# PhishDestroy domain threat record: zwglasif.shop Content language: English Canonical HTML report: https://phishdestroy.io/domain/zwglasif.shop/ Machine-readable companion: https://phishdestroy.io/domain/zwglasif.shop/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-09-20 21:17:57 UTC - Last availability or vendor check: 2026-10-22 10:34:27 UTC - Stored record updated: 2026-10-22 16:07:29 UTC - VirusTotal detections in the stored snapshot: 17/91 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: flagged ## Stored infrastructure - Observed IP address: 43.172.114.23 - Registrar in stored WHOIS data: West263 International Limited - Registrar country in stored WHOIS data: Unknown - Last stored HTTP status: 200 - Registration date in stored WHOIS data: 2025-12-06 07:33:44 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a0c0b0-b8e5-7029-852b-141b8a99a906/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/zwglasif.shop - Certificate Transparency search: https://crt.sh/?q=%25.zwglasif.shop - Web Archive lookup: https://web.archive.org/web/*/https://zwglasif.shop/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview zwglasif.shop presents itself as "Totto: Official Totto Store Spain", copying the bags and backpacks brand to look like its authorised Spanish web shop. It targets shoppers in Spain who are searching for Totto products or clicking discount ads. A random-looking .shop domain with no connection to the brand is a typical sign of a fake storefront. PhishDestroy first flagged it on 2026-09-20, and the site was still online and serving its shop content on 2026-10-19. How the scam works Fake brand stores like this one draw visitors with heavy discounts on recognisable products and copied branding, then lead them through a normal-looking checkout. The victim enters their name, address, phone number and full card details, which go straight to the operators. The usual outcome is a charge with nothing delivered, or a cheap counterfeit. The stolen card data and personal details can also be reused for further fraud or targeted phishing. Evidence Seventeen of 91 VirusTotal engines classified the domain as malicious when it was checked on 2026-09-30. The flagging engines include BitDefender, ESET, Fortinet, Forcepoint ThreatSeeker, G-Data, CRDF, CyRadar and alphaMountain.ai. Google Safe Browsing lists it for social engineering, and Spamhaus DBL lists it as a phishing domain. It also appears in five AlienVault OTX threat pulses, so several independent sources have reached the same conclusion. Infrastructure The domain was registered on 2025-12-06 through West263 International Limited, roughly nine and a half months before PhishDestroy detected it. That gap suggests it was registered well in advance, either held in reserve or used quietly before being reported. The site is hosted on a Tencent network address located in the US. It uses a free Let's Encrypt certificate, so the padlock in the browser only means the connection is encrypted and says nothing about whether the shop is genuine. What to do If you ordered from this site, contact your bank right away to block the card, dispute the charge as fraud and request a replacement card. Watch your statements for further unauthorised transactions. Be wary of emails, texts or calls that mention your order or offer a refund, since the operators now have your contact details. Buy Totto products only through the brand's verified official channels or authorised retailers. Security teams and payment providers should block the domain, report the impersonation to Totto, and add the domain to mail and web filters. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a0c0b0-b8e5-7029-852b-141b8a99a906/ VirusTotal report: https://www.virustotal.com/gui/domain/zwglasif.shop Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=zwglasif.shop Archived copy: https://web.archive.org/web/20260920211925/https://zwglasif.shop/ Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-19 09:37:57 UTC ## Stored page captures - Primary capture: https://urlscan.io/screenshots/01a0c0b0-b8e5-7029-852b-141b8a99a906.png Captured: 2026-09-20 21:22:03 UTC - URLScan capture 1: https://screenshots.phishdestroy.io/01a0c0b0-b8e5-7029-852b-141b8a99a906.png Captured: 2026-09-20 21:22:03 UTC Source report: https://urlscan.io/result/01a0c0b0-b8e5-7029-852b-141b8a99a906/ - URLScan capture 2: https://urlscan.io/screenshots/01a03caa-9e86-721d-a676-7223dc839017.png Captured: 2026-09-20 21:17:57 UTC Source report: