# PhishDestroy domain threat record: morenoa.shop

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/morenoa.shop/
Machine-readable companion: https://phishdestroy.io/domain/morenoa.shop/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-26 11:35:53 UTC
- Last availability or vendor check: 2026-10-26 11:35:53 UTC
- Stored record updated: 2026-10-26 20:25:17 UTC
- VirusTotal detections in the stored snapshot: 7/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored infrastructure

- Observed IP address: 43.153.77.222
- Registrar in stored WHOIS data: Spaceship, Inc.
- Last stored HTTP status: 200
- Registration date in stored WHOIS data: 2026-10-07 00:00:18 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a177fd-d841-74f4-ab7a-f014a0ff9a2e/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/morenoa.shop
- Certificate Transparency search: https://crt.sh/?q=%25.morenoa.shop
- Web Archive lookup: https://web.archive.org/web/*/https://morenoa.shop/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
The captured screenshot from 2026-10-26 shows a Polish-language furniture storefront branded Black Red White, with a banner advertising Halloween discounts up to 80 percent and free shipping. A BIG SALE popup offers PLN coupon vouchers of 20 to 100 above a GET IT ALL button, alongside a TRUSTED STORE badge. PhishDestroy listed the domain after VirusTotal flagged it as malicious and a urlscan capture returned a malicious verdict, with first observation on 2026-10-26.

How the scam works
The coupon tiers act as the hook, a visitor drawn in by the Halloween discount is pushed toward GET IT ALL and an order flow where card details, an email address or a password could be harvested under the guise of a furniture purchase. As a category risk, the page mimics an established retailer's catalogue and trust badge to lower suspicion before checkout.

Evidence
The screenshot shows the PLN coupon vouchers, the GET IT ALL call to action and a TRUSTED STORE badge over a Halloween promotion banner. urlscan returned a malicious engine verdict with an ML score of 82 on 2026-10-26, and VirusTotal flagged the domain as malicious with phishing labels from Forcepoint ThreatSeeker, G-Data and SOCRadar. Spamhaus listed it in the DBL as spam on 2026-10-26, Open Threat Exchange recorded 5 pulses on 2026-10-26, external blocklists counted 0 entries, PhishDestroy's internal blocklist was active, and Google Safe Browsing was not flagged on 2026-10-26. Cloudflare Radar returned a malicious verdict tagged malware and phishing on 2026-10-26, the redirect chain never left morenoa.shop, and requests reached Meta Facebook, TikTok Analytics and Google trackers.

Infrastructure
Registered through Spaceship, Inc. on 2026-10-07, nginx served the recorded address and no WAF or firewall appeared in the capture. Notable weaknesses: CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, COOP, COEP and CORP all absent; no SPF, DKIM or DMARC; CAA present; DNSSEC unsigned; TLS 1.3 with TLS-AES-256-GCM-SHA384, forward secrecy and ALPN http/1.1.

