# PhishDestroy domain threat record: myservicesona.shop

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/myservicesona.shop/
Machine-readable companion: https://phishdestroy.io/domain/myservicesona.shop/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-26 12:18:00 UTC
- Last availability or vendor check: 2026-10-26 12:18:00 UTC
- Stored record updated: 2026-10-26 23:24:55 UTC
- VirusTotal detections in the stored snapshot: 1/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored infrastructure

- Observed IP address: 43.166.131.150
- Registrar in stored WHOIS data: Dynadot Inc.
- Last stored HTTP status: 200
- Registration date in stored WHOIS data: 2026-10-16 03:19:55 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a17824-ae9b-73c8-a59b-a00fef7879ee/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/myservicesona.shop
- Certificate Transparency search: https://crt.sh/?q=%25.myservicesona.shop
- Web Archive lookup: https://web.archive.org/web/*/https://myservicesona.shop/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
The captured screenshot dated 2026-10-26 shows a green welcome page headed Welcome to OpenResty!, offering documentation, support, a YouTube channel and blog buttons, product cards for OpenResty XRay and OpenResty Edge, and a row of blog thumbnails. PhishDestroy listed the domain after intake on 2026-10-26 under a young-domain rule, with first seen 2026-10-26 and registration recorded on 2026-10-16.

How the scam works
The page trades on the OpenResty name, presenting official-looking product and blog material so that a ten-day-old domain appears established and trustworthy. As a category risk, brand-lure landing pages can stage redirects or later swap in credential, download or payment forms while the domain builds reputation. No credential form was visible in this capture, so the observed stage is brand-lure staging rather than a data-entry point.

Evidence
The screenshot shows the OpenResty welcome heading, product cards, blog thumbnails and outbound brand buttons, with no login or payment form present. On 2026-10-26 the urlscan ML engine scored it malicious at 77 while its overall verdict stayed non-malicious, and the captured scan followed a redirect chain ending at a query path on myservicesona.shop. VirusTotal did not flag the domain, with Gridinsoft labelling it suspicious; Google Safe Browsing did not flag it; Spamhaus did not list it; external blocklists recorded none while the PhishDestroy internal blocklist flagged it; OTX recorded 3 pulses. Site inspection found a canvas runner game script stack (createCanvas, RunnerClasses, decodeBase64ToArrayBuffer) instead of a mainstream UI framework, 1 tracker request, and stored capture hashes for pivoting such as 4dc56440ea94.

Infrastructure
Notable weaknesses lead: CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, COOP, COEP and CORP are all absent; DNSSEC is unsigned; SPF lookups are zero with no DKIM or DMARC evidence. TLS 1.3 with TLS_AES_256_GCM_SHA384, forward secrecy and ALPN h2; CAA records present. Registration was recorded through Dynadot Inc. on 2026-10-16, the recorded hosting network was Aceville Pte.ltd, and no WAF was identified.

What to do
If you entered credentials or personal data after visiting, change that password on the genuine service, enable 2FA, and watch for follow-up messages. Security teams should block the exact domain myservicesona.shop, retain the recorded capture hashes for pivoting, and alert on the young-domain brand-lure pattern.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a17824-ae9b-73c8-a59b-a00fef7879ee/
Cloudflare Radar report: https://radar.cloudflare.com/scan/df4fcd31-20c2-4983-90d3-d47012dacbd6
URLQuery report: https://urlquery.net/report/91101bba-0034-4b5a-bf86-df09eaab99d2
Stored capture screenshot: https://i.ibb.co/prrPzkWm/3a0888628103.png
Cloudflare Radar screenshot (2026-10-26T12:52:08Z): https://screenshots.phishdestroy.io/cf/df4fcd31-20c2-4983-90d3-d47012dacbd6.png
URLQuery screenshot: https://screenshots.phishdestroy.io/uq/91101bba-0034-4b5a-bf86-df09eaab99d2.png
URLScan screenshot (2026-10-26T12:19:16Z): https://screenshots.phishdestroy.io/us/01a17826-5269-75ac-b7c1-27b8a31fbbc5.png
URLScan capture report: https://urlscan.io/result/01a17826-5269-75ac-b7c1-27b8a31fbbc5/
VirusTotal report: https://www.virustotal.com/gui/domain/myservicesona.shop
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=myservicesona.shop
Archived copy: https://web.archive.org/web/20261026121824/https://myservicesona.shop/
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-26 20:15:50 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/prrPzkWm/3a0888628103.png
  Captured: 2026-10-26 12:18:00 UTC
- URLScan capture 1: https://urlscan.io/screenshots/01a17824-ae9b-73c8-a59b-a00fef7879ee.png
  Captured: 2026-10-26 12:18:00 UTC
  Source report: https://urlscan.io/result/01a17824-ae9b-73c8-a59b-a00fef7879ee/
- URLScan · 2026-10-26: https://screenshots.phishdestroy.io/us/01a17826-5269-75ac-b7c1-27b8a31fbbc5.png
  Captured: 2026-10-26 12:19:16 UTC
  Source report: https://urlscan.io/result/01a17826-5269-75ac-b7c1-27b8a31fbbc5/
  SHA-256: 88d8b58daffe266b8752c36773f3772d43caea254eed046e2cbcf87da005f12a
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/df4fcd31-20c2-4983-90d3-d47012dacbd6.png
  Captured: 2026-10-26 12:52:08 UTC
  Source report: https://radar.cloudflare.com/scan/df4fcd31-20c2-4983-90d3-d47012dacbd6
  SHA-256: 4dc56440ea94fe78dbf20f6d5a8982bc3d5b0222576af385ac9f4748fad3f6a3
- URLQuery: https://screenshots.phishdestroy.io/uq/91101bba-0034-4b5a-bf86-df09eaab99d2.png
  Source report: https://urlquery.net/report/91101bba-0034-4b5a-bf86-df09eaab99d2
  SHA-256: 39e71f64e23818129062b236303a18e1cb2347b93600e783b7066c006de12aa1

