# PhishDestroy domain threat record: wzvnhvro.shop

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/wzvnhvro.shop/
Machine-readable companion: https://phishdestroy.io/domain/wzvnhvro.shop/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-09-20 10:03:25 UTC
- Last availability or vendor check: 2026-10-22 10:34:24 UTC
- Stored record updated: 2026-10-22 16:07:29 UTC
- VirusTotal detections in the stored snapshot: 15/91
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: flagged

## Stored infrastructure

- Observed IP address: 43.172.114.23
- Registrar in stored WHOIS data: West263 International Limited
- Registrar country in stored WHOIS data: Unknown
- Last stored HTTP status: 200
- Registration date in stored WHOIS data: 2025-12-06 07:33:47 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a0be43-b460-73a9-b508-bb8c68ef6730/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/wzvnhvro.shop
- Certificate Transparency search: https://crt.sh/?q=%25.wzvnhvro.shop
- Web Archive lookup: https://web.archive.org/web/*/https://wzvnhvro.shop/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
wzvnhvro.shop is an impersonation phishing page posing as an official shop for Totto, the backpack and accessories brand. Its page title, "Totto: Offizieller Totto Store Spanien", is written in German but claims to be Totto's official store for Spain, which suggests it is aimed at European shoppers looking for discounted Totto goods. PhishDestroy first flagged the domain on 2026-09-20, and as of 2026-10-19 the site was still online and serving its storefront.

How the scam works
Fake brand stores copy a real retailer's look, fill it with heavily discounted products, and send traffic to it through ads and search results. The checkout is the trap. Shoppers enter their name, address and card details, then either receive nothing or get a cheap counterfeit, while the card data can be reused for further fraud. A random-looking .shop domain dressed up as an "official" store, with no link to the brand's real web presence, is the core of this deception.

Evidence
Fifteen of 91 VirusTotal engines flagged the domain as of 2026-10-03, including Google Safe Browsing, ESET, BitDefender, Fortinet, Forcepoint ThreatSeeker, G-Data, CRDF and alphaMountain.ai. Google Safe Browsing lists it under SOCIAL_ENGINEERING, so Chrome and other browsers that use it should show a warning. urlscan.io returned a malicious verdict and specifically identified the page as a fake shop. Spamhaus lists the domain in its DBL as phishing, it appears in five AlienVault OTX threat pulses, and it is on the PhishDestroy blocklist.

Infrastructure
The domain was registered on 2025-12-06 through West263 International Limited, about nine months before PhishDestroy detected it. That gap fits domains that are registered in bulk and activated later. The site is hosted on a Tencent network with an IP that geolocates to the US. It uses a free Let's Encrypt certificate, so the padlock in the address bar only means the connection is encrypted. It says nothing about whether the shop is genuine.