What to do
If you submitted payment details, contact your card issuer about possible fraudulent charges and monitor statements for further attempts. If you gave a password, change it on the genuine service and enable two-factor authentication. Security teams should block morenoa.shop at the proxy and DNS layers and hunt for related lures using this domain.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a177fd-d841-74f4-ab7a-f014a0ff9a2e/
Cloudflare Radar report: https://radar.cloudflare.com/scan/faca435b-1e85-44c5-8b5b-6e577adf8318
URLQuery report: https://urlquery.net/report/8456e591-9f26-43d6-a1ff-92e72780b03a
Stored capture screenshot: https://i.ibb.co/WN8kjn7G/f4e7b6f98660.png
Cloudflare Radar screenshot (2026-10-26T12:06:19Z): https://screenshots.phishdestroy.io/cf/faca435b-1e85-44c5-8b5b-6e577adf8318.png
URLQuery screenshot: https://screenshots.phishdestroy.io/uq/8456e591-9f26-43d6-a1ff-92e72780b03a.png
URLScan screenshot (2026-10-25T12:31:11Z): https://screenshots.phishdestroy.io/us/01a1730a-a8cc-749f-a95a-165825f88373.png
URLScan capture report: https://urlscan.io/result/01a1730a-a8cc-749f-a95a-165825f88373/
URLScan screenshot (2026-10-26T11:15:56Z): https://screenshots.phishdestroy.io/us/01a177ec-371d-71a6-9ff2-7c614ef157f7.png
URLScan capture report: https://urlscan.io/result/01a177ec-371d-71a6-9ff2-7c614ef157f7/
URLScan screenshot (2026-10-26T11:39:58Z): https://screenshots.phishdestroy.io/us/01a17802-36e3-7478-843e-9e9694bd2ff8.png
URLScan capture report: https://urlscan.io/result/01a17802-36e3-7478-843e-9e9694bd2ff8/
VirusTotal report: https://www.virustotal.com/gui/domain/morenoa.shop
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=morenoa.shop
Archived copy: https://web.archive.org/web/20261026113448/https://morenoa.shop/
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-26 20:21:38 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/WN8kjn7G/f4e7b6f98660.png
  Captured: 2026-10-26 11:35:53 UTC
- URLScan capture 1: https://screenshots.phishdestroy.io/01a177fd-d841-74f4-ab7a-f014a0ff9a2e.png
  Captured: 2026-10-26 11:35:53 UTC
  Source report: https://urlscan.io/result/01a177fd-d841-74f4-ab7a-f014a0ff9a2e/
- URLScan · 2026-10-26: https://screenshots.phishdestroy.io/us/01a177ec-371d-71a6-9ff2-7c614ef157f7.png
  Captured: 2026-10-26 11:15:56 UTC
  Source report: https://urlscan.io/result/01a177ec-371d-71a6-9ff2-7c614ef157f7/
  SHA-256: b35f6f253fb76a339630285a4b4af2d00347023e380ff5d53f8ac1c462645848
- URLScan · 2026-10-25: https://screenshots.phishdestroy.io/us/01a1730a-a8cc-749f-a95a-165825f88373.png
  Captured: 2026-10-25 12:31:11 UTC
  Source report: https://urlscan.io/result/01a1730a-a8cc-749f-a95a-165825f88373/
  SHA-256: b35f6f253fb76a339630285a4b4af2d00347023e380ff5d53f8ac1c462645848
- URLScan · 2026-10-26: https://screenshots.phishdestroy.io/us/01a17802-36e3-7478-843e-9e9694bd2ff8.png
  Captured: 2026-10-26 11:39:58 UTC
  Source report: https://urlscan.io/result/01a17802-36e3-7478-843e-9e9694bd2ff8/
  SHA-256: 6dcfec30d5d66f7dbba08b571a352cc9c5bbd9b28a6083facce3b844cb62e5a2
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/faca435b-1e85-44c5-8b5b-6e577adf8318.png
  Captured: 2026-10-26 12:06:19 UTC
  Source report: https://radar.cloudflare.com/scan/faca435b-1e85-44c5-8b5b-6e577adf8318
  SHA-256: 9bd19f1190f616e4909c3d5a714324463e979c69707f2cede3ed8f8b252ad139
- URLQuery: https://screenshots.phishdestroy.io/uq/8456e591-9f26-43d6-a1ff-92e72780b03a.png
  Source report: https://urlquery.net/report/8456e591-9f26-43d6-a1ff-92e72780b03a
  SHA-256: 686a5210ecfc4c5eab472f59a452404adb15dc4abc519847fa55707065355a44