https://urlscan.io/result/01a0c0b0-b8e5-7029-852b-141b8a99a906/ - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/299f6131-89e9-48bd-b1b3-d4b275c13e6e.png Captured: 2026-09-20 21:20:03 UTC Source report: https://radar.cloudflare.com/scan/299f6131-89e9-48bd-b1b3-d4b275c13e6e SHA-256: f194031d75026e1b057a036487dddd1cf96865006d2dd57c38fd533eb8a8c113 - URLQuery: https://screenshots.phishdestroy.io/uq/7aeaea92-a990-4a26-8844-64ad6ea3969e.png Source report: https://urlquery.net/report/7aeaea92-a990-4a26-8844-64ad6ea3969e SHA-256: 686a5210ecfc4c5eab472f59a452404adb15dc4abc519847fa55707065355a44 - URLScan · 2026-08-25: https://screenshots.phishdestroy.io/us/01a0384f-7c98-703a-b02b-69bd0bb2c0f5.png Captured: 2026-08-25 09:45:40 UTC Source report: https://urlscan.io/result/01a0384f-7c98-703a-b02b-69bd0bb2c0f5/ SHA-256: c9104ab03e054d5b069736b6b3cd6c847e0ee1667b94be3473cebfaf9be8fed3 - URLScan · 2026-08-26: https://screenshots.phishdestroy.io/us/01a03caa-9e86-721d-a676-7223dc839017.png Captured: 2026-08-26 06:03:36 UTC Source report: https://urlscan.io/result/01a03caa-9e86-721d-a676-7223dc839017/ SHA-256: f98f6407bcc29292846b94a5988659e60e3b2d5d5339772d4c82f8faa5909132 ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-20T22:22:37Z", "uuid": "01a0c0b0-b8e5-7029-852b-141b8a99a906", "scanned_at": "2026-09-20T21:20:09Z", "final_url": "https://zwglasif.shop/", "status": 200, "redirected": "https-only", "redirects": [ { "to": "https://zwglasif.shop/", "from": "http://zwglasif.shop/", "status": 307 } ], "ip": "43.172.114.23", "ips": [ "43.172.114.23" ], "asns": [ "132203" ], "countries": [ "SG" ], "doc_hash": "6c5d74593398868b7285edba64f53c5db909a6fd2cf4052b5a617609d3b62b5d", "tls": { "san": [ "zwglasif.shop" ], "cipher": "AES_256_GCM", "issuer": "YR2", "subject": "zwglasif.shop", "protocol": "TLS 1.3", "valid_to": "2026-11-23T01:36:51Z", "valid_from": "2026-08-25T01:36:52Z" }, "domain_age_days": 288, "apex_age_days": 288, "tls_age_days": 26, "tls_valid_days": 89, "requests": 2, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 78, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "nginx", "content-type": "text/html; charset=utf-8" } }, "cf": { "v": 1, "fetched_at": "2026-10-20T22:30:54Z", "uuid": "299f6131-89e9-48bd-b1b3-d4b275c13e6e", "scanned_at": "2026-09-20T21:20:03Z", "final_url": "https://zwglasif.shop/", "status": 200, "history": [ { "url": "https://zwglasif.shop/", "status": 200 } ], "dom_hash": "19dacc22902476e4a8c4eb29bbfb9050c8095d1c6a1d5adc4425f8b66c1a9ac0", "doc_hash": "bc294ca8afa20f73e7b64406258a9507347eaaac86ff8b983cfd2a201592f73c", "phishing_v2": [ "phishing" ], "domain_risks": [ "Malware", "Security threats", "DGA Domains", "CIPA Filter", "CIPA" ], "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "zwglasif.shop", "type": "A", "value": "43.172.114.23" } ], "dnssec_valid": false, "ip": "43.172.114.23", "verdict": { "tags": [ "malware", "dga domains" ], "malicious": true, "categories": [ "malware", "dga domains" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-22T01:53:48Z", "analysis_at": "2026-10-19T01:42:33Z", "stats": { "timeout": 0, "harmless": 44, "malicious": 15, "suspicious": 3, "undetected": 30 }, "detections": { "CRDF": "malicious", "DNS8": "suspicious", "ESET": "suspicious", "VIPRE": "phishing", "G-Data": "phishing", "Lionic": "phishing", "Sophos": "phishing", "CyRadar": "phishing", "Fortinet": "phishing", "PREBYTES": "phishing", "SOCRadar": "phishing", "URLQuery": "malicious", "Seclookup": "malicious", "Gridinsoft": "suspicious", "BitDefender": "phishing", "alphaMountain.ai": "phishing", "Google Safe Browsing": "phishing", "Forcepoint ThreatSeeker": "phishing" }, "reputation": 0, "first_seen": "2025-12-06T09:57:35Z", "dns": [ { "ttl": 3600, "type": "NS", "value": "ns3.363.hk" }, { "ttl": 3600, "type": "NS", "value": "ns4.363.hk" }, { "ttl": 900, "type": "A", "value": "43.172.114.23" }, { "ttl": 3600, "type": "NS", "value": "ns2.363.hk" }, { "ttl": 3600, "type": "SOA", "rname": "dnsconct.363.hk", "value": "ns1.363.hk" }, { "ttl": 3600, "type": "NS", "value": "ns1.363.hk" } ], "dns_at": "2026-10-19T01:47:49Z", "jarm": "15d3fd16d29d29d00042d43d00000041ad16ead50175e1e575f5579aa6b5c8", "cert": { "san": [ "zwglasif.shop" ], "issuer": "Let's Encrypt / YR2", "serial": "67e3c310434d7b37576eeb270e4ca0079a2", "sha256": "c6ddc0c2fd220f83dd6c4d1db98a8dcab917b6d58237601646cdf149eef0b14c", "subject": "zwglasif.shop", "valid_to": "2026-11-23T01:36:51Z", "valid_from": "2026-08-25T01:36:52Z" } } } ```