# PhishDestroy domain threat record: stawki-bet.co.ua

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/stawki-bet.co.ua/
Machine-readable companion: https://phishdestroy.io/domain/stawki-bet.co.ua/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-09-05 19:30:48 UTC
- Last availability or vendor check: 2026-10-22 10:33:48 UTC
- Stored record updated: 2026-10-22 16:07:29 UTC
- VirusTotal detections in the stored snapshot: 14/89
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: mastercard

## Stored infrastructure

- Observed IP address: 45.83.192.158
- Registrar in stored WHOIS data: Service Online LLC
- Registrar country in stored WHOIS data: Unknown
- Last stored HTTP status: 200
- Registration date (registry RDAP, co.ua): 2004-02-25 16:13:13 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a0730c-699e-73e6-ad26-6913a9715ddd/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/stawki-bet.co.ua
- Certificate Transparency search: https://crt.sh/?q=%25.stawki-bet.co.ua
- Web Archive lookup: https://web.archive.org/web/*/https://stawki-bet.co.ua/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
stawki-bet.co.ua is an impersonation phishing page whose name pairs "stawki" ("bets" in Polish) with "bet" under a Ukrainian domain extension. That framing points at people looking for online betting or sportsbook services. PhishDestroy first flagged it on 2026-09-05, and on 2026-10-19 the site was still up and serving content.

How the scam works
Impersonation pages copy the look and wording of a service the victim already trusts. On a betting-themed site, that usually means a login form or a deposit page. The victim enters a username, password or card details, believing they are on a real bookmaker, and those details go straight to the operator. Any deposit made there is gone, and stolen logins can be reused against the genuine service or other accounts that share the password. The page currently returns the title "406 Not Acceptable", a server error message, while our classification is impersonation phishing.

Evidence
On 2026-09-11, 14 of 89 VirusTotal engines marked the domain as malicious. They include alphaMountain.ai, BitDefender, CRDF, ESET, Forcepoint ThreatSeeker, Fortinet, G-Data and Gridinsoft. Detections from that many unrelated vendors mean the verdict does not rest on a single source. The domain is also on the PhishDestroy blocklist.

Infrastructure
The domain was registered on 2004-02-25, more than two decades before we detected it. An aged name like this can slip past filters that weigh domain age as a trust signal. It is registered through Service Online LLC and hosted in the Netherlands on the network of PE Skurykhin Mukola Volodumurovuch, at 45.83.192.158. Its Let's Encrypt certificate gives the padlock icon but says nothing about who runs the site.

