# pbu8z.com - Shopify loading screen capture | PhishDestroy Content language: English Canonical HTML report: https://phishdestroy.io/domain/pbu8z.com/ Machine-readable companion: https://phishdestroy.io/domain/pbu8z.com/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: Last known active - First observed by PhishDestroy: 2026-10-29 00:47:06 UTC - Selected availability observation: 2026-11-08T11:25:06Z - Stored record updated: 2026-11-08 15:23:34 UTC - VirusTotal detections in the stored snapshot: 19/92 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: checked_clean ## Stored labels and detections - Automated brand label (collector metadata; not a confirmed impersonation finding): Shopify ## Stored infrastructure - Observed IP address: 156.238.121.208 - Registrar in stored WHOIS data: Dynadot Inc - Last stored HTTP status: 200 (observed: 2026-11-08T11:25:06Z) ## Evidence links - URLScan report: https://urlscan.io/result/01a1851e-abb4-70e0-b9ed-36733b3bfd2d/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/pbu8z.com - Certificate Transparency search: https://crt.sh/?q=%25.pbu8z.com - Web Archive lookup: https://web.archive.org/web/*/https://pbu8z.com/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Public report package The stored pbu8z.com capture shows a Shopify-branded loading screen, while PhishDestroy's VirusTotal data flags the domain for review. The stored capture of pbu8z.com shows a Shopify-branded loading screen: a dark overlay with a spinner and the Spanish label "Cargando..." (loading). No further page content, forms, or interactive controls are visible in the screenshot, so the recorded page's purpose beyond this loading state cannot be determined from the image alone. The stored VirusTotal result reports 19 of 92 engines flagged the domain. Representative labels include ESET and Kaspersky marking it phishing, while Netcraft and SOCRadar labeled it malicious. PhishDestroy aggregates such scanner signals for review. Package revision: a9335f3b5ac7571d3cd9bf89c4567c812de596a0865d8096f3f6582105248a73 Text generated (not scan time): 2026-10-29 02:24:14 Reviewed evidence snapshot: {"domain":"pbu8z.com","screenshot_available":true,"page_title":"shopify","virustotal":{"detections":19,"engines":92,"malicious":19,"suspicious":0,"retrieved_date":"2026-10-29","analysis_date":"2026-10-28","flagging_vendors":["CRDF","DNS8","ESET","Ermes","G-Data","Lionic","Sophos","Webroot","Emsisoft","Fortinet","Netcraft","SOCRadar","URLQuery","Kaspersky","OpenPhish","Gridinsoft","BitDefender","alphaMountain.ai","Forcepoint ThreatSeeker"],"vendor_labels":{"CRDF":"malicious","DNS8":"phishing","ESET":"phishing","Ermes":"phishing","G-Data":"phishing","Lionic":"phishing","Sophos":"phishing","Webroot":"malicious","Emsisoft":"phishing","Fortinet":"phishing","Netcraft":"malicious","SOCRadar":"malicious","URLQuery":"malicious","Kaspersky":"phishing","OpenPhish":"phishing","Gridinsoft":"phishing","BitDefender":"phishing","alphaMountain.ai":"phishing","Forcepoint ThreatSeeker":"phishing"},"scope":"domain"},"capture_context":{"relationship":"screenshot associated with this domain