What to do
If you placed an order or entered card details on wzvnhvro.shop, contact your bank right away to block the card, dispute the charge and request a replacement. Watch your statements for unfamiliar transactions. If you created an account there, change that password anywhere else you use it. Expect follow-up phishing to the email address and phone number you gave, and buy Totto products only through the brand's verified channels. Defenders should block the domain at DNS and proxy level, add it to email and ad filtering, and report it to Totto's brand-protection team.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a0be43-b460-73a9-b508-bb8c68ef6730/
VirusTotal report: https://www.virustotal.com/gui/domain/wzvnhvro.shop
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=wzvnhvro.shop
Archived copy: https://web.archive.org/web/20260922140940/https://wzvnhvro.shop/
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 10:57:47 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/VpgY86LH/5b0c16a9c5c3.png
  Captured: 2026-09-20 10:03:25 UTC
- URLScan capture 1: https://screenshots.phishdestroy.io/01a0be43-b460-73a9-b508-bb8c68ef6730.png
  Captured: 2026-09-20 10:03:25 UTC
  Source report: https://urlscan.io/result/01a0be43-b460-73a9-b508-bb8c68ef6730/
- URLScan capture 2: https://urlscan.io/screenshots/01a03caa-5e58-75bc-bf2f-e8771f0591d2.png
  Captured: 2026-09-20 09:59:35 UTC
  Source report: https://urlscan.io/result/01a0be43-b460-73a9-b508-bb8c68ef6730/
- URLQuery: https://screenshots.phishdestroy.io/uq/4b1d5aae-9e50-40a5-ab37-19d15e7c2fc7.png
  Captured: 2026-09-20 10:07:34 UTC
  Source report: https://urlquery.net/report/4b1d5aae-9e50-40a5-ab37-19d15e7c2fc7
  SHA-256: 686a5210ecfc4c5eab472f59a452404adb15dc4abc519847fa55707065355a44
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/1df4277c-55da-4690-9162-1a6a806146e2.png
  Captured: 2026-09-20 10:10:15 UTC
  Source report: https://radar.cloudflare.com/scan/1df4277c-55da-4690-9162-1a6a806146e2
  SHA-256: b1dd3c50d1ec3af84ddc346c913b0eea4bd6427696b75f2ebe4aac3865c3f8f1
- URLScan · 2026-08-25: https://screenshots.phishdestroy.io/us/01a0384f-84c5-765f-8c0e-1ebb0ffc6787.png
  Captured: 2026-08-25 09:45:37 UTC
  Source report: https://urlscan.io/result/01a0384f-84c5-765f-8c0e-1ebb0ffc6787/
  SHA-256: f98f6407bcc29292846b94a5988659e60e3b2d5d5339772d4c82f8faa5909132
- URLScan · 2026-08-26: https://screenshots.phishdestroy.io/us/01a03caa-5e58-75bc-bf2f-e8771f0591d2.png
  Captured: 2026-08-26 06:04:47 UTC
  Source report: https://urlscan.io/result/01a03caa-5e58-75bc-bf2f-e8771f0591d2/
  SHA-256: f98f6407bcc29292846b94a5988659e60e3b2d5d5339772d4c82f8faa5909132
- URLScan · 2026-09-20: https://screenshots.phishdestroy.io/us/01a0be47-03cd-713d-a522-95288e13c4d5.png
  Captured: 2026-09-20 10:06:03 UTC
  Source report: https://urlscan.io/result/01a0be47-03cd-713d-a522-95288e13c4d5/
  SHA-256: 5af15ec906004539f7dbb5d41b5410a9439aa16b290540e50f59c11032d379da

