# PhishDestroy domain threat record: passionbox.top

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/passionbox.top/
Machine-readable companion: https://phishdestroy.io/domain/passionbox.top/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-23 14:48:35 UTC
- Last availability or vendor check: 2026-10-26 11:01:26 UTC
- Stored record updated: 2026-10-26 21:41:54 UTC
- VirusTotal detections in the stored snapshot: 2/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored infrastructure

- Observed IP address: 188.114.97.1
- Registrar in stored WHOIS data: NameSilo,LLC
- Registrar country in stored WHOIS data: US
- Last stored HTTP status: 301
- Registration date (registry RDAP, passionbox.top): 2026-10-19 12:28:36 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a162b9-b282-7520-bc36-231b081a9c15/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/passionbox.top
- Certificate Transparency search: https://crt.sh/?q=%25.passionbox.top
- Web Archive lookup: https://web.archive.org/web/*/https://passionbox.top/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
PhishDestroy’s intake AI recorded the page as having insufficient content for analysis, resulting in an “unknown” verdict. The domain was first seen by PhishDestroy on 2026-10-23. An HTTP 301 redirect was observed for the domain on 2026-10-24.

How the scam works
Because no malicious page elements were captured, the listing does not identify a concrete scam technique. Suspicious domains may be used for phishing, credential harvesting, or fraud, but this case lacks evidence of any such activity.

Evidence
VirusTotal scanned the domain on 2026-10-24, flagging it as malicious in 2 of 92 engines (CRDF = malicious, Gridinsoft = phishing). Google Safe Browsing checked on 2026-10-24 and did not flag the site. urlscan captured the page on 2026-10-22; its overall verdict was clean, though its machine‑learning engine marked it malicious with a score of 23. OTX listed three pulses referencing the domain as of 2026-10-24. No external blocklists reported the domain, while PhishDestroy’s internal blocklist marked it as blocked on 2026-10-24.

Infrastructure
The domain was registered with NameSilo on 2026-10-19. DNS records resolve to Cloudflare IPs 188.114.96.3 and 188.114.97.3 (ASN 13335). The site presented a Let’s Encrypt certificate issued on 2026-10-19, valid until 2027-01-17, covering *.passionbox.top and passionbox.top. Cloudflare provides the web firewall and CDN for the domain.

What to do
Visitors should not submit credentials, personal data, or cryptocurrency information to the site; if any were entered, change the associated passwords immediately. Security teams can block passionbox.top at the DNS or proxy level and monitor traffic to the recorded IP addresses, noting the VirusTotal and urlscan detections as indicators of risk. Re‑evaluate the domain periodically as new information becomes available.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a162b9-b282-7520-bc36-231b081a9c15/
Cloudflare Radar report: https://radar.cloudflare.com/scan/9d73d057-43e5-4cb5-8ad0-07bf41590b70
Stored capture screenshot: https://urlscan.io/screenshots/01a162b9-b282-7520-bc36-231b081a9c15.png
URLScan screenshot (2026-10-23T21:02:15Z): https://screenshots.phishdestroy.io/us/01a16a90-ed45-7658-b566-0933b20da125.png
URLScan capture report: https://urlscan.io/result/01a16a90-ed45-7658-b566-0933b20da125/
VirusTotal report: https://www.virustotal.com/gui/domain/passionbox.top
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=passionbox.top
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-24 03:39:43 UTC

## Stored page captures

- Primary capture: https://urlscan.io/screenshots/01a162b9-b282-7520-bc36-231b081a9c15.png
  Captured: 2026-10-23 14:48:35 UTC
- URLScan · 2026-10-23: https://screenshots.phishdestroy.io/us/01a16a90-ed45-7658-b566-0933b20da125.png
  Captured: 2026-10-23 21:02:15 UTC
  Source report: https://urlscan.io/result/01a16a90-ed45-7658-b566-0933b20da125/
  SHA-256: 8d010df523eb13141682425da2e0c386f527d4050e394315d0283fec0a4ae36e