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-26T12:52:32Z",
        "uuid": "01a17824-ae9b-73c8-a59b-a00fef7879ee",
        "scanned_at": "2026-10-26T12:17:19Z",
        "final_url": "https://myservicesona.shop/query/a_index.html",
        "globals": [
            "assert",
            "getRequiredElement",
            "P",
            "S",
            "getRandomNum",
            "getTimeStamp",
            "Dimensions",
            "Config$2",
            "getGlobalConfig",
            "setGlobalConfig",
            "Config$1",
            "Config",
            "setMaxGapCoefficient",
            "setMaxObstacleLength",
            "Status",
            "A11yStrings",
            "RunnerClasses",
            "RunnerSounds",
            "RunnerEvents",
            "updateCanvasScaling",
            "getA11yString",
            "vibrate",
            "createCanvas",
            "decodeBase64ToArrayBuffer",
            "createAdjustedCollisionBox",
            "drawCollisionBoxes",
            "boxCompare",
            "toggleHelpBox",
            "diagnoseErrors",
            "portalSignin",
            "updateForDnsProbe",
            "getMainFrameErrorCssClass",
            "getMainFrameErrorIconCssClass",
            "getSubFrameErrorIconCssClass",
            "shouldShowSuggestionsSummaryList",
            "getSuggestionsSummaryItemCssClass",
            "reloadButtonClick",
            "downloadButtonClick",
            "detailsButtonClick",
            "setAutoFetchState"
        ],
        "domain_age_days": 8,
        "apex_age_days": 8,
        "requests": 8,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 77,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "content-type": "image/png"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-26T12:52:34Z",
        "uuid": "df4fcd31-20c2-4983-90d3-d47012dacbd6",
        "scanned_at": "2026-10-26T12:52:08Z",
        "final_url": "https://myservicesona.shop/",
        "status": 200,
        "history": [
            {
                "url": "https://myservicesona.shop/",
                "status": 200
            }
        ],
        "dom_hash": "e9a2a70d82f470082608dd2ee9b5df20f86cad11160536bf283f057edbc7a278",
        "doc_hash": "8d374d23d4bc454767b8d4eeda8c3020a4f878a29207e31d74f6a1e55d4b7c4b",
        "domain_risks": [
            "Newly Seen Domains",
            "Security Risks",
            "New Domains"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "myservicesona.shop",
                "type": "A",
                "value": "43.166.131.150"
            }
        ],
        "dnssec_valid": false,
        "ip": "43.166.131.150"
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-26T12:52:00Z",
        "analysis_at": "2026-10-18T15:48:21Z",
        "stats": {
            "timeout": 0,
            "harmless": 53,
            "malicious": 0,
            "suspicious": 1,
            "undetected": 38
        },
        "detections": {
            "Gridinsoft": "suspicious"
        },
        "reputation": 0,
        "first_seen": "2026-10-16T05:54:48Z",
        "dns": [
            {
                "ttl": 300,
                "type": "NS",
                "value": "ns2.dyna-ns.net"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "43.166.131.150"
            },
            {
                "ttl": 300,
                "type": "SOA",
                "rname": "hostmaster.myservicesona.shop",
                "value": "ns1.dyna-ns.net"
            },
            {
                "ttl": 300,
                "type": "NS",
                "value": "ns1.dyna-ns.net"
            }
        ],
        "dns_at": "2026-10-18T16:21:41Z",
        "jarm": "28d28d28d00028d00042d42d000000e1ea2a807a629b496b664cf07ad7c08d",
        "cert": {
            "san": [
                "myservicesona.shop"
            ],
            "issuer": "Let's Encrypt / YE2",
            "serial": "55de8fad3c7329715025f1c05990f43581b",
            "sha256": "33337e435f7a0bb410552860667e87ff35a4eb587e49bcb3642f1f4a39924df1",
            "subject": "myservicesona.shop",
            "valid_to": "2027-01-14T04:43:32Z",
            "valid_from": "2026-10-16T04:43:33Z"
