# PhishDestroy domain threat record: lrservice.com.ua

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/lrservice.com.ua/
Machine-readable companion: https://phishdestroy.io/domain/lrservice.com.ua/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-12 21:33:18 UTC
- Last availability or vendor check: 2026-10-22 10:29:42 UTC
- Stored record updated: 2026-10-22 16:07:29 UTC
- VirusTotal detections in the stored snapshot: 6/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: telegram

## Stored infrastructure

- Observed IP address: 77.42.5.121
- Registrar in stored WHOIS data: Internet Invest LLC
- Last stored HTTP status: 200
- Registration date (registry RDAP, lrservice.com.ua): 2017-03-09 13:42:11 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a087b3-3465-76cb-8e07-dd57709ca2f4/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/lrservice.com.ua
- Certificate Transparency search: https://crt.sh/?q=%25.lrservice.com.ua
- Web Archive lookup: https://web.archive.org/web/*/https://lrservice.com.ua/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
lrservice.com.ua is an impersonation phishing site that presents itself as «Автолайф Центр», an official Land Rover service centre in Kyiv. Its audience is Land Rover owners in Ukraine looking for authorised maintenance, repairs or parts. PhishDestroy first flagged the domain on 2026-10-12. As of 2026-10-19 it was still online and serving content.

How the scam works
The page title reads, in Ukrainian, "Page not found – Land Rover «Автолайф Центр» official Land Rover service in Kyiv." A browser tab with that title looks like a genuine dealer site that has a broken link. We classified the domain as an impersonation phishing page. Sites that borrow a dealer's identity usually collect names, phone numbers, vehicle details and VIN codes through booking forms. They may also ask for prepayments or deposits for service slots or parts that never arrive. Victims can lose that money, and the contact details they enter can feed follow-up scam calls that cite their car and booking.

Evidence
On 2026-10-16, 6 of 92 VirusTotal engines flagged the domain: alphaMountain.ai, Gridinsoft, Seclookup, SOCRadar, URLQuery and VIPRE. That is a minority of engines, so many security products will not warn visitors yet. Still, six independent vendors reached the same conclusion. The domain also appears in 31 AlienVault OTX threat pulses, which shows that other researchers are tracking it. PhishDestroy is currently the only blocklist that lists it.

Infrastructure
The domain was registered on 2017-03-09 through Internet Invest LLC, more than nine years before PhishDestroy flagged it. That age makes it look more trustworthy than a freshly registered lookalike. The site runs on Hetzner Online GmbH servers in Finland, not on Ukrainian hosting, even though it claims to be a Kyiv service centre. Its certificate is a standard Let's Encrypt one. The padlock in the browser therefore says nothing about who operates the site.

What to do
If you paid a deposit or prepayment through this site, contact your bank or card issuer immediately and dispute the charge. If you entered your phone number, VIN or address, treat any calls or messages about your booking as suspicious. Do not make further payments. Confirm appointments only through a dealer you find via Land Rover Ukraine's official channels, and report the incident to the cyber police. Defenders should block the domain at DNS and proxy level and add it to mail filters. Watch for lures aimed at car owners that reference Land Rover servicing in Kyiv.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a087b3-3465-76cb-8e07-dd57709ca2f4/
VirusTotal report: https://www.virustotal.com/gui/domain/lrservice.com.ua
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=lrservice.com.ua
Archived copy: https://web.archive.org/web/20261012213410/https://lrservice.com.ua/
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 09:26:22 UTC

## Stored page captures

- Primary capture: https://urlscan.io/screenshots/01a087b3-3465-76cb-8e07-dd57709ca2f4.png
  Captured: 2026-10-12 21:33:18 UTC
- URLScan capture: https://screenshots.phishdestroy.io/01a087b3-3465-76cb-8e07-dd57709ca2f4.png
  Captured: 2026-10-13 03:30:09 UTC
  Source report: https://urlscan.io/result/01a087b3-3465-76cb-8e07-dd57709ca2f4/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/1cdef14b-d07b-4f9f-a6a0-690d472ffe26.png
  Captured: 2026-10-12 21:34:48 UTC
  Source report: https://radar.cloudflare.com/scan/1cdef14b-d07b-4f9f-a6a0-690d472ffe26
  SHA-256: 88edcc83c7fdf5595db74d9f85f711d543371dac563b220c6036f95f2194fd41
- URLScan · 2026-08-13: https://screenshots.phishdestroy.io/us/019ffcba-7ff2-73de-a632-7166fbaa2193.png
  Captured: 2026-08-13 20:05:16 UTC
  Source report: https://urlscan.io/result/019ffcba-7ff2-73de-a632-7166fbaa2193/
  SHA-256: a87250a688f86142b7d9edc836e58e17b72b93a983194265e2718a5d5e6a4a24
- URLScan · 2026-09-09: https://screenshots.phishdestroy.io/us/01a08636-5bbf-7338-904e-2f405a1377e7.png
  Captured: 2026-09-09 12:48:35 UTC
  Source report: https://urlscan.io/result/01a08636-5bbf-7338-904e-2f405a1377e7/
  SHA-256: cf8608183cb50717f973846a93dd5ae74e5dc7665840764f20bca3f5387cae2d
- URLScan · 2026-10-12: https://screenshots.phishdestroy.io/us/01a1320a-6aeb-75dc-b5d3-08ca94feae56.png
  Captured: 2026-10-12 21:35:14 UTC
  Source report: https://urlscan.io/result/01a1320a-6aeb-75dc-b5d3-08ca94feae56/
  SHA-256: 638c4b32872e5d382ff229bae1d79b9826fc14745b1ac239db1878b7b5bc48bd

