# PhishDestroy domain threat record: pay-bitrefill.com-gift-esim-ar04.com

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/pay-bitrefill.com-gift-esim-ar04.com/
Machine-readable companion: https://phishdestroy.io/domain/pay-bitrefill.com-gift-esim-ar04.com/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-22 14:41:47 UTC
- Last availability or vendor check: 2026-10-22 14:41:47 UTC
- Stored record updated: 2026-10-22 18:30:23 UTC
- VirusTotal detections in the stored snapshot: 0/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: coingecko

## Stored infrastructure

- Observed IP address: 62.60.226.39
- Registrar in stored WHOIS data: NICENIC INTERNATIONAL GROUP CO., LIMITED
- Last stored HTTP status: 200
- Registration date (registry RDAP, com-gift-esim-ar04.com): 2026-10-22 14:01:19 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a1640e-9a4c-76a9-9f66-e04f06e1aec1/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/pay-bitrefill.com-gift-esim-ar04.com
- Certificate Transparency search: https://crt.sh/?q=%25.pay-bitrefill.com-gift-esim-ar04.com
- Web Archive lookup: https://web.archive.org/web/*/https://pay-bitrefill.com-gift-esim-ar04.com/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
PhishDestroy listed pay-bitrefill.com-gift-esim-ar04.com based on an admin report that noted insufficient page content for analysis. The recorded page title is “Cart – Bitrefill”. The domain was first seen by PhishDestroy on 2026-10-22 and returned an HTTP 200 response on that date.

How the scam works
No specific malicious behavior was observed on the page, so the listing does not confirm a particular fraud technique. Suspicious domains of this type often aim to impersonate legitimate services, lure users into providing credentials or payment information, or host malicious scripts, but none of these actions were directly detected here.

Evidence
VirusTotal scanned the domain on 2026-10-22 and reported 0 malicious or suspicious detections out of 92 engines. Google Safe Browsing checked the same day and did not flag the site. OTX showed 0 pulses as of 2026-10-22. URLScan’s machine‑learning engine gave a high malicious score (96) but its overall verdict was non‑malicious. PhishDestroy’s internal blocklist marks the domain as suspicious, while external blocklists returned no matches. The page metadata confirms the title “Cart – Bitrefill”.

Infrastructure
The recorded IP was 62.60.226.39 and the hosting organization was identified as Femo IT Solutions Limited in Germany. TLS is provided by Let’s Encrypt (certificate valid until 2027-01-20). DNS is served by Cloudflare nameservers martin.ns.cloudflare.com and sunny.ns.cloudflare.com. The domain and its TLS certificate were created on the day of first observation, indicating a very recent registration.

What to do
If you visited the site and entered any login credentials or personal data, change those passwords immediately and monitor associated accounts for unauthorized activity. Do not approve any cryptocurrency transactions linked to this domain. Network defenders should block the exact hostname and monitor outbound traffic to the recorded IP address. Review web proxy and firewall logs for any connections to pay-bitrefill.com-gift-esim-ar04.com and investigate any related alerts.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a1640e-9a4c-76a9-9f66-e04f06e1aec1/
Cloudflare Radar report: https://radar.cloudflare.com/scan/752a8069-1823-4e14-a918-a383ecbae45f
Stored capture screenshot: https://i.ibb.co/qt7FtZS/6e5c2bcd9384.png
Cloudflare Radar screenshot (2026-10-22T15:12:35Z): https://screenshots.phishdestroy.io/cf/752a8069-1823-4e14-a918-a383ecbae45f.png
URLScan screenshot (2026-10-22T14:44:43Z): https://screenshots.phishdestroy.io/us/01a16412-3449-7005-ac87-e27da24eda0b.png
URLScan capture report: https://urlscan.io/result/01a16412-3449-7005-ac87-e27da24eda0b/
VirusTotal report: https://www.virustotal.com/gui/domain/pay-bitrefill.com-gift-esim-ar04.com
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=pay-bitrefill.com-gift-esim-ar04.com
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-22 15:44:14 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/qt7FtZS/6e5c2bcd9384.png
  Captured: 2026-10-22 14:41:47 UTC
- URLScan capture: https://screenshots.phishdestroy.io/01a1640e-9a4c-76a9-9f66-e04f06e1aec1.png
  Captured: 2026-10-22 14:41:47 UTC
  Source report: https://urlscan.io/result/01a1640e-9a4c-76a9-9f66-e04f06e1aec1/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/752a8069-1823-4e14-a918-a383ecbae45f.png
  Captured: 2026-10-22 15:12:35 UTC
  Source report: https://radar.cloudflare.com/scan/752a8069-1823-4e14-a918-a383ecbae45f
  SHA-256: 47e4c80f93f43b86d1fd3247e58fba9bca02b72afcecf1e8deb6747db4496388
- URLScan · 2026-10-22: https://screenshots.phishdestroy.io/us/01a16412-3449-7005-ac87-e27da24eda0b.png
  Captured: 2026-10-22 14:44:43 UTC
  Source report: https://urlscan.io/result/01a16412-3449-7005-ac87-e27da24eda0b/
  SHA-256: 1d1ae616a367daea209f095b1253717bd997b156972d221bac2f93a43bc348d9