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-26T11:59:06Z",
        "uuid": "01a177fd-d841-74f4-ab7a-f014a0ff9a2e",
        "scanned_at": "2026-10-26T11:34:53Z",
        "final_url": "https://morenoa.shop/",
        "status": 200,
        "ip": "43.153.77.222",
        "ips": [
            "43.153.77.222"
        ],
        "asns": [
            "132203"
        ],
        "countries": [
            "US"
        ],
        "doc_hash": "6c5d74593398868b7285edba64f53c5db909a6fd2cf4052b5a617609d3b62b5d",
        "tls": {
            "san": [
                "morenoa.shop"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "YR2",
            "subject": "morenoa.shop",
            "protocol": "TLS 1.3",
            "valid_to": "2027-01-19T02:06:36Z",
            "valid_from": "2026-10-21T02:06:37Z"
        },
        "domain_age_days": 18,
        "apex_age_days": 18,
        "tls_age_days": 5,
        "tls_valid_days": 89,
        "requests": 2,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 82,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "nginx",
            "content-type": "text/html; charset=utf-8"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-26T12:40:43Z",
        "uuid": "faca435b-1e85-44c5-8b5b-6e577adf8318",
        "scanned_at": "2026-10-26T12:06:19Z",
        "final_url": "https://morenoa.shop/",
        "status": 200,
        "history": [
            {
                "url": "https://morenoa.shop/",
                "status": 200
            }
        ],
        "dom_hash": "1cb70d9cdca0698f79ef4341a006082badba280f80619424c7c0a70b0fa7dd64",
        "doc_hash": "18f30c9b31f90b583256f26c257a3758f9f64a2d9a45b9dbf83ea00f67ebe445",
        "phishing_v2": [
            "phishing"
        ],
        "domain_risks": [
            "Newly Seen Domains",
            "Security Risks",
            "Malware",
            "Security threats",
            "CIPA Filter",
            "CIPA"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "morenoa.shop",
                "type": "A",
                "value": "43.153.77.222"
            }
        ],
        "dnssec_valid": false,
        "ip": "43.153.77.222",
        "verdict": {
            "tags": [
                "malware"
            ],
            "malicious": true,
            "categories": [
                "malware"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-26T20:15:12Z",
        "analysis_at": "2026-10-25T12:27:33Z",
        "stats": {
            "timeout": 0,
            "harmless": 51,
            "malicious": 6,
            "suspicious": 1,
            "undetected": 34
        },
        "detections": {
            "CRDF": "malicious",
            "DNS8": "phishing",
            "G-Data": "phishing",
            "SOCRadar": "phishing",
            "Gridinsoft": "suspicious",
            "alphaMountain.ai": "phishing",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "categories": {
            "alphaMountain.ai": "Phishing (alphaMountain.ai)"
        },
        "first_seen": "2026-10-09T07:22:52Z",
        "dns": [
            {
                "ttl": 600,
                "type": "SOA",
                "rname": "dnsadmin.dnsip.com",
                "value": "ns1.dnsip.com"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "ns2.dnsip.com"
            },
            {
                "ttl": 600,
                "type": "A",
                "value": "43.153.77.222"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "ns1.dnsip.com"
            }
        ],
        "dns_at": "2026-10-25T12:33:17Z",
        "jarm": "15d3fd16d29d29d00042d43d00000041ad16ead50175e1e575f5579aa6b5c8",
        "cert": {
            "san": [
                "morenoa.shop"
            ],
            "issuer": "Let's Encrypt / YR2",
            "serial": "5ce11eece90aa5643aca5a071f687dffdae",
            "sha256": "2144e3ada69d4440c3cd8eeb8b37409502c9d054b841a5234ee57ba4b19bc999",
            "subject": "morenoa.shop",
            "valid_to": "2027-01-19T02:06:36Z",
            "valid_from": "2026-10-21T02:06:37Z"
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-26T12:08:10Z",
        "mail_config": {
            "spf_lookups": 0
        },
        "caa_records": {
            "domain": "morenoa.shop"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_by": [
                "CloudFlare Family"
            ],
            "blocked_count": 1
        },
        "archives": {
            "last": "2026-10-26T11:34:48Z",
            "first": "2026-10-08T09:56:02Z",
            "changes": 2,
            "days_archived": 3,
            "scans_per_day": 0.11,
            "avg_page_bytes": 64187
        },
        "social_tags": {
            "title": "500 Internal Server Error",
            "robots": "noindex, nofollow"
        },
        "trackers": {
            "requests": 74,
            "trackers": [
                {
                    "name": "Facebook",
                    "company": "Meta",
                    "country": "US",
                    "category": "Advertising",
                    "requests": 6
                },
                {
                    "name": "Google Translate",
                    "company": "Google",
                    "country": "US",
                    "category": "Customer Interaction",
                    "requests": 1
                },
                {
                    "name": "Google APIs",
                    "company": "Google",
                    "country": "US",
