflare.com", "lady.ns.cloudflare.com" ], "SOA": "{\"nsname\": \"hunts.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2416077169, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}" }, "dnssec": { "ds": false, "rrsig": false, "dnskey": false }, "hsts": { "header": "max-age=31536000", "message": "HSTS header does not include all subdomains." }, "http_security": { "xFrameOptions": false, "referrerPolicy": "strict-origin-when-cross-origin", "xXSSProtection": false, "permissionsPolicy": "camera=(), microphone=(), geolocation=(), payment=()", "xContentTypeOptions": "nosniff", "contentSecurityPolicy": "default-src 'self'; img-src 'self' data:; style-src 'self'; script-src 'self' https://www.googletagmanager.com; connect-", "strictTransportPolicy": "max-age=31536000", "crossOriginOpenerPolicy": false, "crossOriginEmbedderPolicy": false, "crossOriginResourcePolicy": false }, "get_ip": { "ip": "37.252.1.44", "family": 4 }, "redirects": { "chain": [ "https://itunesgifts.xyz" ] }, "subdomains": { "count": 12, "subdomains": [ "drop-panel.itunesgifts.xyz", "fox-panel.itunesgifts.xyz", "fox.itunesgifts.xyz", "ig-panel.itunesgifts.xyz", "keys-panel.itunesgifts.xyz", "keys.itunesgifts.xyz", "panel.itunesgifts.xyz", "px-panel.itunesgifts.xyz", "px.itunesgifts.xyz", "topup.itunesgifts.xyz", "uc-panel.itunesgifts.xyz", "uc.itunesgifts.xyz" ] }, "linked_pages": { "external": [ "https://t.me/itunesgiftsen_bot" ], "external_count": 1, "internal_count": 9 }, "whois": { "registrar": "Hosting Concepts B.V. d/b/a Registrar.eu", "created": "2026-09-26T07:49:33Z", "updated": "2026-09-26T07:49:37Z", "expires": "2027-09-26T23:59:59Z", "status": [ "serverTransferProhibited https://icann.org/epp", "clientTransferProhibited https://icann.org/epp" ], "nameservers": [ "hunts.ns.cloudflare.com", "lady.ns.cloudflare.com" ] }, "headers": { "headers": { "server": "nginx", "content-type": "text/html; charset=utf-8", "strict-transport-security": "max-age=31536000", "content-security-policy": "default-src 'self'; img-src 'self' data:; style-src 'self'; script-src 'self' https://www.googletagmanager.com; connect-src 'self' https://www.google-analytics.com https://*.google-analytics.com https://www.googletagmanager.com; frame-ancestors 'none'; base-uri 'none'; form-action 'none'; object-src", "x-content-type-options": "nosniff", "referrer-policy": "strict-origin-when-cross-origin", "permissions-policy": "camera=(), microphone=(), geolocation=(), payment=()" } } } } ```