# PhishDestroy domain threat record: shop.olacoffee.vn Content language: English Canonical HTML report: https://phishdestroy.io/domain/shop.olacoffee.vn/ Machine-readable companion: https://phishdestroy.io/domain/shop.olacoffee.vn/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-09-23 19:36:47 UTC - Last availability or vendor check: 2026-10-22 10:33:44 UTC - Stored record updated: 2026-10-22 16:07:29 UTC - VirusTotal detections in the stored snapshot: 14/91 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: no stored flag ## Stored classification - Targeted brand: ["gmail"] ## Stored infrastructure - Observed IP address: 36.50.26.127 - Registrar in stored WHOIS data: REGISTRAR_NOT_FOUND - Last stored HTTP status: 200 ## Evidence links - URLScan report: https://urlscan.io/result/01a0cfd3-c355-71f9-b907-8af6d201735a/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/shop.olacoffee.vn - Certificate Transparency search: https://crt.sh/?q=%25.shop.olacoffee.vn - Web Archive lookup: https://web.archive.org/web/*/https://shop.olacoffee.vn/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview shop.olacoffee.vn is an impersonation phishing page that poses as a legitimate Vietnamese online storefront, with the page title "Trang chủ" ("Home page"). It targets Vietnamese-speaking visitors who believe they are shopping or signing in on a genuine site. PhishDestroy first saw it on 2026-09-23. On 2026-10-19 the site was still online and serving content. How the scam works Impersonation pages copy the look of a trusted shop or service so visitors enter account credentials, personal details or card data without hesitation. Whatever is typed into the forms goes to the operators, who can take over accounts, make purchases or resell the data. The "shop" subdomain and the generic Vietnamese home-page title make the page look like an ordinary store front. The title itself names no brand, so the impersonation is not obvious from the browser tab. Evidence On 2026-10-03, 14 of 91 VirusTotal engines flagged the domain. Those engines include BitDefender, ESET, Forcepoint ThreatSeeker, Fortinet, G-Data, Gridinsoft, Kaspersky and Lionic. Agreement among that many independent vendors is a solid signal, although most engines had not yet caught up. Among blocklists, PhishDestroy currently lists it, so protection depends heavily on whether your security tool uses one of the flagging vendors. Infrastructure The page is hosted in Vietnam on IP 36.50.26.127, on the network of EZ TECHNOLOGY COMPANY LIMITED, which matches its Vietnamese-speaking audience. It uses a free Let's Encrypt certificate. The browser padlock only means the connection is encrypted and says nothing about whether the shop is real. What to do If you entered a password on this site, change it immediately, along with any other account where you reuse it, and turn on two-factor authentication. If you entered card or bank details, contact your bank to block the card and dispute any unfamiliar charges. Watch for follow-up calls or messages that use your stolen details to seem credible. Defenders should block shop.olacoffee.vn and 36.50.26.127 at DNS and proxy level and search mail and web logs for earlier visits. Reports to the hosting provider help get the page taken down. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a0cfd3-c355-71f9-b907-8af6d201735a/ VirusTotal report: https://www.virustotal.com/gui/domain/shop.olacoffee.vn Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=shop.olacoffee.vn Archived copy: https://web.archive.org/web/20260923194342/https://shop.olacoffee.vn/ Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-19 09:35:18 UTC ## Stored page captures - Primary capture: https://urlscan.io/screenshots/01a0cfd3-c355-71f9-b907-8af6d201735a.png Captured: 2026-09-23 19:54:37 UTC - URLScan capture 1: https://screenshots.phishdestroy.io/01a0cfd3-c355-71f9-b907-8af6d201735a.png Captured: 2026-09-23 19:54:37 UTC Source report: https://urlscan.io/result/01a0cfd3-c355-71f9-b907-8af6d201735a/ - URLScan capture 2: https://urlscan.io/screenshots/019e9c29-c033-7047-b010-e3f75a0e929c.png Captured: 2026-09-23 19:36:47 