# PhishDestroy domain threat record: fable-wheels.com

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/fable-wheels.com/
Machine-readable companion: https://phishdestroy.io/domain/fable-wheels.com/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-26 00:48:43 UTC
- Last availability or vendor check: 2026-10-26 00:48:43 UTC
- Stored record updated: 2026-10-26 02:30:29 UTC
- VirusTotal detections in the stored snapshot: 17/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored infrastructure

- Observed IP address: 188.114.97.3
- Registrar in stored WHOIS data: Dynadot Inc
- Last stored HTTP status: 200
- Registration date in stored WHOIS data: 2026-01-11 07:21:45 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a175ae-0df0-7508-8850-baf873da7eb5/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/fable-wheels.com
- Certificate Transparency search: https://crt.sh/?q=%25.fable-wheels.com
- Web Archive lookup: https://web.archive.org/web/*/https://fable-wheels.com/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
PhishDestroy listed fable-wheels.com on its internal blocklist after an intake on 2026-10-26. The intake reason cited fourteen malicious detections from VirusTotal. A page fetch on the same day returned an HTTP 403 status, while later checks showed an HTTP 200 response from Cloudflare Radar and the webcheck tool. The domain was first seen by PhishDestroy on 2026-10-26.

How the scam works
The available detections indicate that the site may be used for phishing or malware distribution, but no specific malicious payload or credential‑harvesting form was observed on the captured page. Without concrete evidence of a particular scheme, the risk is described in general terms as a potential phishing or malware host.

Evidence
VirusTotal reported fourteen malicious and three suspicious classifications from ninety‑two engines, totaling seventeen detections on 2026-10-18 (retrieved 2026-10-26). Google Safe Browsing checked the domain on 2026-10-26 and did not flag it. URLScan’s engine verdict marked the site as malicious with a score of 49 on 2026-10-26, though its overall verdict was non‑malicious. Cloudflare Radar on 2026-10-26 labeled the domain malicious, assigning it to the malware category and noting phishing tags. OTX listed four pulses referencing the domain on the same date, and PhishDestroy’s internal blocklist contains the domain while external blocklists reported none.

Infrastructure
The domain was registered on 2026-01-11 through Dynadot Inc, with a client‑transfer‑prohibited status. DNS resolution points to Cloudflare nameservers (curt.ns.cloudflare.com and michelle.ns.cloudflare.com) and IP addresses in the 188.114.96.0/24 range and IPv6 2a06:98c1:3120::/64. A TLS certificate issued by Google Trust Services is valid from 2026-09-04 to 2026-12-03, and the site is protected by Cloudflare’s web application firewall.