record","captured_at":"2026-10-29T01:21:49Z","final_host":"pbu8z.com","captured_on":"2026-10-29"}} Source facts (timestamps as stored): {"record_id":1700843,"first_recorded_at":"2026-10-29 01:47:06","virustotal":{"source":"VirusTotal","scope":"unknown","result_state":"complete","numerator":19,"denominator":92,"malicious":19,"suspicious":0,"vendors":{"CRDF":"malicious","DNS8":"phishing","ESET":"phishing","Ermes":"phishing","G-Data":"phishing","Lionic":"phishing","Sophos":"phishing","Webroot":"malicious","Emsisoft":"phishing","Fortinet":"phishing","Netcraft":"malicious","SOCRadar":"malicious","URLQuery":"malicious","Kaspersky":"phishing","OpenPhish":"phishing","Gridinsoft":"phishing","BitDefender":"phishing","alphaMountain.ai":"phishing","Forcepoint ThreatSeeker":"phishing"},"observed_at":"2026-10-28T22:43:29Z","checked_at":null,"fetched_at":"2026-10-29T01:21:13Z","time_basis":"UTC (provider ISO timestamps)","stored_summary":{"source":"VirusTotal","scope":"unknown","result_state":"observed","numerator":19,"denominator":92,"malicious":null,"suspicious":null,"vendors":["alphaMountain.ai","BitDefender","CRDF","DNS8","Ermes","ESET","Emsisoft","Forcepoint ThreatSeeker","Fortinet","G-Data","Gridinsoft","Kaspersky","Lionic","Netcraft","OpenPhish","SOCRadar","Sophos","URLQuery","Webroot"],"observed_at":"2026-10-28 22:43:29","checked_at":"2026-10-29 02:21:18","fetched_at":"2026-10-29 01:21:18","time_basis":"as stored; legacy timezone not established"},"record_source":"phishdestroy.technologies.vt","vendor_labels":{"CRDF":"malicious","DNS8":"phishing","ESET":"phishing","Ermes":"phishing","G-Data":"phishing","Lionic":"phishing","Sophos":"phishing","Webroot":"malicious","Emsisoft":"phishing","Fortinet":"phishing","Netcraft":"malicious","SOCRadar":"malicious","URLQuery":"malicious","Kaspersky":"phishing","OpenPhish":"phishing","Gridinsoft":"phishing","BitDefender":"phishing","alphaMountain.ai":"phishing","Forcepoint ThreatSeeker":"phishing"},"vendor_names":["CRDF","DNS8","ESET","Ermes","G-Data","Lionic","Sophos","Webroot","Emsisoft","Fortinet","Netcraft","SOCRadar","URLQuery","Kaspersky","OpenPhish","Gridinsoft","BitDefender","alphaMountain.ai","Forcepoint ThreatSeeker"],"stats":{"timeout":0,"harmless":43,"malicious":19,"suspicious":0,"undetected":30}},"google_safe_browsing":{"source":"Google Safe Browsing","state":"checked_clean","verdict":0,"checked_at":"2026-11-08 06:02:26"},"spamhaus":{"source":"Spamhaus","verdict":"DBL_SPAM","checked_at":"2026-10-29 04:30:30"},"availability":{"state":"alive","label_key":"availability.active","detail_key":"detail.latest_reachability","params":[],"source":"current_http_probe","record_id":1700843,"scope":"checked_url","observed_at":"2026-11-08T11:25:06Z","http_status":200,"http_observed_at":"2026-11-08T11:25:06Z","stored_http_code":200,"stored_http_observed_at":"2026-11-08T11:25:06Z","legacy_site_status":"alive","supports_outcome_badge":false,"content_classification":"served_at_root","content_classification_at":"2026-11-08T11:25:06Z","registration_state":"unknown","policy":"20261102-dated-availability-v2"}} ## Stored page captures - Stored capture: https://i.ibb.co/1fL4z50Y/66bbfc63f77c.png - URLScan · 2026-10-29: https://screenshots.phishdestroy.io/01a1851e-abb4-70e0-b9ed-36733b3bfd2d.png Captured: 2026-10-29 00:45:50 UTC Source report: https://urlscan.io/result/01a1851e-abb4-70e0-b9ed-36733b3bfd2d/ - URLScan · 2026-10-28: https://screenshots.phishdestroy.io/us/01a18359-407b-745c-b996-0fb4feba376a.png Captured: 2026-10-28 16:30:56 UTC Source report: https://urlscan.io/result/01a18359-407b-745c-b996-0fb4feba376a/ SHA-256: 0cc97a247d38afe3b5f724bf705b2a493e6f13a68269885ca1255f54cc831788 - URLScan · 2026-10-28: https://screenshots.phishdestroy.io/us/01a18299-fdfc-778a-9610-6acd4b92198d.png Captured: 2026-10-28 13:01:43 UTC Source report: https://urlscan.io/result/01a18299-fdfc-778a-9610-6acd4b92198d/ SHA-256: 23fbbc84d1ba681035f3a98cdded22a36601cf71bc7d0c3848ad4b2f3ec1f3c8 - URLScan · 2026-10-29: https://screenshots.phishdestroy.io/us/01a189c5-d703-7628-85c2-915013a5c7ca.png Captured: 2026-10-29 22:26:54 UTC Source report: https://urlscan.io/result/01a189c5-d703-7628-85c2-915013a5c7ca/ SHA-256: 193340d929398088ad5e5622db1047e8984aafb62b2682e1e10c7e36ba00fd89 - URLScan · 2026-10-31: https://screenshots.phishdestroy.io/us/01a190b4-384b-72ea-8d41-acefd019df66.png Captured: 2026-10-31 06:44:59 UTC Source report: https://urlscan.io/result/01a190b4-384b-72ea-8d41-acefd019df66/ SHA-256: f64fa9a9ebc2d93d4b190ea4d05d64ad54844a2aefcd67f06a8511a9647443cf - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/9d0a7a23-5be9-4d88-9e26-317374bb9ade.png Captured: 2026-10-29 01:21:49 UTC Source report: https://radar.cloudflare.com/scan/9d0a7a23-5be9-4d88-9e26-317374bb9ade SHA-256: a2f943eab18de63ef1c9eb6f2327171baecf46a5159467c18851a3fc4b011f13 ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-29T01:21:38Z", "uuid": "01a1851e-abb4-70e0-b9ed-36733b3bfd2d", "scanned_at": "2026-10-29T00:45:50Z", "final_url": "https://pbu8z.com/", "status": 200, "redirected": "https-only", "redirects": [ { "to": "https://pbu8z.com/", "from": "http://pbu8z.com/", "status": 307 } ], "ip": "156.238.121.222", "domains": [ "a7nkq.vip" ], "ips": [ "156.238.121.176", "156.238.121.222" ], "asns": [ "54801" ], "countries": [ "HK" ], "doc_hash": "4cfb3fae70aebe5e27ea25d8159102c9c98c2e67752607d60db7d9e501a6cd6b", "script_hashes": [ "04a5f825214114fe21cb33567faeccca67bb22a604e7026d0082775f156e97d5", "59a22eb47ad374fd423f8737c8ea8b8ff77647d81cd4d664a90be572d7d04f0a", "603f127d27c558ad96f3b16b02d6e4a12f6ac77a54051e587be3280a48c8d5aa", "5849140937ec037dc88373b861c03258ea2bca2c32cb5f84dbb889b8e11c01a6" ], "globals": [ "webpackChunkshopify", "clearImmediate", "setImmediate" ], "storage_keys": [ "lang", "systemConfig" ], "tls": { "san": [ "*.pbu8z.com", "pbu8z.com" ], "cipher": "AES_256_GCM", "issuer": "YR1", "subject": "pbu8z.com", "protocol": "TLS 1.3", "valid_to": "2027-01-25T15:41:51Z", "valid_from": "2026-10-27T15:41:52Z" }, "domain_age_days": 0, "apex_age_days": 0, "tls_age_days": 1, "tls_valid_days": 89, "requests": 15, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 97, "malicious": true }, "overall": { "tags": [ "phishing" ], "score": 100, "brands": [ "shopify" ], "malicious": true, "categories": [ "phishing" ] }, "urlscan": { "tags": [ "phishing" ], "score": 100, "brands": [ "Shopify" ], "malicious": true, "categories": [ "phishing" ] } }, "headers": { "server": "nginx", "content-type": "text/html", "strict-transport-security": "max-age=31536000", "x-cache": "HIT from cb2llhk60623d" } }, "cf": { "v": 1, "fetched_at": "2026-10-29T01:23:34Z", "uuid": "9d0a7a23-5be9-4d88-9e26-317374bb9ade", "scanned_at": "2026-10-29T01:21:49Z", "final_url": "https://pbu8z.com/", "status": 200, "history": [ { "url": "https://pbu8z.com/", "status": 200 } ], "dom_hash": "595f5e66f22b20cb59ef218da3fa955067ff51d7a3a8f1a7107462929ba85794", "doc_hash": "4cfb3fae70aebe5e27ea25d8159102c9c98c2e67752607d60db7d9e501a6cd6b", "phishing_v2": [ "phishing" ], "url_risks": [ "Phishing" ], "domain_risks": [ "New Domains", "Security Risks", "Newly Seen Domains", "Phishing", "Security threats", "CIPA Filter", "CIPA" ], "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "pbu8z.com", "type": "A", "value": "45.200.17.1" }, { "name": "pbu8z.com", "type": "A", "value": "45.128.220.114" }, { "name": "pbu8z.com", "type": "A", "value": "156.238.121.176" }, { "name": "pbu8z.com", "type": "A", "value": "172.93.221.110" }, { "name": "pbu8z.com", "type": "A", "value": "156.238.122.164" }, { "name": "pbu8z.com", "type": "A", "value": "45.200.49.222" }, { "name": "pbu8z.com", "type": "A", "value": "45.200.49.210" }, { "name": "pbu8z.com", "type": "A", "value": "156.238.121.208" }, { "name": "pbu8z.com", "type": "A", "value": "156.238.121.222" } ], "dnssec_valid": false, "ip": "127.0.1.12", "verdict": { "tags": [ "phishing" ], "malicious": true, "categories": [ "phishing" ] }, "whois": { "registrar": "Dynadot Inc", "created": "2026-10-27T16:26:24Z", "updated": "2026-10-27T16:32:25Z", "expires": "2027-10-27T16:26:24Z", "nameservers": [ "nancy.ns.cloudflare.com", "sean.ns.cloudflare.com" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-29T01:21:13Z", "analysis_at": "2026-10-28T22:43:29Z", "stats": { "timeout": 0, "harmless": 43, "malicious": 19, "suspicious": 0, "undetected": 30 }, "detections": { "CRDF": "malicious", "DNS8": "phishing", "ESET": "phishing", "Ermes": "phishing", "G-Data": "phishing", "Lionic": "phishing", "Sophos": "phishing", "Webroot": "malicious", "Emsisoft": "phishing", "Fortinet": "phishing", "Netcraft": "malicious", "SOCRadar": "malicious", "URLQuery": "malicious", "Kaspersky": "phishing", "OpenPhish": "phishing", "Gridinsoft": "phishing", "BitDefender": "phishing", "alphaMountain.ai": "phishing", "Forcepoint ThreatSeeker": "phishing" }, "reputation": 0, "categories": { "Sophos": "phishing and fraud", "Webroot": "Phishing and Other Frauds", "alphaMountain.ai": "Phishing (alphaMountain.ai)", "Forcepoint ThreatSeeker": "phishing and other frauds" }, "registrar": "Dynadot Inc", "created": "2026-10-27T16:26:24Z", "expires": "2027-10-27T16:26:24Z", "updated": "2026-10-27T16:32:25Z", "first_seen": "2026-10-27T16:44:53Z", "dns": [ { "ttl": 300, "type": "A", "value": "45.200.49.222" }, { "ttl": 300, "type": "A", "value": "156.238.121.222" }, { "ttl": 21600, "type": "NS", "value": "sean.ns.cloudflare.com" }, { "ttl": 300, "type": "A", "value": "156.238.121.176" }, { "ttl": 300, "type": "A", "value": "156.238.121.208" }, { "ttl": 