What to do
If you logged in on this site, change that password immediately, and change it anywhere else you reused it. Then turn on two-factor authentication with your real betting provider. If you entered card details or made a deposit, contact your bank or card issuer to block the card and dispute the charge. Watch your statements for unfamiliar transactions. Defenders should block the domain and its IP, search proxy and DNS logs for past visits, and warn users who tried to reach betting services through unofficial links.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a0730c-699e-73e6-ad26-6913a9715ddd/
VirusTotal report: https://www.virustotal.com/gui/domain/stawki-bet.co.ua
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=stawki-bet.co.ua
Archived copy: https://web.archive.org/web/20260922092214/https://stawki-bet.co.ua/
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 09:48:55 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/cKhDWC7v/622db5762b54.png
  Captured: 2026-09-05 19:30:48 UTC
- URLScan capture 1: https://screenshots.phishdestroy.io/01a0730c-699e-73e6-ad26-6913a9715ddd.png
  Captured: 2026-09-05 19:30:48 UTC
  Source report: https://urlscan.io/result/01a0730c-699e-73e6-ad26-6913a9715ddd/
- URLScan capture 2: https://urlscan.io/screenshots/01a0a442-e5a3-763d-ae99-9089ca6cd310.png
  Captured: 2026-09-05 19:30:48 UTC
  Source report: https://urlscan.io/result/01a0730c-699e-73e6-ad26-6913a9715ddd/
- URLQuery: https://screenshots.phishdestroy.io/uq/fc799d64-d9c7-4f74-84b5-7db36978eaf7.png
  Captured: 2026-09-05 19:43:00 UTC
  Source report: https://urlquery.net/report/fc799d64-d9c7-4f74-84b5-7db36978eaf7
  SHA-256: 686a5210ecfc4c5eab472f59a452404adb15dc4abc519847fa55707065355a44
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/c951f0e1-1304-4552-bc66-2dfc2353613b.png
  Captured: 2026-09-05 20:12:51 UTC
  Source report: https://radar.cloudflare.com/scan/c951f0e1-1304-4552-bc66-2dfc2353613b
  SHA-256: a74fb3be1b4575162146966ce558d26740d0f3f2ccb4f7dc29d6d987aafedd5b
- URLScan · 2026-09-05: https://screenshots.phishdestroy.io/us/01a0730e-b565-715f-ad0b-d0111b7c0fca.png
  Captured: 2026-09-05 19:32:26 UTC
  Source report: https://urlscan.io/result/01a0730e-b565-715f-ad0b-d0111b7c0fca/
  SHA-256: 443adcb4b42d9c413a752ef68734936bc85c8fa41f16737d949e9ac681e3f437
- URLScan · 2026-09-05: https://screenshots.phishdestroy.io/us/01a07332-67f3-769b-b83f-cf36544fa4d6.png
  Captured: 2026-09-05 20:11:29 UTC
  Source report: https://urlscan.io/result/01a07332-67f3-769b-b83f-cf36544fa4d6/
  SHA-256: 443adcb4b42d9c413a752ef68734936bc85c8fa41f16737d949e9ac681e3f437
- URLScan · 2026-09-05: https://screenshots.phishdestroy.io/us/01a07333-aebd-710e-9ac5-927065c1fcfe.png
  Captured: 2026-09-05 20:12:50 UTC
  Source report: https://urlscan.io/result/01a07333-aebd-710e-9ac5-927065c1fcfe/
  SHA-256: 443adcb4b42d9c413a752ef68734936bc85c8fa41f16737d949e9ac681e3f437
- URLScan · 2026-09-10: https://screenshots.phishdestroy.io/us/01a08a81-9d8d-763f-a757-f1a7f9e2e379.png
  Captured: 2026-09-10 08:49:38 UTC
  Source report: https://urlscan.io/result/01a08a81-9d8d-763f-a757-f1a7f9e2e379/
  SHA-256: 5ae3453a5097b3875e0f59788976dde38845e7e82af6f566b5a13cc9399a2644
- URLScan · 2026-09-15: https://screenshots.phishdestroy.io/us/01a0a442-e5a3-763d-ae99-9089ca6cd310.png
  Captured: 2026-09-15 08:51:16 UTC
  Source report: https://urlscan.io/result/01a0a442-e5a3-763d-ae99-9089ca6cd310/
  SHA-256: 2caffcf82d4e13ec9af9cce89f6e53ca660b920d2d445ee060e04e66fd316a0d

