# PhishDestroy threat dossier — mr-bel-informations.bolt.host ================================================================ Fetched: 2026-07-07 03:00:03 UTC Canonical: https://phishdestroy.io/domain/mr-bel-informations.bolt.host/ ## VERDICT ---------------------------------------------------------------- HIGH THREAT — malicious activity confirmed Composite threat score: 73/100 (PhishDestroy scoring — see methodology below) ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 16/91 security vendors flagged this domain Flagging vendors: alphaMountain.ai, BitDefender, Cluster25, CRDF, CyRadar, ESET, Emsisoft, Fortinet, G-Data, Gridinsoft, Kaspersky, Lionic, Netcraft, PREBYTES, Sophos, Webroot Public blocklists: listed on 2 independent blocklists ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 104.26.13.118 (CA, Toronto) ASN: AS13335 Cloudflare, Inc. Hosting org: Cloudflare, Inc. Registrar: Cloudflare, Inc. Nameservers: alex.ns.cloudflare.com, galilea.ns.cloudflare.com Registered: 2024-11-14 Expires: 2027-11-14 Page title: Mondial Relay - Notification de livraison HTTP response: 200 ## TLS CERTIFICATE ---------------------------------------------------------------- Issuer: Google Trust Services / WE1 Expires: 2026-08-31 Status: INVALID chain Fingerprint: ec42243633b88eecf1fefea1ddd4bdacf9ecc03acc43d0bf03573d43e478f953 Subject Alternative Names (related infrastructure — often same operator): - bolt.host ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: pending notification queue. No abuse reports filed yet — this domain is waiting for the next cycle of our automated abuse-reporter. ## TIMELINE ---------------------------------------------------------------- Domain registered: 2024-11-14 (per WHOIS / CT — may reflect a renewal or transfer date, not first-ever registration) First detected: 2026-07-07 02:18:20 UTC (by PhishDestroy tracker) Last verified: 2026-07-07 04:25:13 UTC Current status: ACTIVE / observable ## EXTERNAL CORROBORATION (third-party evidence) ---------------------------------------------------------------- URLScan.io: https://urlscan.io/result/019f39ef-460c-70d8-bcb6-ec7a59de2d8d/ Wayback Machine: https://web.archive.org/web/*/mr-bel-informations.bolt.host crt.sh CT logs: https://crt.sh/?q=%25.mr-bel-informations.bolt.host Google transparency: https://transparencyreport.google.com/safe-browsing/search?url=mr-bel-informations.bolt.host AlienVault OTX: https://otx.alienvault.com/indicator/domain/mr-bel-informations.bolt.host URLhaus: https://urlhaus.abuse.ch/host/mr-bel-informations.bolt.host/ ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-07-07 02:35:47 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] The domain mr-bel-informations.bolt.host has been identified as an active source of credential theft through brand impersonation, specifically targeting users of the Mondial Relay delivery service. The site presents a deceptive notification page titled 'Mondial Relay - Notification de livraison' and is designed to harvest sensitive user credentials under the guise of legitimate package notifications. This activity constitutes a significant threat by exploiting brand trust to facilitate unauthorized data collection. Technical analysis reveals multiple risk indicators. The domain is currently active and resolves to IP address 104.26.13.118. It is protected by Cloudflare, Inc. as registrar and utilizes a Google Trust Services SSL certificate, as well as technologies such as Netlify, jsDelivr, HSTS, and Cloudflare CDN. The domain’s registration date is November 14, 2024, indicating recent establishment for this campaign. VirusTotal scan results show that 16 out of 95 security vendors have flagged the domain for malicious activity, confirming widespread detection across the infosec community. Users who have visited mr-bel-informations.bolt.host are at high risk for exposure of personal credentials and should immediately change any potentially compromised passwords. It is recommended to monitor for unauthorized account activity and implement multi-factor authentication wherever possible. Affected individuals should also consult with security teams to assess further risk to their systems and take additional mitigation steps as necessary. The domain should be avoided and reported to relevant stakeholders for prompt remediation. ## EVIDENCE HASHES ---------------------------------------------------------------- Favicon MD5: b8a0bf372c762e966cc99ede8682bc71 TLS cert SHA-256: ec42243633b88eecf1fefea1ddd4bdacf9ecc03acc43d0bf03573d43e478f953 ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (operator takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/mr-bel-informations.bolt.host/ JSON API: https://api.destroy.tools/v1/check?domain=mr-bel-informations.bolt.host Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: independent open-source threat-intelligence platform. Tracked: 175,644 domains (12,655 alive under monitoring, 162,048 confirmed takedowns/dead). Site: https://phishdestroy.io