1800, "type": "SOA", "rname": "dns.cloudflare.com", "value": "nancy.ns.cloudflare.com" }, { "ttl": 300, "type": "A", "value": "45.200.49.210" }, { "ttl": 300, "type": "A", "value": "45.128.220.114" }, { "ttl": 300, "type": "A", "value": "45.200.17.1" }, { "ttl": 300, "type": "A", "value": "172.93.221.110" }, { "ttl": 300, "type": "A", "value": "156.238.122.164" }, { "ttl": 21600, "type": "NS", "value": "nancy.ns.cloudflare.com" } ], "dns_at": "2026-10-28T22:43:45Z", "jarm": "2ad2ad0002ad2ad22c42d42d000000307ee0eb468e9fdb5cfcd698a80a67ef", "cert": { "san": [ "*.pbu8z.com", "pbu8z.com" ], "issuer": "Let's Encrypt / YR1", "serial": "51d4c665816a666524f7c5b33f837b1c5b", "sha256": "1b73f0ebe8ebf4b3f70fba3fec62f1f6e91926076b9ba25717a3bd39c50850b9", "subject": "pbu8z.com", "valid_to": "2027-01-25T15:41:51Z", "valid_from": "2026-10-27T15:41:52Z" }, "whois": { "registrar": "Dynadot Inc", "registrar_iana_id": "472", "registrar_url": "http://www.dynadot.com", "created": "2026-10-27T16:26:24Z", "updated": "2026-10-27T16:32:25Z", "expires": "2027-10-27T16:26:24Z", "status": [ "clientTransferProhibited" ], "nameservers": [ "nancy.ns.cloudflare.com", "sean.ns.cloudflare.com" ], "dnssec": "unsigned" }, "rdap": { "status": [ "transfer prohibited" ], "events": { "expiration": "2027-10-27T16:26:24Z", "last changed": "2026-10-27T16:32:25Z", "registration": "2026-10-27T16:26:24Z", "registrar expiration": "2027-10-27T16:26:24Z", "last update of RDAP database": "2026-10-27T16:36:52Z" } } }, "webcheck": { "v": 1, "fetched_at": "2026-10-29T01:03:50Z", "mail_config": { "spf_lookups": 0 }, "caa_records": { "domain": "pbu8z.com" }, "block_lists": { "resolvers": 12, "blocked_by": [ "CloudFlare Family" ], "blocked_count": 1 }, "archives": { "last": "2026-10-29T00:43:48Z", "first": "2026-10-29T00:43:48Z", "changes": 0, "days_archived": 1, "avg_page_bytes": 951 }, "social_tags": { "title": "shopify" }, "trackers": { "requests": 8 }, "mixed_content": { "third_party_scripts": 0 }, "status": { "up": true, "code": 200, "timings": { "dns": 238, "tls": 389, "wait": 192, "connect": 192, "download": 0 }, "response_ms": 1011 }, "tls_connection": { "alpn": "h2", "cipher": "TLS_AES_256_GCM_SHA384", "protocol": "TLSv1.3", "versions": [ "TLSv1", "TLSv1.1", "TLSv1.2", "TLSv1.3" ], "authorized": true, "forward_secrecy": true }, "ports": { "open": [ 80, 443 ] }, "carbon": { "bytes": 757, "co2_grams": 0, "cleaner_than": 95 }, "dns_server": { "ns": [ { "ip": "162.159.38.84", "host": "nancy.ns.cloudflare.com" }, { "ip": "172.64.33.231", "host": "sean.ns.cloudflare.com" } ], "zone": "pbu8z.com" }, "location": { "ip": "45.200.49.210", "asn": "54801", "org": "Zillion Network Inc", "city": "Dallas", "country": "US" }, "ssl": { "issuer": "Let's Encrypt / YR1", "subject": "pbu8z.com" }, "dns": { "A": [ "45.200.17.1", "156.238.122.164", "156.238.121.208", "45.128.220.114", "45.200.49.210", "172.93.221.110", "156.238.121.176", "45.200.49.222", "156.238.121.222" ], "NS": [ "sean.ns.cloudflare.com", "nancy.ns.cloudflare.com" ], "SOA": "{\"nsname\": \"nancy.