# PhishDestroy domain threat record: rshoppakistan.pk Content language: English Canonical HTML report: https://phishdestroy.io/domain/rshoppakistan.pk/ Machine-readable companion: https://phishdestroy.io/domain/rshoppakistan.pk/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-10-22 01:52:34 UTC - Last availability or vendor check: 2026-10-22 10:49:42 UTC - Stored record updated: 2026-10-22 16:07:29 UTC - VirusTotal detections in the stored snapshot: 0/92 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: no stored flag ## Stored classification - Targeted brand: revolut ## Stored infrastructure - Observed IP address: 103.229.81.58 - Registrar in stored WHOIS data: REGISTRAR_NOT_FOUND - Last stored HTTP status: 200 - Registration date in stored WHOIS data: 2021-06-03 22:00:00 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a1614e-9cad-765c-918d-72c22916c1e2/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/rshoppakistan.pk - Certificate Transparency search: https://crt.sh/?q=%25.rshoppakistan.pk - Web Archive lookup: https://web.archive.org/web/*/https://rshoppakistan.pk/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview PhishDestroy’s intake AI flagged rshoppakistan.pk as a malicious phishing site because it pretends to be an online retailer offering discounted luxury watches from brands such as Rolex and Tag Heuer, which the domain does not officially represent. The recorded page title “Mens and Womens Watches at Discount Prices | Watches in Pakistan” and the lack of observed page content still support the impersonation claim. The domain was first seen by PhishDestroy on 2026-10-22, returning an HTTP 200 response with the same effective domain. How the scam works Fake luxury‑watch storefronts lure visitors with unrealistically low prices and brand logos to collect payment details, personal information, or to redirect victims to fraudulent payment gateways. By presenting themselves as legitimate retailers, they exploit the trust associated with high‑value brands to increase conversion rates. Evidence VirusTotal scanned the domain on 2026-10-22 (analysis date 2026-10-02) with 92 engines and reported 0 malicious and 0 suspicious detections. Google Safe Browsing checked on 2026-10-22 and did not flag the site. OTX recorded no pulses for the domain on the same date. URLScan captured the site on 2026-10-22, its engine tags marked it malicious with a score of 88, though the overall verdict was non‑malicious. PhishDestroy’s internal blocklist includes the domain as of 2026-10-22, while external blocklists returned no hits. Infrastructure The domain was registered on 2021-06-04 and uses Cloudflare name servers (dane.ns.cloudflare.com, rachel.ns.cloudflare.com). The recorded IP address 103.229.81.58 belongs to Ultahost, Inc. in the Netherlands and is served through Cloudflare’s CDN. TLS was issued by Let’s Encrypt (YR1) on 2026-10-11, valid until 2027-01-09, and includes multiple watch‑related SAN entries; DNSSEC is not enabled. What to do Visitors should avoid entering any personal, payment, or login information on the site and should change any credentials that may have been submitted. Security teams should block the exact domain rshoppakistan.pk and monitor outbound connections to 103.229.81.58, adding the host to internal blocklists if not already present. Review logs for any interactions with the domain and educate users about the risks of counterfeit luxury‑watch e‑commerce sites. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a1614e-9cad-765c-918d-72c22916c1e2/ Cloudflare Radar report: https://radar.cloudflare.com/scan/b5e71551-4277-493e-8c04-7616e7c8ba89 Stored capture screenshot: https://i.ibb.co/p67CMMG2/b2a73601ef22.png Cloudflare Radar screenshot (2026-10-22T01:53:03Z): https://screenshots.phishdestroy.io/cf/b5e71551-4277-493e-8c04-7616e7c8ba89.png URLScan screenshot (2026-10-22T01:48:27Z): https://screenshots.phishdestroy.io/us/01a1614b-7f2a-736d-a6fc-16996d28b6b5.png URLScan capture report: https://urlscan.io/result/01a1614b-7f2a-736d-a6fc-16996d28b6b5/ URLScan screenshot (2026-10-22T01:50:47Z): https://screenshots.phishdestroy.io/us/01a1614d-a4d8-75a9-90d1-bd73356e5b77.png URLScan capture report: https://urlscan.io/result/01a1614d-a4d8-75a9-90d1-bd73356e5b77/ VirusTotal report: https://www.virustotal.com/gui/domain/rshoppakistan.pk Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=rshoppakistan.pk Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-22 01:54:18 UTC ## Stored page captures - Primary capture: https://i.ibb.co/p67CMMG2/b2a73601ef22.png Captured: 2026-10-22 01:52:34 UTC - URLScan capture: https://screenshots.phishdestroy.io/01a1614e-9cad-765c-918d-72c22916c1e2.png Captured: 2026-10-22 01:52:34 UTC Source report: https://urlscan.io/result/01a1614e-9cad-765c-918d-72c22916c1e2/ - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/b5e71551-4277-493e-8c04-7616e7c8ba89.png Captured: 2026-10-22 01:53:03 UTC Source report: https://radar.cloudflare.com/scan/b5e71551-4277-493e-8c04-7616e7c8ba89 SHA-256: 224f3976b03650065e71247105839113e09af7fb76e8756c3f083ec79641fcc5 - URLQuery: https://screenshots.phishdestroy.io/uq/9bc02da3-a3bf-42f8-ad3f-95a0e19bf915.png Source report: https://urlquery.net/report/9bc02da3-a3bf-42f8-ad3f-95a0e19bf915 SHA-256: 6e23c478800ded553a1e556de3cc8c2df14f49d2cc7b5870e482b3a6944177b3 - URLScan · 2026-10-22: https://screenshots.phishdestroy.io/us/01a1614b-7f2a-736d-a6fc-16996d28b6b5.png Captured: 2026-10-22 01:48:27 UTC Source report: https://urlscan.io/result/01a1614b-7f2a-736d-a6fc-16996d28b6b5/ SHA-256: 954d9ff095c0df8346f544bccc8ef032742a004541b3c6e2c437649baaaabe4f - URLScan · 2026-10-22: https://screenshots.phishdestroy.io/us/01a1614d-a4d8-75a9-90d1-bd73356e5b77.png Captured: 2026-10-22 01:50:47 UTC Source report: https://urlscan.io/result/01a1614d-a4d8-75a9-90d1-bd73356e5b77/ SHA-256: ca0e6f8813dfacbb5a3d24462211d1a82f1058fe6b605116b54618fd00cf4117 ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-22T01:53:27Z", "uuid": "01a1614e-9cad-765c-918d-72c22916c1e2", "scanned_at": "2026-10-22T01:52:06Z", "final_url": "https://rshoppakistan.pk/", "status": 200, "redirected": "https-only", "redirects": [ { "to": "https://rshoppakistan.pk/", "from": "http://rshoppakistan.pk/", "status": 307 } ], "ip": "103.229.81.58", "ptr": "nl-rs.rshop.com.pk", "domains": [ "fonts.gstatic.com", "www.gstatic.com", "fonts.googleapis.com", "www.google-analytics.com", "www.google.com", "www.googletagmanager.com" ], "ips": [ "142.251.153.119", "142.251.150.119", "142.250.183.46", "142.250.183.35", "142.250.195.232", "142.250.195.170", "103.229.81.58" ], "asns": [ "15169", "214036" ], "countries": [ "US", "NL" ], "link_domains": [ "rshop.com.pk", "wa.me", "api.whatsapp.com" ], "social": [ "https://wa.me/923352345111", "https://api.whatsapp.com/send" ], "doc_hash": "e29d444bf133c46c3312072ad45b2c447cb39efb0db6c97eb21c6f466a042a4b", "script_hashes": [ "75bfc47a2e40b65a345c681ab904428a391accbd0836bf03299d3e7c66ff0846", "2c69162d1b68d10b28e9e5aa98c6e97cde64d583c6086f94008c14a07a71fb0a", "ce3b60fb5c856dd229eae6c616d6692433916e96cdca9f51953c007c1b7968f7", "bcb762d99fadde03392c79f13cdcea32ebff4fe5f27b9428a5130a2105d36963", "eb64611bfddd85049781ae2927d48f40e4df39aae6974bd23ca7dec03d545b04", "59575b76aaf809046a9202f3ca986d29568045d2c95fd58fc06d5522444209ae", "e9ea666827b99055e4d81747ef998a796c9706d2410d0de0ccf146e8c9ce2965", "bd2d563283d15eb309447e80685e8f6546eeb35b112c5c4b27cc68d5f928100e", "99e45d7fff07d03609e865e7ebdd2d056be1c955a0211d75698b784fff654f56", "cec92e107cf1b802b5242f280a0396621ca89e55071e2b51c6ae6b1db4b2b8ca" ], "globals": [ "LOCALE", "BASE_URL", "require", "requirejs", "define", "gtag", "dataLayer", "js_porto_vars", "redirect_cart", "theme", "cookiesConfig", "checkout", "authenticationPopup", "amlazy", "amlazycallback", "google_tag_data", "google_tag_manager", "gaGlobal", "jQuery", "lazyload", "_", "tinycolor", "mediaCheck", "rememberMeConfig", "globalOnRecaptchaOnLoadCallback", "Cookies", "GoogleAnalyticsObject", "ga", "gaplugins", "gaData", "___grecaptcha_cfg", "grecaptcha", "__recaptcha_api", "__google_recaptcha_client", "cookieStorage", "recaptcha", "scrypt", "closure_lm_283213" ], "cookies": [ "PHPSESSID", "X-Magento-Vary", "_ga_YS2FGWBLG8", "form_key", "_ga", "_gid", "_gat", "mage-cache-storage", "mage-cache-storage-section-invalidation", "mage-cache-sessid", "mage-messages", "recently_viewed_product", "recently_viewed_product_previous", "recently_compared_product", "recently_compared_product_previous", "product_data_storage" ], "storage_keys": [ "storage_test", "_storageSupported", "jsapi", "mage-cache-storage", "mage-cache-storage-section-invalidation", "mage-cache-timeout", "mage-customer-login", "recently_viewed_product", "recently_viewed_product_previous", "recently_compared_product", "recently_compared_product_previous", "product_data_storage" ], "tls": { "san": [ "luxury-watches.pk", "onlinewatches.pk", "replicawatches.pk", "rshop-pakistan.com.pk", "rshop.com.pk", "rshoppakistan.pk", "watchesinpakistan.com.pk", "watchprice.com.pk", "watchprice.pk", "www.luxury-watches.pk" ], "cipher": "AES_256_GCM", "issuer": "YR1", "subject": "rshop.com.pk", "protocol": "TLS 1.3", "valid_to": "2027-01-09T16:44:18Z", "valid_from": "2026-10-11T16:44:19Z" }, "domain_age_days": 1845, "apex_age_days": 1845, "tls_age_days": 10, "tls_valid_days": 89, "requests": 289, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 88, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "nginx/1.30.0", "content-type": "text/html; charset=UTF-8", "x-powered-by": "PHP/8.4.12", "strict-transport-security": "max-age=31536000", "content-security-policy": "font-src maxcdn.bootstrapcdn.com *.fontawesome.com *.fonts.googleapis.com *.gstatic.com data: *.cloudflare.com data: 