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-26T12:19:47Z",
        "mail_config": {
            "spf_lookups": 0
        },
        "caa_records": {
            "domain": "myservicesona.shop"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_count": 0
        },
        "archives": {
            "last": "2026-10-26T12:18:24Z",
            "first": "2026-10-16T14:26:26Z",
            "changes": 0,
            "days_archived": 2,
            "scans_per_day": 0.1,
            "avg_page_bytes": 46281
        },
        "social_tags": {
            "title": "Welcome to OpenResty!"
        },
        "trackers": {
            "requests": 1
        },
        "mixed_content": {
            "third_party_scripts": 0
        },
        "status": {
            "up": true,
            "code": 200,
            "timings": {
                "dns": 289,
                "tls": 134,
                "wait": 211,
                "connect": 191,
                "download": 208
            },
            "response_ms": 1033
        },
        "tls_connection": {
            "alpn": "h2",
            "cipher": "TLS_AES_256_GCM_SHA384",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                22,
                80,
                443
            ]
        },
        "carbon": {
            "bytes": 128646,
            "co2_grams": 0.0047,
            "cleaner_than": 16
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "162.159.27.158",
                    "host": "ns1.dyna-ns.net"
                },
                {
                    "ip": "162.159.24.5",
                    "host": "ns2.dyna-ns.net"
                }
            ],
            "zone": "myservicesona.shop"
        },
        "location": {
            "ip": "43.166.131.150",
            "asn": "132203",
            "org": "Aceville Pte.ltd",
            "city": "Ashburn",
            "country": "US"
        },
        "ssl": {
            "issuer": "Let's Encrypt / YE2",
            "subject": "myservicesona.shop"
        },
        "dns": {
            "A": [
                "43.166.131.150"
            ],
            "NS": [
                "ns1.dyna-ns.net",
                "ns2.dyna-ns.net"
            ],
            "SOA": "{\"nsname\": \"ns1.dyna-ns.net\", \"hostmaster\": \"hostmaster.myservicesona.shop\", \"serial\": 2026101901, \"refresh\": 16384, \"retry\": 2048, \"expire\": 1209600, \"minttl\": 300}"
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "hsts": {
            "message": "Site does not serve any HSTS headers."
        },
        "http_security": {
            "xFrameOptions": false,
            "referrerPolicy": false,
            "xXSSProtection": false,
            "permissionsPolicy": false,
            "xContentTypeOptions": false,
            "contentSecurityPolicy": false,
            "strictTransportPolicy": false,
            "crossOriginOpenerPolicy": false,
            "crossOriginEmbedderPolicy": false,
            "crossOriginResourcePolicy": false
        },
        "get_ip": {
            "ip": "43.166.131.150",
            "family": 4
        },
        "redirects": {
            "chain": [
                "https://myservicesona.shop"
            ]
        },
        "linked_pages": {
            "external": [
                "https://openresty.org/",
                "https://openresty.com/",
                "https://www.youtube.com/channel/UCXVmwF-UCScv2ftsGoMqxhw",
                "https://blog.openresty.com/",
                "https://openresty.com/en/xray/",
                "https://openresty.com/en/edge/",
                "https://blog.openresty.com/en/xray-azure/",
                "https://blog.openresty.com/en/ysql-count-ngx-reqs/",
                "https://blog.openresty.com/en/edge-enable-waf/",
                "https://blog.openresty.com/en/edge-edgelang/",
                "https://blog.openresty.com/en/edge-upstream-real-ip/"
            ],
            "external_count": 11
        },
        "headers": {
            "headers": {
                "server": "openresty/1.31.1.1",
                "content-type": "text/html"
            }
        }
    }
}
```