billsart.shop is an E-Commerce Scam: a fake storefront that poses as a legitimate retailer to collect money from online shoppers. Its page title is simply the domain name, with no brand behind it, which fits the generic, disposable shop names these operations rotate through. PhishDestroy first flagged it on 2026-10-16. On 2026-10-19 it was still alive, with visitors being redirected rather than served a static page.
How the scam works
Fake shops lure buyers with unusually low prices, often pushed through social media ads or search results, then run them through a checkout that looks normal. The victim pays by card or another method and receives nothing, a cheap substitute, or a fake tracking number that leads nowhere. Card numbers, billing addresses and contact details entered at checkout can also be reused for fraud or sold. The redirect seen on 2026-10-19 means the address may now forward visitors elsewhere, so what you see when you visit can differ from what earlier victims saw.
Evidence
On 2026-10-16, 12 of 92 VirusTotal engines flagged the domain, including alphaMountain.ai, BitDefender, CRDF, CyRadar, ESET, Fortinet, G-Data and Gridinsoft. That is a meaningful spread of independent vendors for a site this new. urlscan.io returned a malicious verdict and specifically identified the page as a fake shop. The domain also appears in one AlienVault OTX threat pulse, and it is listed on the PhishDestroy blocklist.
Infrastructure
The domain was registered through Dynadot Inc. on 2026-07-26, about 82 days before PhishDestroy detected it. That gap suggests it was set up in advance and possibly used quietly before being caught. It is hosted on the Malakmadze Web LLC network, which is registered in Georgia, while the server itself geolocates to the US.
What to do
If you bought something on billsart.shop, contact your bank or card issuer now to dispute the charge and ask for a new card number. Chargebacks for undelivered goods are time-limited, so act quickly. Keep order confirmations, emails and screenshots as evidence. Watch for follow-up phishing that uses the name and address you entered, and change any password you reused when creating an account there. Defenders should block billsart.shop at DNS and proxy level and check logs for users who reached its checkout pages.
For this gTLD, the registrar above operates under an ICANN accreditation agreement. The links below provide the official fee schedule and current DNS abuse compliance guidance.
Accreditation is a contract, not a safety certification.
RAA §3.18 establishes abuse-contact and handling requirements. This report can document stored outbound notices and later technical observations; it does not by itself establish receipt, investigation, remediation, or contractual non-compliance.
Saved certificate metadata. Certificate dates without a timezone are shown as stored. Transport encryption does not establish that the site is trustworthy.
Latest HTTP observationRedirectingHTTP redirect observed80%2026-10-20 10:00:30 UTC
RDAP registration不明
Observed timelinelast reachable: 2026-10-20 10:00:30 UTC
Availability, content, DNS and registration are independent evidence layers. NXDOMAIN, an unreachable origin or missing content alone does not prove registrar action. A registrar or provider is credited only when a direct technical marker identifies that actor. Report causality is shown separately.
Keep original emails, receipts, messages and screenshots in a secure place. A factual timeline helps the receiving authority understand what happened. IC3 evidence guidance ↗
Payment records — if you paid, save the receipt, amount, date, payment provider and recipient details.
Your bank or payment provider — contact its fraud team promptly through official contact details if money or card information was exposed.
地元の警察 — たとえ直ちに行動を起こせなくても、公式な記録が残される
A report is not a guarantee of recovery or investigation, but prompt, accurate transaction data can help authorities and service providers trace the incident.
詐欺による金銭の返還を装った詐欺 — fraudsters pose as recovery agents and demand upfront fees. Never share a seed phrase or pay before independently verifying the provider
About this reportSources, observation dates and corrections
This report combines saved page captures, registration and network records, scanner results and PhishDestroy reporting history. Each source keeps its own observation date. Open a source report to inspect the original result.
The AI-assisted analysis was written on . It describes the evidence available at that time; later source checks can change.
A capture documents what was shown. A scanner result records that provider’s assessment at the time of its check. Neither a valid certificate nor a zero-detection result is a guarantee of safety.
(US)