What to do
Visitors should avoid entering any credentials, downloading files, or approving wallet actions on this site and should change passwords if any were submitted. Organizations should add fable-wheels.com to their DNS and web filtering blocklists and monitor network logs for connections to the listed IP addresses. Security teams can use the recorded DNS and certificate details to create precise detection rules without assuming broader infrastructure ownership.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a175ae-0df0-7508-8850-baf873da7eb5/
Cloudflare Radar report: https://radar.cloudflare.com/scan/d42fee70-3a9d-4bfc-8c90-fa055468044d
URLQuery report: https://urlquery.net/report/6cb36ac3-b093-43dd-a8b1-88c8a84336a9
Stored capture screenshot: https://i.ibb.co/4wTMH9DN/cdd9fb5ed457.png
Cloudflare Radar screenshot (2026-10-26T01:22:53Z): https://screenshots.phishdestroy.io/cf/d42fee70-3a9d-4bfc-8c90-fa055468044d.png
URLQuery screenshot: https://screenshots.phishdestroy.io/uq/6cb36ac3-b093-43dd-a8b1-88c8a84336a9.png
URLScan screenshot (2026-10-26T00:40:02Z): https://screenshots.phishdestroy.io/us/01a175a6-55f2-701d-8e17-cdcafee20031.png
URLScan capture report: https://urlscan.io/result/01a175a6-55f2-701d-8e17-cdcafee20031/
URLScan screenshot (2026-10-26T00:43:15Z): https://screenshots.phishdestroy.io/us/01a175a9-4671-729e-8056-1f47e7a4aa3a.png
URLScan capture report: https://urlscan.io/result/01a175a9-4671-729e-8056-1f47e7a4aa3a/
VirusTotal report: https://www.virustotal.com/gui/domain/fable-wheels.com
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=fable-wheels.com
Archived copy: https://web.archive.org/web/20261026004926/https://fable-wheels.com/
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-26 02:28:15 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/4wTMH9DN/cdd9fb5ed457.png
  Captured: 2026-10-26 00:48:43 UTC
- URLScan capture: https://urlscan.io/screenshots/01a175ae-0df0-7508-8850-baf873da7eb5.png
  Captured: 2026-10-26 00:48:43 UTC
  Source report: https://urlscan.io/result/01a175ae-0df0-7508-8850-baf873da7eb5/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/d42fee70-3a9d-4bfc-8c90-fa055468044d.png
  Captured: 2026-10-26 01:22:53 UTC
  Source report: https://radar.cloudflare.com/scan/d42fee70-3a9d-4bfc-8c90-fa055468044d
  SHA-256: c92527a69aa3fcebe780fb0d114e03d6a626390234da8bc5086dbbd206c8b559
- URLQuery: https://screenshots.phishdestroy.io/uq/6cb36ac3-b093-43dd-a8b1-88c8a84336a9.png
  Source report: https://urlquery.net/report/6cb36ac3-b093-43dd-a8b1-88c8a84336a9
  SHA-256: 9ddfafa1690dd6dfdcae47a7d2908eb9a92077806ad3d542c22b762c4f1ce31f
- URLScan · 2026-10-26: https://screenshots.phishdestroy.io/us/01a175a6-55f2-701d-8e17-cdcafee20031.png
  Captured: 2026-10-26 00:40:02 UTC
  Source report: https://urlscan.io/result/01a175a6-55f2-701d-8e17-cdcafee20031/
  SHA-256: 1fb920c1ed848e7b54a56aea50925ea81c91cc7b4e29dbda8edf5c44586530d4
- URLScan · 2026-10-26: https://screenshots.phishdestroy.io/us/01a175a9-4671-729e-8056-1f47e7a4aa3a.png
  Captured: 2026-10-26 00:43:15 UTC
  Source report: https://urlscan.io/result/01a175a9-4671-729e-8056-1f47e7a4aa3a/
  SHA-256: 1fb920c1ed848e7b54a56aea50925ea81c91cc7b4e29dbda8edf5c44586530d4