'self' 'unsafe-inline'; form-action 'self' 'unsafe-inline'; frame-ancestors 'self';", "x-frame-options": "SAMEORIGIN", "x-content-type-options": "nosniff" } }, "cf": { "v": 1, "fetched_at": "2026-10-22T01:53:38Z", "uuid": "b5e71551-4277-493e-8c04-7616e7c8ba89", "scanned_at": "2026-10-22T01:53:03Z", "final_url": "https://rshoppakistan.pk/", "status": 200, "history": [ { "url": "https://rshoppakistan.pk/", "status": 200 } ], "dom_hash": "1269862ede9929813597c54084a69aa7cd900e42d7793d8df9079aaa0bddcb27", "doc_hash": "a0397ae8cd76d4a698b9463fe852488d9750c597c9bce75e4944ae546b56a66c", "domain_risks": [ "Ecommerce", "Shopping & Auctions", "Fashion", "Society & Lifestyle", "Questionable Activities", "Questionable Content", "CIPA Filter", "CIPA" ], "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "rshoppakistan.pk", "type": "A", "value": "103.229.81.58" } ], "dnssec_valid": false, "ip": "103.229.81.58", "whois": { "created": "2021-06-04T00:00:00Z", "expires": "2027-06-04T00:00:00Z", "nameservers": [ "dane.ns.cloudflare.com", "rachel.ns.cloudflare.com" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-22T01:53:00Z", "analysis_at": "2026-10-02T01:40:52Z", "stats": { "timeout": 0, "harmless": 56, "malicious": 0, "suspicious": 0, "undetected": 36 }, "reputation": 0, "popularity": { "Cisco Umbrella": 616865, "Cloudflare Radar": 200000 }, "created": "2021-06-04T00:00:00Z", "first_seen": "2024-09-14T16:27:39Z", "dns": [ { "ttl": 300, "type": "A", "value": "103.229.81.58" }, { "ttl": 300, "type": "MX", "value": "alt1.aspmx.l.google.com", "priority": 5 }, { "ttl": 300, "type": "MX", "value": "aspmx.l.google.com", "priority": 1 }, { "ttl": 300, "type": "TXT", "value": "v=spf1 a mx ip4:213.239.227.47 ~all" }, { "ttl": 1800, "type": "SOA", "rname": "dns.cloudflare.com", "value": "dane.ns.cloudflare.com" }, { "ttl": 300, "type": "MX", "value": "alt4.aspmx.l.google.com", "priority": 10 }, { "ttl": 300, "type": "MX", "value": "alt2.aspmx.l.google.com", "priority": 5 }, { "ttl": 21600, "type": "NS", "value": "rachel.ns.cloudflare.com" }, { "ttl": 300, "type": "MX", "value": "alt3.aspmx.l.google.com", "priority": 10 }, { "ttl": 300, "type": "TXT", "value": "google-site-verification=uGclw_nzDe0zQDu9WJfXRWrAdCHDaukmgVkc-5qYD8E" }, { "ttl": 21600, "type": "NS", "value": "dane.ns.cloudflare.com" }, { "ttl": 300, "type": "MX", "value": "_dc-mx.e1f3486d42cd.rshoppakistan.pk", "priority": 0 } ], "dns_at": "2026-10-02T01:54:11Z", "jarm": "2ad2ad0002ad2ad00042d42d0000002059a3b916699461c5923779b77cf06b", "cert": { "san": [ "luxury-watches.pk", "online-watches.com.pk", "onlinewatches.pk", "replicawatches.pk", "rshop-pakistan.com.pk", "rshop.com.pk", "rshoppakistan.pk", "watchesinpakistan.com.pk", "watchprice.com.pk", "watchprice.pk" ], "issuer": "Let's Encrypt / YR2", "serial": "58664136d7acdfc38e619504a073fd795d6", "sha256": "1a634dc1f4ff7dfced1314d09742539d119d35aa25264972166e846c2c82abde", "subject": "rshop.com.pk", "valid_to": "2026-10-11T00:52:00Z", "valid_from": "2026-07-13T00:52:01Z" }, "whois": { "created": "2021-06-04T00:00:00Z", "nameservers": [ "dane.ns.cloudflare.com", "rachel.ns.cloudflare.com" ] } }, "webcheck": { "v": 1, "fetched_at": "2026-10-22T01:54:00Z", "mail_config": { "mx": [ "alt1.aspmx.l.google.com", "alt2.aspmx.l.google.com", "_dc-mx.e1f3486d42cd.rshoppakistan.pk", "aspmx.l.google.com", "alt3.aspmx.l.google.com", "alt4.aspmx.l.google.com" ], "spf": "v=spf1 a mx ip4:213.239.227.47 ~all", "providers": [ "Google Workspace" ], "spf_lookups": 2 }, "caa_records": { "domain": "rshoppakistan.pk" }, "block_lists": { "resolvers": 12, "blocked_by": [ "CloudFlare Family" ], "blocked_count": 1 }, "archives": { "last": "2026-10-22T01:53:23Z", "first": "2024-08-31T22:48:26Z", "changes": 6, "days_archived": 10, "scans_per_day": 0.01, "avg_page_bytes": 11222 }, "tls_connection": { "alpn": "h2", "cipher": "TLS_AES_256_GCM_SHA384", "protocol": "TLSv1.3", "versions": [ "TLSv1.2", "TLSv1.3" ], "authorized": true, "forward_secrecy": true }, "ports": { "open": [ 21, 80, 110, 143, 443, 587, 993, 995, 8888 ] }, "dns_server": { "ns": [ { "ip": "172.64.33.97", "host": "dane.ns.cloudflare.com" }, { "ip": "173.245.58.215", "host": "rachel.ns.cloudflare.com" } ], "zone": "rshoppakistan.pk" }, "location": { "ip": "103.229.81.58", "asn": "214036", "org": "Ultahost, Inc.", "city": "Amsterdam", "country": "NL" }, "ssl": { "issuer": "Let's Encrypt / YR1", "subject": "rshop.com.pk" }, "dns": { "A": [ "103.229.81.58" ], "MX": [ "{\"exchange\": \"alt3.aspmx.l.google.com\", \"priority\": 10}", "{\"exchange\": \"alt1.aspmx.l.google.com\", \"priority\": 5}", "{\"exchange\": \"aspmx.l.google.com\", \"priority\": 1}", "{\"exchange\": \"_dc-mx.e1f3486d42cd.rshoppakistan.pk\", \"priority\": 0}", "{\"exchange\": \"alt4.aspmx.l.google.com\", \"priority\": 10}", "{\"exchange\": \"alt2.aspmx.l.google.com\", \"priority\": 5}" ], "NS": [ "dane.ns.cloudflare.com", "rachel.ns.cloudflare.com" ], "SOA": "{\"nsname\": \"dane.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2416894929, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}", "TXT": [ "google-site-verification=uGclw_nzDe0zQDu9WJfXRWrAdCHDaukmgVkc-5qYD8E", "v=spf1 a mx ip4:213.239.227.47 ~all" ] }, "dnssec": { "ds": false, "rrsig": false, "dnskey": false }, "hsts": { "header": "max-age=31536000", "message": "HSTS header does not include all subdomains." }, "http_security": { "xFrameOptions": false, "referrerPolicy": false, "xXSSProtection": false, "permissionsPolicy": false, "xContentTypeOptions": false, "contentSecurityPolicy": false, "strictTransportPolicy": "max-age=31536000", "crossOriginOpenerPolicy": false, "crossOriginEmbedderPolicy": false, "crossOriginResourcePolicy": false }, "get_ip": { "ip": "103.229.81.58", "family": 4 }, "rank": { "domain": "rshoppakistan.pk" }, "subdomains": { "count": 1, "subdomains": [ "www.rshoppakistan.pk" ] }, "tech_stack": { "technologies": [ "Magento", "Cart Functionality", "MySQL", "PHP", "Bootstrap", "CivicTheme", "RequireJS", "PayPal", "Nginx", "OWL Carousel", "Moment.js", "Lodash", "jQuery UI", "jQuery", "Google Analytics", "WhatsApp Business Chat", "Google Font API", "Font Awesome", "HSTS", "HTTP/3" ] }, "whois": { "created": "2021-06-04T00:00:00Z", "expires": "2027-06-04T00:00:00Z", "status": [ "Domain is Registered" ], "nameservers": [ "dane.ns.cloudflare.com", "rachel.ns.cloudflare.com" ] }, "headers": { "headers": { "server": "nginx/1.30.0", "content-type": "text/html; charset=utf-8", "strict-transport-security": "max-age=31536000" } } } } ```