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-22T15:12:50Z",
        "uuid": "01a1640e-9a4c-76a9-9f66-e04f06e1aec1",
        "scanned_at": "2026-10-22T14:40:55Z",
        "final_url": "https://pay-bitrefill.com-gift-esim-ar04.com/",
        "status": 200,
        "ip": "62.60.226.39",
        "domains": [
            "superwebvizor.com",
            "us-assets.i.posthog.com"
        ],
        "ips": [
            "104.20.17.167",
            "85.137.251.205",
            "62.60.226.39"
        ],
        "asns": [
            "13335",
            "57043",
            "214351"
        ],
        "countries": [
            "NL",
            "DE"
        ],
        "link_domains": [
            "bitrefill.com-gift-esim-ar04.com"
        ],
        "doc_hash": "2c160fd6a46febf9038935873f01bae1291808933d682cf332f521158fc65643",
        "script_hashes": [
            "dc150c3cbc894410897f7ec882f97ace8d59ee4fd410ae851a24941c432e38b8",
            "2c160fd6a46febf9038935873f01bae1291808933d682cf332f521158fc65643",
            "be3245950b35428e6b391b9a419397c48a5812c9ca2bab34fd2426a4422d5ea5"
        ],
        "globals": [
            "__APP_CONFIG__",
            "__visorLoaded",
            "visor",
            "__VUE_INSTANCE_SETTERS__",
            "__VUE_SSR_SETTERS__",
            "__VUE__",
            "__PosthogExtensions__",
            "posthog",
            "rrweb",
            "__visorRrweb",
            "_POSTHOG_REMOTE_CONFIG",
            "postHogWebVitalsCallbacks",
            "extendPostHogWithSurveys"
        ],
        "cookies": [
            "ph_phc_s7J7jXgM4vuJrTgvG73pdKgzBahMFYbQPaMhpcYUsEoF_posthog"
        ],
        "storage_keys": [
            "__visor_test",
            "visor_session",
            "visor_vid",
            "visor_cfg_demo",
            "__support__",
            "ph_phc_s7J7jXgM4vuJrTgvG73pdKgzBahMFYbQPaMhpcYUsEoF_primary_window_exists",
            "ph_phc_s7J7jXgM4vuJrTgvG73pdKgzBahMFYbQPaMhpcYUsEoF_session_registered_propertie",
            "__mplssupport__",
            "ph_phc_s7J7jXgM4vuJrTgvG73pdKgzBahMFYbQPaMhpcYUsEoF_posthog",
            "test",
            "ph_phc_s7J7jXgM4vuJrTgvG73pdKgzBahMFYbQPaMhpcYUsEoF_window_id"
        ],
        "tls": {
            "san": [
                "pay-bitrefill.com-gift-esim-ar04.com",
                "www.pay-bitrefill.com-gift-esim-ar04.com"
            ],
            "cipher": "AES_256_GCM",
            "issuer": "YR1",
            "subject": "pay-bitrefill.com-gift-esim-ar04.com",
            "protocol": "TLS 1.3",
            "valid_to": "2027-01-20T13:03:58Z",
            "valid_from": "2026-10-22T13:03:59Z"
        },
        "domain_age_days": 0,
        "apex_age_days": 0,
        "tls_age_days": 0,
        "tls_valid_days": 89,
        "requests": 25,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 96,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "nginx/1.30.5",
            "content-type": "text/html; charset=UTF-8"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-22T15:12:52Z",
        "uuid": "752a8069-1823-4e14-a918-a383ecbae45f",
        "scanned_at": "2026-10-22T15:12:35Z",
        "final_url": "https://pay-bitrefill.com-gift-esim-ar04.com/",
        "status": 200,
        "history": [
            {
                "url": "https://pay-bitrefill.com-gift-esim-ar04.com/",
                "status": 200
            }
        ],
        "dom_hash": "e5e4e270a03e42ebc98638d7267d32f92ef4db18e7877891c820e1ec43db0d0a",
        "doc_hash": "2c160fd6a46febf9038935873f01bae1291808933d682cf332f521158fc65643",