UTC Source report: https://urlscan.io/result/01a0cfd3-c355-71f9-b907-8af6d201735a/ - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/24f210a0-9616-49f0-a61b-be3984fac715.png Captured: 2026-09-23 19:43:01 UTC Source report: https://radar.cloudflare.com/scan/24f210a0-9616-49f0-a61b-be3984fac715 SHA-256: 4d8d8a2c3dc23a3f79904707dc50f7b396d11481af6268b306de810f4931821c - URLScan · 2026-09-23: https://screenshots.phishdestroy.io/us/01a0cfd8-8f94-73bc-b99c-c525cca2312b.png Captured: 2026-09-23 19:58:10 UTC Source report: https://urlscan.io/result/01a0cfd8-8f94-73bc-b99c-c525cca2312b/ SHA-256: f9626aa0c0f26cb014498221ee52e1accca8897dde4eafe04b8e9998df6a1751 ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-20T21:00:36Z", "uuid": "01a0cfd3-c355-71f9-b907-8af6d201735a", "scanned_at": "2026-09-23T19:52:57Z", "final_url": "https://shop.olacoffee.vn/", "status": 200, "redirected": "https-only", "redirects": [ { "to": "https://shop.olacoffee.vn/", "from": "http://shop.olacoffee.vn/", "status": 307 } ], "ip": "36.50.26.127", "ips": [ "36.50.26.127" ], "asns": [ "150895" ], "countries": [ "VN" ], "link_domains": [ "goo.gl", "olacoffee.vn", "www.facebook.com" ], "social": [ "https://www.facebook.com/coffeedaongoc" ], "doc_hash": "153180c2e9ae3c9f0220b98854101a2fb9d3e066c99f0b9156725652548a83c7", "script_hashes": [ "b16654b5e174763afea2742f82461a1fbadb8f8ee312d862e29e9c9c64d3c500", "32b91976ef7354384fb7bc5b24fc4b4e46ed5fc3f2ffa40ef4b5a4cbe71c8e27", "f9f57621a4cc1edc44f5773255e00bbc685df017936fe5a815c2fe8d90ed91f5" ], "globals": [ "route", "showInstallPromotion", "axios", "Ziggy", "CACHE_NAME", "OFFLINE_URL", "filesToCache", "deferredPrompt" ], "cookies": [ "XSRF-TOKEN", "ola_coffee_session" ], "tls": { "san": [ "shop.olacoffee.vn" ], "cipher": "AES_256_GCM", "issuer": "YR2", "subject": "shop.olacoffee.vn", "protocol": "TLS 1.3", "valid_to": "2026-11-16T19:19:38Z", "valid_from": "2026-08-18T19:19:39Z" }, "domain_age_days": 465, "apex_age_days": 1602, "tls_age_days": 36, "tls_valid_days": 89, "requests": 22, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 1, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "nginx", "content-type": "text/html; charset=UTF-8", "strict-transport-security": "max-age=31536000" } }, "cf": { "v": 1, "fetched_at": "2026-10-20T21:07:19Z", "uuid": "24f210a0-9616-49f0-a61b-be3984fac715", "scanned_at": "2026-09-23T19:43:01Z", "final_url": "https://shop.olacoffee.vn/", "status": 200, "history": [ { "url": "https://shop.olacoffee.vn/", "status": 200 } ], "dom_hash": "c3ef6e8d2ab7db65f42ffbf5f4f9fcf9222a3ff7512a1a6a310f10cd21ed267e", "doc_hash": "153180c2e9ae3c9f0220b98854101a2fb9d3e066c99f0b9156725652548a83c7", "domain_risks": [ "Malware", "Security threats", "CIPA Filter", "CIPA" ], "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "shop.olacoffee.vn", "type": "A", "value": "36.50.26.127" } ], "dnssec_valid": false, "ip": "36.50.26.127", "verdict": { "tags": [ "malware" ], "malicious": true, "categories": [ "malware" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-21T19:37:16Z", "analysis_at": "2026-10-16T07:27:05Z", "stats": { "timeout": 0, "harmless": 46, "malicious": 13, "suspicious": 3, "undetected": 30 }, "detections": { "DNS8": "suspicious", "ESET": "suspicious", "VIPRE": "phishing", "G-Data": "phishing", "Lionic": "phishing", "Sophos": "phishing", "CyRadar": "phishing", "Webroot": "malicious", "Fortinet": "phishing", "SOCRadar": "phishing", "URLQuery": "malicious", "Kaspersky": "phishing", "Seclookup": "malicious", "Gridinsoft": "suspicious", "BitDefender": "phishing", "Forcepoint ThreatSeeker": "phishing" }, "reputation": 0, "first_seen": "2025-06-15T14:33:59Z", "dns": [ { "ttl": 3600, "type": "A", "value": "36.50.26.127" } ], "dns_at": "2026-10-16T07:32:28Z", "jarm": "3fd3fd0003fd3fd21c42d42d000000bdfc58c9a46434368cf60aa440385763", "cert": { "san": [ "shop.olacoffee.vn" ], "issuer": "Let's Encrypt / YR2", "serial": "5f359247e1fcce01bc7f519b0697da4931", "sha256": "28558dbb9ded4b812886ce53e0ca599c77158346b87de00f8a887066412df435", "subject": "shop.olacoffee.vn", "valid_to": "2027-01-13T22:41:38Z", "valid_from": "2026-10-15T22:41:39Z" } } } ```