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-26T01:00:02Z",
        "uuid": "01a175ae-0df0-7508-8850-baf873da7eb5",
        "scanned_at": "2026-10-26T00:48:33Z",
        "final_url": "http://fable-wheels.com/",
        "redirects": [
            {
                "to": "https://fable-wheels.com/",
                "from": "http://fable-wheels.com/",
                "status": 307
            },
            {
                "to": "http://fable-wheels.com/",
                "from": "https://fable-wheels.com/",
                "status": 307
            },
            {
                "to": "https://fable-wheels.com/",
                "from": "http://fable-wheels.com/",
                "status": 307
            }
        ],
        "globals": [
            "assert",
            "getRequiredElement",
            "P",
            "S",
            "getRandomNum",
            "getTimeStamp",
            "Dimensions",
            "Config$2",
            "getGlobalConfig",
            "setGlobalConfig",
            "Config$1",
            "Config",
            "setMaxGapCoefficient",
            "setMaxObstacleLength",
            "Status",
            "A11yStrings",
            "RunnerClasses",
            "RunnerSounds",
            "RunnerEvents",
            "updateCanvasScaling",
            "getA11yString",
            "vibrate",
            "createCanvas",
            "decodeBase64ToArrayBuffer",
            "createAdjustedCollisionBox",
            "drawCollisionBoxes",
            "boxCompare",
            "toggleHelpBox",
            "diagnoseErrors",
            "portalSignin",
            "updateForDnsProbe",
            "getMainFrameErrorCssClass",
            "getMainFrameErrorIconCssClass",
            "getSubFrameErrorIconCssClass",
            "shouldShowSuggestionsSummaryList",
            "getSuggestionsSummaryItemCssClass",
            "reloadButtonClick",
            "downloadButtonClick",
            "detailsButtonClick",
            "setAutoFetchState"
        ],
        "domain_age_days": 287,
        "apex_age_days": 287,
        "requests": 8,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 49,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-26T01:25:17Z",
        "uuid": "d42fee70-3a9d-4bfc-8c90-fa055468044d",
        "scanned_at": "2026-10-26T01:22:53Z",
        "final_url": "https://fable-wheels.com/",
        "status": 200,
        "history": [
            {
                "url": "https://fable-wheels.com/",
                "status": 200
            }
        ],
        "dom_hash": "6f581d7a067e4f4d9088edf3075d62ff1b2167feb916c0b5981aeb51a3f34d74",
        "doc_hash": "96073b1deb6e2810f68b8206f46b42802c56ec2e8f1006c52f8e3363809b495b",
        "phishing_v2": [
            "phishing"
        ],
        "domain_risks": [
            "Malware",
            "Security threats",
            "CIPA Filter",
            "CIPA"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "fable-wheels.com",
                "type": "A",
                "value": "188.114.96.0"
            },
            {
                "name": "fable-wheels.com",
                "type": "A",
                "value": "188.114.97.0"
            },
            {
                "name": "fable-wheels.com",
                "type": "AAAA",
                "value": "2a06:98c1:3121::"
            },
            {
                "name": "fable-wheels.com",
                "type": "AAAA",
                "value": "2a06:98c1:3120::"
            }
        ],
        "dnssec_valid": false,
        "ip": "188.114.96.0",
        "verdict": {
            "tags": [
                "malware"
            ],
            "malicious": true,
            "categories": [
                "malware"
            ]
        },
        "whois": {
            "registrar": "Dynadot Inc",
            "created": "2026-01-11T08:21:45Z",
            "updated": "2026-01-11T08:21:56Z",
            "expires": "2027-01-11T08:21:45Z",
            "nameservers": [
                "curt.ns.cloudflare.com",
                "michelle.ns.cloudflare.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-26T02:26:21Z",
        "analysis_at": "2026-10-18T11:51:15Z",
        "stats": {
            "timeout": 0,
            "harmless": 44,
            "malicious": 14,
            "suspicious": 3,
            "undetected": 31
        },
        "detections": {
            "DNS8": "suspicious",
            "ESET": "suspicious",
            "VIPRE": "malware",
            "G-Data": "phishing",
            "Lionic": "phishing",
            "Sophos": "phishing",
            "Webroot": "malicious",
            "Fortinet": "phishing",
            "SOCRadar": "phishing",
            "Kaspersky": "phishing",
            "Seclookup": "malicious",
            "Gridinsoft": "suspicious",
            "BitDefender": "phishing",
            "Chong Lua Dao": "malicious",
            "alphaMountain.ai": "phishing",
            "Yandex Safebrowsing": "phishing",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "created": "2026-01-11T00:00:00Z",
        "updated": "2026-01-11T00:00:00Z",
        "first_seen": "2026-01-11T08:43:36Z",
        "dns": [
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3031::ac43:8724"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "104.21.26.16"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "curt.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3030::6815:1a10"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "michelle.ns.cloudflare.com"
            },
            {
                "ttl": 1800,
                "type": "SOA",
                "rname": "dns.cloudflare.com",
                "value": "curt.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "172.67.135.36"
