rustorebot.shop
Appeared in the .shop zone on Monday, November 2, 2026; by the end of that day the census found active website. Full domain report
Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.
Own one of these names and think the listing is wrong? Tell us and a person will look.
What matched
Model opinions
The page uses a throwaway 'POCKETPLAY' brand on a RuStore-borrowing domain name. It offers free 'help installing' PC titles like GTA V on your phone and funnels visitors to a Telegram 'agent', with an unprompted reference to Apple ID passwords, which fits the fake-mobile-game / shared-Apple-ID lockout and extortion scheme.
The page impersonates a legitimate game-installation service but explicitly references Apple ID credentials in its pitch ('Без передачи пароля Apple ID' — without sharing Apple ID password), and directs users to Telegram operators for 'compatibility checks' and 'setup help.' This is a classic credential-harvesting scheme: the sealed-room shape of Telegram-only contact, the reassurance about not needing Apple ID passwords (which signals the operators will ask for them), and the game-installation
A model looked at the screenshot and page text and wrote what it thought. It can be wrong, and it is not a finding.
What the page looked like on Monday, November 2, 2026
Same data as JSON: /api/zone/domain/rustorebot.shop. This page is not indexed by search engines and does not link to the site it describes.