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-23T14:51:21Z",
        "uuid": "01a162b9-b282-7520-bc36-231b081a9c15",
        "scanned_at": "2026-10-22T08:29:49Z",
        "final_url": "https://passionbox.top/",
        "status": 666,
        "ip": "188.114.96.3",
        "domains": [
            "www.google.com"
        ],
        "ips": [
            "142.251.156.119",
            "188.114.96.3"
        ],
        "asns": [
            "15169",
            "13335"
        ],
        "countries": [
            "US"
        ],
        "doc_hash": "c396babd7f49262f18a3a2ec34542c8e314cb4d869875152bb9675a6bb6066ea",
        "script_hashes": [
            "0bf32f6f5e0db7af1e5c2bf8701b0dda03b6b9fc7f09c66755a85200506b3a0b"
        ],
        "tls": {
            "san": [
                "*.passionbox.top",
                "passionbox.top"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "YE2",
            "subject": "passionbox.top",
            "protocol": "TLS 1.3",
            "valid_to": "2027-01-17T11:44:24Z",
            "valid_from": "2026-10-19T11:44:25Z"
        },
        "domain_age_days": 611,
        "apex_age_days": 611,
        "tls_age_days": 2,
        "tls_valid_days": 89,
        "requests": 4,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 23,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "cloudflare",
            "content-type": "text/html; charset=utf-8"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-23T15:23:14Z",
        "uuid": "9d73d057-43e5-4cb5-8ad0-07bf41590b70",
        "scanned_at": "2026-10-23T14:50:38Z"
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-24T03:36:42Z",
        "analysis_at": "2026-10-23T06:55:50Z",
        "stats": {
            "timeout": 0,
            "harmless": 52,
            "malicious": 2,
            "suspicious": 0,
            "undetected": 38
        },
        "detections": {
            "CRDF": "malicious",
            "Gridinsoft": "phishing"
        },
        "reputation": 0,
        "registrar": "NameSilo,LLC",
        "created": "2026-10-19T12:28:36Z",
        "expires": "2027-10-19T12:28:36Z",
        "updated": "2026-10-19T12:35:59Z",
        "first_seen": "2025-02-20T16:04:18Z",
        "dns": [
            {
                "ttl": 21600,
                "type": "NS",
                "value": "pete.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "172.67.219.174"
            },
            {
                "ttl": 300,
                "type": "TXT",
                "value": "google-site-verification=Oub_SO7hugDi7Vp5IsiA0E2T8rC1cjIHqnHoZyCPvS0"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "heather.ns.cloudflare.com"
            },
            {
                "ttl": 1800,
                "type": "SOA",
                "rname": "dns.cloudflare.com",
                "value": "heather.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "104.21.45.227"
            }
        ],
        "dns_at": "2026-10-23T07:13:46Z",
        "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c",
        "cert": {
            "san": [
                "*.passionbox.top",
                "passionbox.top"
            ],
            "issuer": "Let's Encrypt / YE2",
            "serial": "6bc6376a3ef4ae637ec1a1cef6d4e4c82a8",
            "sha256": "1a18987238df9eb6c631c42400be0f9b3fdbf399315d915ec5fe273ecb3be4c2",
            "subject": "passionbox.top",
            "valid_to": "2027-01-17T11:44:24Z",
            "valid_from": "2026-10-19T11:44:25Z"
        },
        "whois": {
            "registrar": "NameSilo,LLC",
            "registrar_iana_id": "1479",
            "registrar_url": "https://www.namesilo.com",
            "created": "2026-10-19T12:28:36Z",
            "updated": "2026-10-19T12:35:59Z",
            "expires": "2027-10-19T12:28:36Z",
            "status": [
                "addPeriod",
                "clientTransferProhibited"
            ],
            "nameservers": [
                "heather.ns.cloudflare.com",
                "pete.ns.cloudflare.com"
            ],
            "dnssec": "unsigned"
        },
        "rdap": {
            "status": [
                "client transfer prohibited"
            ],
            "events": {
                "last changed": "2026-10-19T09:03:41Z",
                "registration": "2026-10-19T00:00:00Z",
                "registrar expiration": "2027-10-19T00:00:00Z",
                "last update of RDAP database": "2026-10-20T17:19:47Z"
            }
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-23T14:51:53Z",
        "mail_config": {
            "spf_lookups": 0
        },
        "caa_records": {
            "domain": "passionbox.top"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_count": 0
        },
        "tls_connection": {
            "alpn": "h2",
            "cipher": "TLS_AES_256_GCM_SHA384",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1",
                "TLSv1.1",
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                80,
                443,
                8080
            ]
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "173.245.58.161",
                    "host": "heather.ns.cloudflare.com"
                },
                {
                    "ip": "172.64.33.136",
                    "host": "pete.ns.cloudflare.com"
                }
            ],
            "zone": "passionbox.top"
        },
        "location": {
            "ip": "188.114.96.3",
            "asn": "13335",
            "org": "Cloudflare, Inc.",
            "city": "Toronto",
            "country": "CA"
        },
        "ssl": {
            "issuer": "Let's Encrypt / YE2",
            "subject": "passionbox.top"
        },
        "dns": {
            "A": [
                "188.114.97.3",
                "188.114.96.3"
            ],
            "NS": [
                "heather.ns.cloudflare.com",
                "pete.ns.cloudflare.com"
            ],
            "SOA": "{\"nsname\": \"heather.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2417924909, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}",
            "TXT": [
                "google-site-verification=Oub_SO7hugDi7Vp5IsiA0E2T8rC1cjIHqnHoZyCPvS0"
            ]
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "hsts": {
            "message": "Site does not serve any HSTS headers."
        },
        "http_security": {
            "xFrameOptions": false,
            "referrerPolicy": false,
            "xXSSProtection": false,
            "permissionsPolicy": false,
            "xContentTypeOptions": false,
            "contentSecurityPolicy": false,
            "strictTransportPolicy": false,
            "crossOriginOpenerPolicy": false,
            "crossOriginEmbedderPolicy": false,
            "crossOriginResourcePolicy": false
        },
        "firewall": {
            "waf": "Cloudflare",
            "has_waf": true
        },
        "get_ip": {
            "ip": "188.114.96.3",
            "family": 4
        },
        "tech_stack": {
            "technologies": [
                "Cloudflare"
            ]
        },
        "whois": {
            "registrar": "NameSilo,LLC",
            "created": "2026-10-19T12:28:36Z",
            "updated": "2026-10-19T12:35:59Z",
            "expires": "2027-10-19T12:28:36Z",
            "status": [
                "clientTransferProhibited https://icann.org/epp",
                "addPeriod https://icann.org/epp"
            ],
            "nameservers": [
                "heather.ns.cloudflare.com",
                "pete.ns.cloudflare.com"
            ]
        }
    }
}
```