            }
        ],
        "dns_at": "2026-10-18T11:56:29Z",
        "jarm": "27d40d40d00040d1dc27d40d27d40d5fb4c89fe3813d172ffb53f84a68f750",
        "cert": {
            "san": [
                "fable-wheels.com",
                "*.fable-wheels.com"
            ],
            "issuer": "Google Trust Services / WE1",
            "serial": "32726355a451972d0ee9e64dec8c6989",
            "sha256": "c8d99ed0830dcd773ab676e7128f19afd9b74ff460eb98b7e51e4853213bae8b",
            "subject": "fable-wheels.com",
            "valid_to": "2026-12-03T12:29:40Z",
            "valid_from": "2026-09-04T11:32:07Z"
        },
        "whois": [],
        "rdap": {
            "status": [
                "transfer prohibited"
            ],
            "events": {
                "expiration": "2027-01-11T08:21:45Z",
                "last changed": "2026-01-11T08:21:56Z",
                "registration": "2026-01-11T08:21:45Z",
                "registrar expiration": "2027-01-11T08:21:45Z",
                "last update of RDAP database": "2026-10-16T06:41:53Z"
            },
            "registrar": "DYNADOT LLC",
            "registrar_iana_id": "472"
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-26T01:22:07Z",
        "mail_config": {
            "spf_lookups": 0
        },
        "caa_records": {
            "domain": "fable-wheels.com"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_by": [
                "CloudFlare Family"
            ],
            "blocked_count": 1
        },
        "archives": {
            "last": "2026-10-26T00:49:26Z",
            "first": "2026-10-26T00:49:26Z",
            "changes": 0,
            "days_archived": 1,
            "avg_page_bytes": 3085
        },
        "robots_txt": {
            "agents": [
                "*"
            ],
            "present": true
        },
        "social_tags": {
            "themeColor": "#ffffff"
        },
        "trackers": {
            "requests": 11
        },
        "mixed_content": {
            "third_party_scripts": 0
        },
        "status": {
            "up": true,
            "code": 200,
            "timings": {
                "dns": 13,
                "tls": 45,
                "wait": 125,
                "connect": 9,
                "download": 0
            },
            "response_ms": 192
        },
        "tls_connection": {
            "alpn": "h2",
            "cipher": "ECDHE-ECDSA-AES128-GCM-SHA256",
            "protocol": "TLSv1.2",
            "versions": [
                "TLSv1",
                "TLSv1.1",
                "TLSv1.2"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                80,
                443,
                8080
            ]
        },
        "carbon": {
            "bytes": 4138,
            "co2_grams": 0.0002,
            "cleaner_than": 91
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "172.64.33.94",
                    "host": "curt.ns.cloudflare.com"
                },
                {
                    "ip": "108.162.192.201",
                    "host": "michelle.ns.cloudflare.com"
                }
            ],
            "zone": "fable-wheels.com"
        },
        "cookies": {
            "cookies": [
                {
                    "name": "surfer_uuid"
                }
            ]
        },
        "location": {
            "ip": "2a06:98c1:3121::3",
            "asn": "13335",
            "org": "CloudFLARENET-EU",
            "city": "London",
            "country": "GB"
        },
        "ssl": {
            "issuer": "Google Trust Services / WE1",
            "subject": "fable-wheels.com"
        },
        "dns": {
            "A": [
                "188.114.97.3",
                "188.114.96.3"
            ],
            "NS": [
                "michelle.ns.cloudflare.com",
                "curt.ns.cloudflare.com"
            ],
            "SOA": "{\"nsname\": \"curt.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2415723166, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}",
            "AAAA": [
                "2a06:98c1:3120::3",
                "2a06:98c1:3121::3"
            ]
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "hsts": {
            "message": "Site does not serve any HSTS headers."
        },
        "http_security": {
            "xFrameOptions": false,
            "referrerPolicy": false,
            "xXSSProtection": false,
            "permissionsPolicy": false,
            "xContentTypeOptions": false,
            "contentSecurityPolicy": false,
            "strictTransportPolicy": false,
            "crossOriginOpenerPolicy": false,
            "crossOriginEmbedderPolicy": false,
            "crossOriginResourcePolicy": false
        },
        "firewall": {
            "waf": "Cloudflare",
            "has_waf": true
        },
        "get_ip": {
            "ip": "2a06:98c1:3120::3",
            "family": 6
        },
        "redirects": {
            "chain": [
                "https://fable-wheels.com"
            ]
        },
        "whois": {
            "registrar": "Dynadot Inc",
            "created": "2026-01-11T08:21:45Z",
            "updated": "2026-01-11T08:21:56Z",
            "expires": "2027-01-11T08:21:45Z",
            "status": [
                "clientTransferProhibited https://icann.org/epp"
            ],
            "nameservers": [
                "curt.ns.cloudflare.com",
                "michelle.ns.cloudflare.com"
            ]
        },
        "headers": {
            "headers": {
                "server": "cloudflare",
                "content-type": "text/html; charset=utf-8"
            }
        }
    }
}
```