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-20T22:23:48Z",
        "uuid": "01a0be43-b460-73a9-b508-bb8c68ef6730",
        "scanned_at": "2026-09-20T10:02:20Z",
        "final_url": "https://wzvnhvro.shop/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://wzvnhvro.shop/",
                "from": "http://wzvnhvro.shop/",
                "status": 307
            },
            {
                "to": "http://wzvnhvro.shop/",
                "from": "https://wzvnhvro.shop/",
                "status": 307
            },
            {
                "to": "https://wzvnhvro.shop/",
                "from": "http://wzvnhvro.shop/",
                "status": 307
            }
        ],
        "ip": "43.172.114.23",
        "domains": [
            "cdn.pddmooncdn.com",
            "translate-pa.googleapis.com",
            "www.gstatic.com",
            "translate.googleapis.com",
            "translate.google.com",
            "fonts.gstatic.com",
            "connect.facebook.net",
            "www.google.com"
        ],
        "ips": [
            "192.178.183.95",
            "172.217.113.4",
            "142.251.150.119",
            "142.251.110.94",
            "2001:4860:4847:400::",
            "2a00:1450:4001:c15::5f",
            "2a00:1450:4001:c17::5e",
            "2a00:1450:4001:c0f::65",
            "192.178.183.94",
            "157.240.0.6",
            "35.241.43.136",
            "43.172.114.23"
        ],
        "asns": [
            "15169",
            "32934",
            "396982",
            "132203"
        ],
        "countries": [
            "US",
            "DE",
            "SG"
        ],
        "link_domains": [
            "www.facebook.com",
            "www.pinterest.com",
            "translate.google.com"
        ],
        "social": [
            "https://www.facebook.com"
        ],
        "doc_hash": "a378a3d254336ea18d0d765cf17c7ed4626603045507e74ddde348294301ea02",
        "script_hashes": [
            "0bac2014c32c928df3bdac1e0ea9936e84724fb656c25ebfea9374a2d25d2701",
            "107dbc6c7aa4c6c8340e44695a119799e4c8d4ce6f18d019dcad6b21edcd6029",
            "f4a099229036ccbb066da0f978318cee3f2edfaffd99e1955d6e8ffdecaaee20",
            "2c59eed652b88f5773dd480c80519fa5c6b95b4ae21f02879e5b08f058dd94c5",
            "0329c811ee1ab9d32e00d317ebb7b1dc5239d0b4aa6bc21ff9a58999a80bff99",
            "28cc7e0e796fb3f0d0f597b9d0804e1aa8850fb5816f04195a7296d74e078864",
            "3a6d22a2b4945857c42d1b70ab10394ec8fbedcbc46bfd2e3a9cd316665dcff1",
            "0c0f08b7c9c72bc8c3d18622db16699b8cda83fc2138774de5084e522e50692c",
            "adee9fc19c16e96c114900c6235cfeb057caaab31e27211d0c67216bf0eb716d",
            "daadde97c5f3db55f3886f24a7c9436e901c9b78cb1e148a21e801aa7677e60d"
        ],
        "globals": [
            "_wzvnhvroshop_",
            "_BBZHCCD_",
            "themeConfig",
            "shop_theme",
            "storeConfig",
            "shop_config",
            "lang",
            "shop_lang",
            "C_SETTINGS",
            "_GET_C_SETTING_",
            "oemcart_client_browser",
            "oemcart_current_template",
            "oemcart_store_id",
            "oemcart_user_id",
            "oemcart_time_zone",
            "oemcart_page_ca",
            "oemcart_user_email",
            "oemcart_pv_id",
            "oemcart_data_from",
            "oemcart_user",
            "oemcart_currency",
            "oemcart_currency_code",
            "oemcart_currency_rate",
            "oemcart_currency_lcoin",
            "oemcart_currency_rcoin",
            "oemcart_currency_decimal",
            "oemcart_base_currency",
            "oemcart_base_currency_code",
            "oemcart_base_currency_rate",
            "oemcart_base_currency_lcoin",
            "oemcart_base_currency_rcoin",
            "oemcart_base_currency_decimal",
            "oemcart_website_domain",
            "oemcart_real_domain",
            "oemcart_site_type",
            "oemcart_client_country",
            "oemcart_protocal_type",
            "oemcart_website_language",
            "oemcart_utm_source",
            "oemcart_utm_medium"
        ],
        "cookies": [
            "_fbp",
            "_bcbcca_vid",
            "_bcbcca_cvid",
            "_bcbcca_vs",
            "utm_source",
            "utm_medium",
            "order_utm_history",
            "landing_page",
            "_bcbcca_ka",
            "first_http_referer",
            "first_visit_time",
            "currency_code",
            "PHPSESSID",
            "_BBZHCCD_ua",
            "_BBZHCCD_pu",
            "_BBZHCCD_tz",
            "_BBZHCCD_ss",
            "_BBZHCCD_lang",
            "_BBZHCCD_vs",
            "_BBZHCCD_dt"
        ],
        "storage_keys": [
            "lastExternalReferrer",
            "lastExternalReferrerTime",
            "APP_GOOGLETRANSLATE_VISIT_COUNT"
        ],
        "tls": {
            "san": [
                "wzvnhvro.shop"
            ],
            "cipher": "AES_256_GCM",