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-20T17:51:55Z",
        "uuid": "01a087b3-3465-76cb-8e07-dd57709ca2f4",
        "scanned_at": "2026-09-09T19:44:31Z",
        "final_url": "https://lrservice.com.ua/wp-includes/Southwire/KCY5735683679/Corporation/En/Outstanding-Invoices",
        "status": 404,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://lrservice.com.ua/wp-includes/Southwire/KCY5735683679/Corporation/En/Outstanding-Invoices",
                "from": "http://lrservice.com.ua/wp-includes/Southwire/KCY5735683679/Corporation/En/Outstanding-Invoices",
                "status": 307
            }
        ],
        "ip": "77.42.5.121",
        "ptr": "static.121.5.42.77.clients.your-server.de",
        "domains": [
            "my.binotel.ua",
            "widgets.binotel.com",
            "landrover-media.komliev.studio",
            "fonts.googleapis.com",
            "www.googletagmanager.com",
            "fonts.gstatic.com",
            "wschat1.binotel.com",
            "www.google.fi",
            "stats.g.doubleclick.net",
            "region1.analytics.google.com",
            "www.google-analytics.com",
            "connect.facebook.net"
        ],
        "ips": [
            "192.178.183.94",
            "142.251.13.94",
            "142.251.127.156",
            "216.239.34.36",
            "216.239.38.178",
            "45.91.130.36",
            "142.250.154.95",
            "142.251.110.97",
            "77.42.5.121"
        ],
        "asns": [
            "15169",
            "205722",
            "24940"
        ],
        "countries": [
            "US",
            "UA",
            "FI"
        ],
        "link_domains": [
            "www.landrover.ua",
            "service-calculator.landrover.ua",
            "landrover.ua",
            "komliev.studio",
            "t.me"
        ],
        "social": [
            "https://t.me/AutolifeJLR_bot"
        ],
        "doc_hash": "8a63498252d5bc80a2d488b12ca3c3e1444714a2d539df34b86a04a24a05dcd9",
        "script_hashes": [
            "ff84f53a41760cf70a6771bf9fe5a67683cc3318cb0bcc7dd0e67b7333431bdd",
            "22ba3c18584278dcd54a6700f9e7c607c597a1d92876eb6cd7472e8e4557bd39"
        ],
        "globals": [
            "mediaServerBase",
            "gtag",
            "dataLayer",
            "chatbox",
            "fbAsyncInit",
            "$",
            "jQuery",
            "Popper",
            "yii",
            "bootstrap",
            "_determinate",
            "_indeterminate",
            "_update",
            "_type",
            "_click",
            "_touch",
            "_add",
            "_remove",
            "_callback",
            "_label",
            "_cursor",
            "_mobile",
            "Inputmask",
            "Odometer",
            "InteractiveTab",
            "owlMainAutoplays",
            "timers",
            "closeHeaderDropdown",
            "closeBreadcrumbs",
            "moveSearch",
            "restructureLayout",
            "modelsSpecsHeight",
            "restructureModels",
            "scrolltime",
            "google_tag_data",
            "google_tag_manager",
            "GoogleAnalyticsObject",
            "ga",
            "gaGlobal",
            "BinotelGetCallSettings"
        ],
        "cookies": [
            "_csrf-frontend",
            "_ga_F0ECJ3RK0P",
            "_ga",
            "_gid",
            "_gat_gtag_UA_139713798_2",
            "biatv-cookie"
        ],
        "storage_keys": [
            "bwc.visitor-data.13890.with-expire",
            "bwc.tab.13890.QL3dKi6VmZpsHdWTaA",
            "bwc.widgetLang",
            "bwc.employee.13890.QL3dKi6VmZpsHdWTaA.with-expire",
            "bwc.teamSelectionState.13890.QL3dKi6VmZpsHdWTaA",
            "bwc.isWorkingTime.13890.with-expire",
            "bwc.chat-id.13890.QL3dKi6VmZpsHdWTaA",
            "bwc.chat-start-time.13890.QL3dKi6VmZpsHdWTaA",
            "bwc.items.13890.QL3dKi6VmZpsHdWTaA",
            "bwc.msg.13890.QL3dKi6VmZpsHdWTaA.dPGeD",
            "bwc.chat.open.13890.QL3dKi6VmZpsHdWTaA"
        ],
        "tls": {
            "san": [
                "admin.lrservice.com.ua",
                "lrservice.com.ua",