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "pay-bitrefill.com-gift-esim-ar04.com",
                "type": "A",
                "value": "62.60.226.39"
            }
        ],
        "dnssec_valid": false,
        "ip": "62.60.226.39",
        "whois": {
            "registrar": "NICENIC INTERNATIONAL GROUP CO., LIMITED",
            "created": "2026-10-22T14:01:19Z",
            "updated": "2026-10-22T14:01:19Z",
            "expires": "2027-10-22T14:01:19Z",
            "nameservers": [
                "martin.ns.cloudflare.com",
                "sunny.ns.cloudflare.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-22T15:43:52Z",
        "analysis_at": "2026-10-22T14:12:51Z",
        "stats": {
            "timeout": 0,
            "harmless": 53,
            "malicious": 0,
            "suspicious": 0,
            "undetected": 39
        },
        "reputation": 0,
        "tags": [
            "dga"
        ],
        "registrar": "NICENIC INTERNATIONAL GROUP CO., LIMITED",
        "created": "2026-10-22T14:01:19Z",
        "expires": "2027-10-22T14:01:19Z",
        "updated": "2026-10-22T14:01:19Z",
        "first_seen": "2026-10-22T14:13:07Z",
        "dns": [
            {
                "ttl": 3600,
                "type": "A",
                "value": "62.60.226.39"
            }
        ],
        "dns_at": "2026-10-22T14:13:07Z",
        "jarm": "2ad2ad0002ad2ad00042d42d00000000f78d2dc0ce6e5bbc5b8149a4872356",
        "cert": {
            "san": [
                "pay-bitrefill.com-gift-esim-ar04.com",
                "www.pay-bitrefill.com-gift-esim-ar04.com"
            ],
            "issuer": "Let's Encrypt / YR1",
            "serial": "651a6541f2416927688b2c0050357d451d5",
            "sha256": "f4652417cec9c921a8cdfbb382a2fca9beb886b2ea551d5615a5a8997d3d2e63",
            "subject": "pay-bitrefill.com-gift-esim-ar04.com",
            "valid_to": "2027-01-20T13:03:58Z",
            "valid_from": "2026-10-22T13:03:59Z"
        },
        "whois": {
            "registrar": "NICENIC INTERNATIONAL GROUP CO., LIMITED",
            "registrar_iana_id": "3765",
            "registrar_url": "https://nicenic.com",
            "created": "2026-10-22T14:01:19Z",
            "updated": "2026-10-22T14:01:19Z",
            "expires": "2027-10-22T14:01:19Z",
            "status": [
                "clientDeleteProhibited",
                "clientTransferProhibited"
            ],
            "nameservers": [
                "martin.ns.cloudflare.com",
                "sunny.ns.cloudflare.com"
            ],
            "dnssec": "unsigned"
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-22T15:13:13Z",
        "caa_records": {
            "domain": "pay-bitrefill.com-gift-esim-ar04.com"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_count": 0
        },
        "archives": {
            "last": "2026-10-22T14:43:50Z",
            "first": "2026-10-22T14:43:50Z",
            "changes": 0,
            "days_archived": 1,
            "avg_page_bytes": 1065
        },
        "social_tags": {
            "title": "Cart - Bitrefill"
        },
        "trackers": {
            "requests": 18,
            "trackers": [
                {
                    "name": "PostHog",
                    "company": "PostHog",
                    "country": "US",
                    "category": "Site Analytics",
                    "requests": 5
                }
            ]
        },
        "mixed_content": {
            "no_sri": [
                "https://superwebvizor.com/visor.js"
            ],
            "third_party_scripts": 1
        },
        "status": {