            "issuer": "YR1",
            "subject": "wzvnhvro.shop",
            "protocol": "TLS 1.3",
            "valid_to": "2026-11-20T07:17:02Z",
            "valid_from": "2026-08-22T07:17:03Z"
        },
        "domain_age_days": 288,
        "apex_age_days": 288,
        "tls_age_days": 29,
        "tls_valid_days": 89,
        "requests": 117,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 100,
                "malicious": true
            },
            "overall": {
                "tags": [
                    "phishing"
                ],
                "score": 100,
                "brands": [
                    "fakeshop"
                ],
                "malicious": true,
                "categories": [
                    "phishing"
                ]
            },
            "urlscan": {
                "tags": [
                    "phishing"
                ],
                "score": 100,
                "brands": [
                    "Fake Shop"
                ],
                "malicious": true,
                "categories": [
                    "phishing"
                ]
            }
        },
        "headers": {
            "server": "nginx",
            "content-type": "text/html; charset=utf-8"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-20T22:31:42Z",
        "uuid": "1df4277c-55da-4690-9162-1a6a806146e2",
        "scanned_at": "2026-09-20T10:10:15Z",
        "final_url": "https://wzvnhvro.shop/",
        "status": 200,
        "redirected": "https-only",
        "history": [
            {
                "url": "http://wzvnhvro.shop/",
                "status": 307
            },
            {
                "url": "https://wzvnhvro.shop/",
                "status": 200
            }
        ],
        "dom_hash": "2141ff49c9df392dda9f66021375489cf39f7ffef8cd6cbf12217afe69e8ad63",
        "doc_hash": "0492b90c0f8c3f0fb2d030fa4aa35769a0137fd429331e7559652145ed483aa6",
        "phishing_v2": [
            "phishing"
        ],
        "domain_risks": [
            "Malware",
            "Security threats",
            "DGA Domains",
            "CIPA Filter",
            "CIPA"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "wzvnhvro.shop",
                "type": "A",
                "value": "43.172.114.23"
            }
        ],
        "dnssec_valid": false,
        "ip": "43.172.114.23",
        "verdict": {
            "tags": [
                "malware",
                "dga domains"
            ],
            "malicious": true,
            "categories": [
                "malware",
                "dga domains"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-22T01:56:13Z",
        "analysis_at": "2026-10-19T01:43:24Z",
        "stats": {
            "timeout": 0,
            "harmless": 44,
            "malicious": 14,
            "suspicious": 3,
            "undetected": 31
        },
        "detections": {
            "CRDF": "malicious",
            "DNS8": "suspicious",
            "ESET": "suspicious",
            "VIPRE": "phishing",
            "G-Data": "phishing",
            "Lionic": "phishing",
            "Sophos": "phishing",
            "Fortinet": "phishing",
            "PREBYTES": "phishing",
            "SOCRadar": "phishing",
            "URLQuery": "malicious",
            "Seclookup": "malicious",
            "Gridinsoft": "suspicious",
            "BitDefender": "phishing",
            "alphaMountain.ai": "phishing",
            "Google Safe Browsing": "phishing",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "tags": [
            "dga"
        ],
        "first_seen": "2025-12-06T09:58:52Z",
        "dns": [
            {
                "ttl": 3600,
                "type": "NS",
                "value": "ns3.363.hk"
            },
            {
                "ttl": 3600,
                "type": "SOA",
                "rname": "dnsconct.363.hk",
                "value": "ns1.363.hk"
            },
            {
                "ttl": 3600,
                "type": "NS",
                "value": "ns2.363.hk"
            },
            {
                "ttl": 900,
                "type": "A",
                "value": "43.172.114.23"
            },
            {
                "ttl": 3600,
                "type": "NS",
                "value": "ns4.363.hk"
            },
            {
                "ttl": 3600,
                "type": "NS",
                "value": "ns1.363.hk"
            }
        ],
        "dns_at": "2026-10-19T01:48:42Z",
        "jarm": "15d3fd16d29d29d00042d43d00000041ad16ead50175e1e575f5579aa6b5c8",
        "cert": {
            "san": [
                "wzvnhvro.shop"
            ],
            "issuer": "Let's Encrypt / YR1",
            "serial": "51ae4b535ac9eb778a8519e8935a67bb18c",
            "sha256": "56a5c11c89f726a5c4270a0cb92654dfb512a998ea14b20c0add05d89fe2c490",
            "subject": "wzvnhvro.shop",
            "valid_to": "2026-11-20T07:17:02Z",
            "valid_from": "2026-08-22T07:17:03Z"
        }
    }
}
```