# patrickstash.cash — SUSPICIOUS

> patrickstash.cash is a cash stash-themed phishing domain flagged by 2/95 VirusTotal vendors. Created Dec 22, 2025, it lures users into fake financial schemes.

## Summary
This domain, patrickstash.cash, is actively involved in phishing campaigns that impersonate legitimate financial services or cash stash-related offers to trick users into revealing sensitive information like passwords or payment details. The site is designed to appear as a trustworthy service, likely mimicking banking or investment platforms to exploit user trust and harvest credentials or financial data. Security researchers have identified this as a classic cash stash-themed phishing operation, where attackers leverage urgency and enticing offers to prompt immediate user action without scrutiny.  PhishDestroy identifies that patrickstash.cash was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on December 22, 2025, just days ago, which is a common tactic to quickly deploy phishing sites before they can be widely blocked. VirusTotal confirms that 2 out of 95 security vendors have flagged this domain, a relatively low but still concerning detection rate that highlights the need for additional scrutiny. The domain resolves to IP address 176.123.0.199 and uses a Let’s Encrypt SSL certificate, which may give it a false sense of legitimacy to unsuspecting visitors.  If you have visited patrickstash.cash, immediately cease any interaction with the site and avoid entering any personal or financial information. Check your device for any unusual activity, such as unauthorized logins or unexpected transactions, and consider changing passwords for critical accounts. Run a scan with your antivirus software to ensure no malware was downloaded. Report the domain to your security team or use tools like PhishDestroy to block it from future access. Always verify the legitimacy of financial websites by cross-checking URLs, looking for HTTPS (with a valid certificate), and consulting trusted sources before engaging.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: unknown (HTTP ?)

## Domain Intelligence
- Registered: 2025-12-22 19:21:51
- Registrar: NICENIC INTERNATIONAL GROUP CO., LIMITED
- IP: 176.123.0.199

## Detection Status
- VirusTotal: 2 vendors flagged
- Google Safe Browsing: clean
- Blocklists: 1 hits
  Lists: ["PhishDestroy"]

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/scan/b5be6cdf-df00-4aef-9655-a0ba06f84c37
- PhishDestroy: https://phishdestroy.io/domain/patrickstash.cash/
- LLM endpoint: https://phishdestroy.io/domain/patrickstash.cash/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/patrickstash.cash/
Last updated: 2026-03-26