bacalaloonline.shop is a fake online shop dressed up as a Spanish-language gourmet food store. Its page title is "Venta de Bacalao de Islandia y Conservas Gourmet | Bacalalo", which advertises Icelandic salt cod and gourmet preserves under the name Bacalalo. It targets shoppers looking for bacalao and specialty tinned goods online. PhishDestroy first flagged it on 2026-10-10, and the storefront was still live when last checked on 2026-10-19.
How the scam works
Fake food shops like this one copy the look of a real delicatessen. They show product photos, descriptions and prices that are attractive but believable, which suits a niche product like Icelandic cod where buyers expect specialist sellers. The shopper places an order and pays, and the goods either never ship or the order disappears after checkout. The victim loses the money paid. They may also lose the card details, name, address and phone number entered at checkout, and that information can be reused for fraud or follow-up scams.
Evidence
urlscan.io rates the site malicious and specifically identifies it as a fake shop. On VirusTotal, 6 of 92 engines flagged it as of 2026-10-15: CRDF, Forcepoint ThreatSeeker, Gridinsoft, LevelBlue, SOCRadar and URLQuery. That count is modest, which is typical for fresh e-commerce fraud, but six independent vendors agree. The domain also appears in four AlienVault OTX threat pulses and is listed on the PhishDestroy blocklist.
Infrastructure
The domain was registered through Dynadot Inc. on 2026-06-03, roughly four months before PhishDestroy detected it. That gap is long enough to build out a catalogue and pick up some search visibility before drawing attention. The site is served from an address on the network of Malakmadze Web LLC, a Georgian-registered provider, with the IP geolocated to the United States. A free Let's Encrypt certificate supplies the padlock icon, which proves nothing about the seller's legitimacy.
What to do
If you paid on this site, contact your bank or card issuer right away to dispute the charge and report it as merchant fraud. If you used a card, ask your bank to cancel and reissue it. Keep any order confirmations or emails as evidence. Be wary of later messages about "delivery problems" or refunds that ask for more payment or personal details. Defenders and payment providers should block the domain, watch for lookalike Bacalalo storefronts, and report the site to the registrar and hosting provider for takedown.
For this gTLD, the registrar above operates under an ICANN accreditation agreement. The links below provide the official fee schedule and current DNS abuse compliance guidance.
Accreditation is a contract, not a safety certification.
RAA §3.18 establishes abuse-contact and handling requirements. This report can document stored outbound notices and later technical observations; it does not by itself establish receipt, investigation, remediation, or contractual non-compliance.
Certificate fingerprinta9dc7a64e19903334666e4be640f13dd6d9bb7be4ec68ffa58b0699f96e3cb7fCertificate names · 1 SANs
bacalaloonline.shop
Saved certificate metadata. Certificate dates without a timezone are shown as stored. Transport encryption does not establish that the site is trustworthy.
Evidence layersAvailability: Content servingContent: Content served at rootDNS: ResolvedRegistration: Unknown
Latest HTTP observationコンテンツ公開中Ordinary HTTP content served90%2026-10-21 10:32:49 UTC
RDAP registration不明
Observed timelinelast reachable: 2026-10-21 10:32:49 UTClast content: 2026-10-21 10:32:49 UTC
Availability, content, DNS and registration are independent evidence layers. NXDOMAIN, an unreachable origin or missing content alone does not prove registrar action. A registrar or provider is credited only when a direct technical marker identifies that actor. Report causality is shown separately.
使用技術 · 1 identified
H
HTTP/3
Miscellaneous
HTTP/3 is the third major version of the Hypertext Transfer Protocol used to exchange information on the World Wide Web.
Keep original emails, receipts, messages and screenshots in a secure place. A factual timeline helps the receiving authority understand what happened. IC3 evidence guidance ↗
Payment records — if you paid, save the receipt, amount, date, payment provider and recipient details.
Your bank or payment provider — contact its fraud team promptly through official contact details if money or card information was exposed.
地元の警察 — たとえ直ちに行動を起こせなくても、公式な記録が残される
A report is not a guarantee of recovery or investigation, but prompt, accurate transaction data can help authorities and service providers trace the incident.
詐欺による金銭の返還を装った詐欺 — fraudsters pose as recovery agents and demand upfront fees. Never share a seed phrase or pay before independently verifying the provider
About this reportSources, observation dates and corrections
This report combines saved page captures, registration and network records, scanner results and PhishDestroy reporting history. Each source keeps its own observation date. Open a source report to inspect the original result.
The AI-assisted analysis was written on . It describes the evidence available at that time; later source checks can change.
A capture documents what was shown. A scanner result records that provider’s assessment at the time of its check. Neither a valid certificate nor a zero-detection result is a guarantee of safety.
(US)