                "www.lrservice.com.ua"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "YE2",
            "subject": "lrservice.com.ua",
            "protocol": "TLS 1.3",
            "valid_to": "2026-11-11T19:05:11Z",
            "valid_from": "2026-08-13T19:05:12Z"
        },
        "domain_age_days": 2829,
        "apex_age_days": 2829,
        "tls_age_days": 27,
        "tls_valid_days": 89,
        "requests": 84,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 29,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "nginx/1.24.0 (Ubuntu)",
            "content-type": "text/html; charset=UTF-8"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-20T18:03:05Z",
        "uuid": "1cdef14b-d07b-4f9f-a6a0-690d472ffe26",
        "scanned_at": "2026-10-12T21:34:48Z",
        "final_url": "https://lrservice.com.ua/",
        "status": 200,
        "history": [
            {
                "url": "https://lrservice.com.ua/",
                "status": 200
            }
        ],
        "dom_hash": "61ff06ecc213219afd2d0cdb756433027858bb9d7f264de4e023659aac1ffbca",
        "doc_hash": "3e4c13626ff74cccf6d579e7d4833b9ed6fcfe92f7afe0e4879eadd844aaaa44",
        "domain_risks": [
            "Vehicles"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "lrservice.com.ua",
                "type": "A",
                "value": "77.42.5.121"
            }
        ],
        "dnssec_valid": false,
        "ip": "77.42.5.121",
        "whois": {
            "registrar": "ua.imena",
            "created": "2017-03-09T13:42:11Z",
            "updated": "2026-02-09T12:22:20Z",
            "expires": "2027-03-09T13:42:11Z",
            "nameservers": [
                "helium.ns.hetzner.de",
                "hydrogen.ns.hetzner.com",
                "oxygen.ns.hetzner.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-21T00:28:43Z",
        "analysis_at": "2026-10-16T02:00:27Z",
        "stats": {
            "timeout": 0,
            "harmless": 54,
            "malicious": 4,
            "suspicious": 2,
            "undetected": 32
        },
        "detections": {
            "VIPRE": "malware",
            "SOCRadar": "phishing",
            "URLQuery": "suspicious",
            "Seclookup": "malicious",
            "Gridinsoft": "suspicious",
            "alphaMountain.ai": "malicious"
        },
        "reputation": 0,
        "categories": {
            "alphaMountain.ai": "Malicious, Vehicles (alphaMountain.ai)"
        },
        "popularity": {
            "Alexa": 441788,
            "Statvoo": 441788
        },
        "registrar": "ua.imena",
        "expires": "2027-03-09T13:42:11Z",
        "first_seen": "2023-10-05T12:32:57Z",
        "dns": [
            {
                "ttl": 21600,
                "type": "NS",
                "value": "hydrogen.ns.hetzner.com"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "oxygen.ns.hetzner.com"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "helium.ns.hetzner.de"
            },
            {
                "ttl": 21600,
                "type": "SOA",
                "rname": "dns.hetzner.com",
                "value": "hydrogen.ns.hetzner.com"
            },
            {
                "ttl": 21600,
                "type": "MX",
                "value": "mail.lrservice.com.ua",
                "priority": 10
            },
            {
                "ttl": 21600,
                "type": "A",
                "value": "77.42.5.121"
            }
        ],
        "dns_at": "2026-10-16T02:00:42Z",
        "jarm": "27d40d40d00040d00042d43d0000007d20e9b9a3e87aa1ec17cb4d646ce9a5",
        "cert": {
            "san": [
                "admin.lrservice.com.ua",
                "lrservice.com.ua",
                "www.lrservice.com.ua"
            ],
            "issuer": "Let's Encrypt / YE1",
            "serial": "6582e7e8c4dfc0e9de30fbce632aa868441",
            "sha256": "ae25140543be19c4dc2bb5d439e46f028649988feee94cde688a68715ea8847b",
            "subject": "lrservice.com.ua",
            "valid_to": "2027-01-10T20:59:52Z",
            "valid_from": "2026-10-12T20:59:53Z"
        },
        "whois": {
            "registrar": "ua.imena"
        }
    }
}
```