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-21T03:48:48Z",
        "uuid": "01a0730c-699e-73e6-ad26-6913a9715ddd",
        "scanned_at": "2026-09-05T19:30:01Z",
        "final_url": "https://stawki-bet.co.ua/",
        "status": 200,
        "ip": "45.83.192.158",
        "ptr": "158.192.83.45.eushared21.twinservers.net",
        "domains": [
            "s.w.org",
            "fonts.gstatic.com",
            "www.clarity.ms",
            "fonts.googleapis.com"
        ],
        "ips": [
            "192.0.77.48",
            "142.250.207.3",
            "57.155.120.218",
            "142.251.42.106",
            "45.83.192.158"
        ],
        "asns": [
            "2635",
            "15169",
            "8075",
            "56851"
        ],
        "countries": [
            "US",
            "SG",
            "NL"
        ],
        "doc_hash": "3d230e25f70b4281364bf1345aab64ecc10ba19f557edd11752e1ee19a6b2182",
        "script_hashes": [
            "cb6f2d32c49d1c2b25e9ffc9aaafa3f83075346c01bcd4ae6eb187392a4292cf",
            "5274f11e6fb32ae0cf2dfb9f8043272865c397a7c4223b4cfa7d50ea52fbde89",
            "c2ca2f071e8bd0e7f9c878707ff16c51e14aeba087313a988466cb1ca52bf2af",
            "f279225a89838686761ad4f3973638ab4fbb9adc0f2b74da5f091ab6e46de3be",
            "1c98b25727b9a2a43f5a6232bc803853eaac58e39f05d7a1b520dffeaf98ce8b",
            "063840b4b3f5869e0f0d078bab8bd29cfb3a59ee85e8e3edbbec35a8fe846fd3"
        ],
        "globals": [
            "jQuery",
            "u$",
            "cssBgParser",
            "ResponsiveMenu",
            "CookiesConsent",
            "MailChimpForm",
            "loadMapsContent",
            "mapIframeApiReady",
            "MapsLoader",
            "Lightbox",
            "skrollr",
            "Waypoint",
            "WaypointAdapter",
            "_npStickyStack",
            "_npInitMenuLink",
            "AnimationInfo",
            "AnimationEventScroll",
            "AnimationEventSlider",
            "WillChangeHint",
            "AnimationFactory",
            "CountUp",
            "StepAnimationState",
            "StepCss",
            "StepAnimation",
            "uAnimation",
            "_npScrollAnchor",
            "_npScrollSpyInit",
            "ImageZoom",
            "_npHorizontalLayoutSlider",
            "TabsControl",
            "_npTabsInit",
            "lazySizes",
            "_npLazyImages",
            "lazySizesConfig",
            "_npDialogsInit",
            "Currency",
            "VariationHelper",
            "_npAccordionInit",
            "setImmediate",
            "clearImmediate"
        ],
        "storage_keys": [
            "wpEmojiSettingsSupports"
        ],
        "tls": {
            "san": [
                "stawki-bet.co.ua",
                "www.stawki-bet.co.ua"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "YR1",
            "subject": "stawki-bet.co.ua",
            "protocol": "TLS 1.3",
            "valid_to": "2026-11-24T16:00:40Z",
            "valid_from": "2026-08-26T16:00:41Z"
        },
        "domain_age_days": 295,
        "apex_age_days": 295,
        "tls_age_days": 10,
        "tls_valid_days": 89,
        "requests": 132,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 74,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "LiteSpeed",
            "content-type": "text/html; charset=UTF-8",
            "x-powered-by": "PHP/8.3.33"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-21T03:59:35Z",
        "uuid": "c951f0e1-1304-4552-bc66-2dfc2353613b",
        "scanned_at": "2026-09-05T20:12:51Z",
        "final_url": "https://stawki-bet.co.ua/",
        "status": 200,
        "history": [
            {
                "url": "https://stawki-bet.co.ua/",
                "status": 200
            }
        ],
        "dom_hash": "85f0b6115fe7646688c768b2606f3292a2e63c67dbffb2a5019c7a8dd9c8c3a0",
        "doc_hash": "515031f997f9161e5637af3073d23d467dd95f8223293256612cae4087d3f040",
        "domain_risks": [
            "Phishing",
            "Security threats",
            "CIPA Filter",
            "CIPA"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "stawki-bet.co.ua",
                "type": "A",
                "value": "45.83.192.158"
            }
        ],
        "dnssec_valid": false,
        "ip": "45.83.192.158",
        "verdict": {
            "tags": [
                "phishing"
            ],
            "malicious": true,
            "categories": [
                "phishing"
            ]
        },
        "whois": {
            "registrar": "NIC.UA LLC (nic-mnt-cunic)",
            "created": "2025-03-27T09:37:10Z",
            "updated": "2026-08-31T13:51:48Z",
            "expires": "2027-03-27T09:37:10Z",
            "nameservers": [
                "dns2.hostiq.ua",
                "dns1.hostiq.ua"
            ]
        }
    }
}
```