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2418625417, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}" }, "dnssec": { "ds": false, "rrsig": false, "dnskey": false }, "hsts": { "header": "max-age=31536000", "message": "HSTS header does not include all subdomains." }, "http_security": { "xFrameOptions": false, "referrerPolicy": false, "xXSSProtection": false, "permissionsPolicy": false, "xContentTypeOptions": false, "contentSecurityPolicy": false, "strictTransportPolicy": "max-age=31536000", "crossOriginOpenerPolicy": false, "crossOriginEmbedderPolicy": false, "crossOriginResourcePolicy": false }, "get_ip": { "ip": "156.238.121.222", "family": 4 }, "redirects": { "chain": [ "https://pbu8z.com" ] }, "whois": { "registrar": "Dynadot Inc", "created": "2026-10-27T16:26:24Z", "updated": "2026-10-27T16:32:25Z", "expires": "2027-10-27T16:26:24Z", "status": [ "clientTransferProhibited https://icann.org/epp" ], "nameservers": [ "nancy.ns.cloudflare.com", "sean.ns.cloudflare.com" ] }, "headers": { "headers": { "server": "nginx", "content-type": "text/html", "strict-transport-security": "max-age=31536000", "x-cache": "HIT from cb2llhk50607-0611" } } } } ``` Capture recorded with this analysis (source URL, capture time and stored hash): {"url":"https://screenshots.phishdestroy.io/cf/9d0a7a23-5be9-4d88-9e26-317374bb9ade.png","source":"Cloudflare Radar","report_url":"https://radar.cloudflare.com/scan/9d0a7a23-5be9-4d88-9e26-317374bb9ade","captured_at":"2026-10-29T01:21:49Z","sha256":"a2f943eab18de63ef1c9eb6f2327171baecf46a5159467c18851a3fc4b011f13","model_image_sha256":"2794722e4eeac118bb4f0318433ba342c6049e87e911b61604ce5d815c015552","available":true,"content_status":null} ## Complete dated records Availability observations: https://phishdestroy.io/domain/pbu8z.com/records.json?source=availability&format=json Source observation history: https://phishdestroy.io/domain/pbu8z.com/records.json?source=detections&format=json PhishStats records: https://phishdestroy.io/domain/pbu8z.com/records.json?source=phishstats&format=json Sent report records: https://phishdestroy.io/domain/pbu8z.com/records.json?source=sent_reports&format=json Report history: https://phishdestroy.io/domain/pbu8z.com/records.json?source=report_history&format=json Repeat report records: https://phishdestroy.io/domain/pbu8z.com/records.json?source=rereports&format=json Follow-up records: https://phishdestroy.io/domain/pbu8z.com/records.json?source=followups&format=json Content observations: https://phishdestroy.io/domain/pbu8z.com/records.json?source=content&format=json ## Dated availability observation Latest stored reachability observation ```json { "state": "alive", "label_key": "availability.active", "detail_key": "detail.latest_reachability", "params": [], "source": "current_http_probe", "record_id": 1700843, "scope": "checked_url", "observed_at": "2026-11-08T11:25:06Z", "http_status": 200, "http_observed_at": "2026-11-08T11:25:06Z", "stored_http_code": 200, "stored_http_observed_at": "2026-11-08T11:25:06Z", "legacy_site_status": "alive", "supports_outcome_badge": false, "content_classification": "served_at_root", "content_classification_at": "2026-11-08T11:25:06Z", "registration_state": "unknown", "policy": "20261102-dated-availability-v2" } ```