            "up": true,
            "code": 200,
            "timings": {
                "dns": 2,
                "tls": 28,
                "wait": 37,
                "connect": 26,
                "download": 1
            },
            "response_ms": 94
        },
        "tls_connection": {
            "alpn": "http/1.1",
            "cipher": "TLS_AES_256_GCM_SHA384",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                21,
                22,
                25,
                80,
                110,
                143,
                443,
                587,
                993,
                995,
                8888
            ]
        },
        "carbon": {
            "bytes": 757,
            "co2_grams": 0,
            "cleaner_than": 95
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "162.159.44.87",
                    "host": "martin.ns.cloudflare.com"
                },
                {
                    "ip": "162.159.38.166",
                    "host": "sunny.ns.cloudflare.com"
                }
            ],
            "zone": "com-gift-esim-ar04.com"
        },
        "location": {
            "ip": "62.60.226.39",
            "asn": "214351",
            "org": "Femo IT Solutions Limited",
            "city": "Frankfurt am Main",
            "country": "DE"
        },
        "ssl": {
            "issuer": "Let's Encrypt / YR1",
            "subject": "pay-bitrefill.com-gift-esim-ar04.com"
        },
        "dns": {
            "A": [
                "62.60.226.39"
            ]
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "hsts": {
            "message": "Site does not serve any HSTS headers."
        },
        "http_security": {
            "xFrameOptions": false,
            "referrerPolicy": false,
            "xXSSProtection": false,
            "permissionsPolicy": false,
            "xContentTypeOptions": false,
            "contentSecurityPolicy": false,
            "strictTransportPolicy": false,
            "crossOriginOpenerPolicy": false,
            "crossOriginEmbedderPolicy": false,
            "crossOriginResourcePolicy": false
        },
        "get_ip": {
            "ip": "62.60.226.39",
            "family": 4
        },
        "redirects": {
            "chain": [
                "https://pay-bitrefill.com-gift-esim-ar04.com"
            ]
        },
        "subdomains": {
            "count": 4,
            "subdomains": [
                "bitrefill.com-gift-esim-ar04.com",
                "pay-bitrefill.com-gift-esim-ar04.com",
                "www.bitrefill.com-gift-esim-ar04.com",
                "www.pay-bitrefill.com-gift-esim-ar04.com"
            ]
        },
        "tech_stack": {
            "technologies": [
                "Cart Functionality",
                "Vue.js",
                "Nginx",
                "PostHog"
            ]
        },
        "whois": {
            "registrar": "NICENIC INTERNATIONAL GROUP CO., LIMITED",
            "created": "2026-10-22T14:01:19Z",
            "updated": "2026-10-22T14:01:19Z",
            "expires": "2027-10-22T14:01:19Z",
            "status": [
                "clientDeleteProhibited https://icann.org/epp",
                "clientTransferProhibited https://icann.org/epp"
            ],
            "nameservers": [
                "martin.ns.cloudflare.com",
                "sunny.ns.cloudflare.com"
            ]
        },
        "headers": {
            "headers": {
                "server": "nginx/1.30.5",
                "content-type": "text/html; charset=UTF-8"
            }
        }
    }
}
```