                    "category": "Hosting",
                    "requests": 1
                },
                {
                    "name": "Google Static",
                    "company": "Google",
                    "country": "US",
                    "category": "Hosting",
                    "requests": 5
                },
                {
                    "name": "Facebook Connect",
                    "company": "Meta",
                    "country": "US",
                    "category": "Site Analytics",
                    "requests": 6
                },
                {
                    "name": "TikTok Analytics",
                    "company": "ByteDance Inc",
                    "country": "KY",
                    "category": "Site Analytics",
                    "requests": 8
                }
            ]
        },
        "mixed_content": {
            "third_party_scripts": 0
        },
        "status": {
            "up": true,
            "code": 200,
            "timings": {
                "dns": 1062,
                "tls": 164,
                "wait": 207,
                "connect": 159,
                "download": 0
            },
            "response_ms": 1592
        },
        "tls_connection": {
            "alpn": "http/1.1",
            "cipher": "TLS_AES_256_GCM_SHA384",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "carbon": {
            "bytes": 219,
            "co2_grams": 0,
            "cleaner_than": 95
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "218.98.111.206",
                    "host": "ns1.dnsip.com"
                },
                {
                    "ip": "211.99.99.33",
                    "host": "ns2.dnsip.com"
                }
            ],
            "zone": "morenoa.shop"
        },
        "cookies": {
            "cookies": [
                {
                    "name": "_fbp"
                },
                {
                    "name": "_auth_debug"
                },
                {
                    "name": "_adhcid_vid"
                },
                {
                    "name": "_adhcid_cvid"
                },
                {
                    "name": "_adhcid_vs"
                },
                {
                    "name": "utm_source"
                },
                {
                    "name": "utm_medium"
                },
                {
                    "name": "order_utm_history"
                },
                {
                    "name": "landing_page"
                },
                {
                    "name": "_adhcid_ka"
                },
                {
                    "name": "first_http_referer"
                },
                {
                    "name": "first_visit_time"
                },
                {
                    "name": "PHPSESSID",
                    "session": true
                },
                {
                    "name": "_BBHBHAC_ua",
                    "secure": true,
                    "same_site": "None"
                },
                {
                    "name": "_BBHBHAC_pu",
                    "secure": true,
                    "same_site": "None"
                },
                {
                    "name": "_BBHBHAC_tz",
                    "secure": true,
                    "same_site": "None"
                },
                {
                    "name": "_BBHBHAC_ss",
                    "secure": true,
                    "same_site": "None"
                },
                {
                    "name": "_BBHBHAC_lang",
                    "secure": true,
                    "same_site": "None"
                },
                {
                    "name": "_BBHBHAC_vs",
                    "secure": true,
                    "same_site": "None"
                },
                {
                    "name": "_BBHBHAC_dt",
                    "secure": true,
                    "same_site": "None"
                }
            ]
        },
        "location": {
            "ip": "43.153.77.222",
            "asn": "132203",
            "org": "Shenzhen Tencent Computer Systems Company Limited",
            "city": "Santa Clara",
            "country": "US"
        },
        "ssl": {
            "issuer": "Let's Encrypt / YR2",
            "subject": "morenoa.shop"
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "hsts": {
            "message": "Site does not serve any HSTS headers."
        },
        "http_security": {
            "xFrameOptions": false,
            "referrerPolicy": false,
            "xXSSProtection": false,
            "permissionsPolicy": false,
            "xContentTypeOptions": false,
            "contentSecurityPolicy": false,
            "strictTransportPolicy": false,
            "crossOriginOpenerPolicy": false,
            "crossOriginEmbedderPolicy": false,
            "crossOriginResourcePolicy": false
        },
        "get_ip": {
            "ip": "43.153.77.222",
            "family": 4
        },
        "redirects": {
            "chain": [
                "https://morenoa.shop"
            ]
        },
        "subdomains": {
            "count": 1,
            "subdomains": [
                "www.morenoa.shop"
            ]
        },
        "headers": {
            "headers": {
                "server": "nginx",
                "content-type": "text/html; charset=utf-8"
            }
        }
    }
}
```