VirusTotal
2 det.
stashpatrick[.]org
Domain Security & Threat Intelligence Report
“Patrick Market”
0
Risk Score
Data coverage
VirusTotal
2 / 95
URLQuery
no det.
OTX
no pulses
CF Radar
clean
URLScan
report ready
DNS blocks
none
SSL
valid, 86d
WHOIS
73d old
Screenshot
captured
Redirect chain
not probed
CDN bypass
n/a
URLQuery
no det.
URLScan
Report ↗
SSL
Let's Encrypt
Age
73d
Status
Dead
DestroyList
Listed
Reports Sent
1
02
Forensic brief
Analyst brief · auto-generated
PhishDestroy identifies stashpatrick.org as an active phishing domain, classified under generic phishing threats. The domain mimics a legitimate service under the page title 'Patrick Market' to deceive users into submitting sensitive information. It was registered recently, indicating a newly established phishing campaign designed to exploit unsuspecting visitors. Technical analysis reveals that stashpatrick.org was created on August 27, 2023, and is registered through Regional Network Information Center, JSC dba RU-CENTER. The domain resolves to the IP address 87.249.38.253, which is associated with hosting infrastructure commonly used by malicious actors in phishing campaigns. The use of a recently registered domain and generic page title are typical tactics to avoid early detection. The phishing site remains active at the time of analysis, posing a medium-level risk to users who may encounter it. Users are advised to avoid interacting with the domain and not to disclose any personal or financial details. PhishDestroy continues to monitor stashpatrick.org for any changes in activity or infrastructure to provide updated threat intelligence and mitigation guidance.
03
Threat response pipeline
30+ Proprietary Parsers
Distributed scanning of Google Ads, SEO-manipulated results, Twitter/X, YouTube & Telegram campaigns.
Infrastructure Analysis
dnstwist & typosquatting detection.
Community Intelligence
Real-time ingestion via Telegram Bot & partner intelligence feeds.
Threat Ingested
stashpatrick.org detected and queued for full analysis.
48+ Vendor Submissions
Threat data submitted to 48+ security vendors & threat-intel platforms.
Spamhaus
Cloudflare
Google Safe Browsing
Microsoft Security
VirusTotal
Netcraft
ESET
Bitdefender
Norton Safe Web
Avira
Kaspersky
Sophos
Fortinet
TrendMicro
McAfee
Forcepoint
BlueCoat
Quttera
Yandex Safe
OpenPhish
PhishTank
URLhaus
SURBL
Mimecast
Proofpoint
Webroot
Comodo
Avast
AVG
Malwarebytes
Emsisoft
F-Secure
Panda
Dr.Web
GData
ALYac
Cyren
Tencent
Rising
Baidu
ClamAV
Antiy
Acronis
AILabs
ChainPatrol
CryptoScamDB
ScamSniffer
SEAL-ISAC
Cloudflare Radar
View scan — verdict: clean
VirusTotal2 / 95 vendors flagged on VirusTotal.
Blocklist Detection
Found in 1 blocklists: PhishDestroy.
Forensic Evidence CollectionURLScan.io, URLQuery & Cloudflare Radar — DOM snapshots, HTTP transactions, DNS & certificate data.
Registrar & Hosting Notification
Abuse report sent to Regional Network Information Center, JSC dba RU-CENTER at
abuse@timeweb.ru with forensic evidence (metadata, screenshots, PDF).DestroyList Published
Added to PhishDestroy/DestroyList — open-source blocklist for wallets & extensions.
Abuse Reports Sent (1)
1 abuse reports filed; 73d 4h elapsed since first report.
Open Threat Database
Real-time commits to GitHub repository & live monitoring at phishdestroy.io/live.
Social Broadcasting
Automated alerts on X, Telegram & Mastodon.
Confirmed dead
Domain confirmed taken down in 245 hours.
04
Evidence capture
Live Snapshot
2026-05-17 05:14 UTC
Domain Intelligence
Domainstashpatrick.org
Registrar
Regional Network Information Center, JSC dba RU-CENTER
Regional Network Information Center, JSC dba RU-CENTER
Abuse contact
abuse@timeweb.ru
IP Address
87.249.38.253
ASN
AS9123
Registration
2026-03-05 01:07:02
SSL
Let's Encrypt
Hosting
Saint Petersburg , RU
Saint Petersburg , RU
Nameservers
"ns2.timeweb.ru"]
MX
mx1.timeweb.ru, mx2.timeweb.ru
Page title
“Patrick Market”
External lookups
ICANN RDAP ↗
WHOIS ↗
viewdns ↗rapiddns ↗ ICANN registrars ↗
Technical details
Favicon hashabd12a721eaf1dc2187a824a1ee093f4
URLScan UUID019cbb83-ffff-7270…
Case IDPD-20260305-0C4C7F
08
Public blocklist status
1
Listed in 1 public blocklist — confirmed by independent sources
Sources with no listing are omitted.
09
Technologies
Technologies · 3 identified
Bootstrap
Nginx
Popper
Detected via Cloudflare Radar · Wappalyzer engine
10
VirusTotal consensus
2/95
vendors flagging
Partial detection
Aggregated detection across 95 security vendors.
Per-vendor breakdown not available — view raw report on VirusTotal ↗
11
Site performance
Site performance analysis
Google PageSpeed Insights — mobile audit of stashpatrick.org
63
Needs Work
Performance
FCP
5.86
First Contentful Paint
LCP
6.46
Largest Contentful Paint
CLS
0
Cumulative Layout Shift
TBT
0
Total Blocking Time
SI
5.86
Speed Index
12
Evidence & external reports
Security Analysis
14
Were you affected by this site?
Were You Affected?
You are not alone and there is nothing to be ashamed of. Reporting is the most
powerful weapon against fraud — your report can prevent others from becoming victims.
Chainabuse
Report crypto wallet or phishing URL
FBI IC3
Report internet crime (US)
Europol
Report cybercrime (EU)
Domain Appeal
Contest this listing
Beware of recovery scammers! No legitimate service will ask for upfront payment
to recover stolen crypto. Learn more about recovery fraud →
15
Report to your local authorities
Your country (auto-detected)
Russia
Email template — registrar abuse
To:
tld-adm@nic.ru, abuse@timeweb.ru
Registrar: Regional Network Information Center, JSC dba RU-CENTER Case: PD-PD-20260305-0C4C7F
16
Embed this report
17
About this report
About this report: stashpatrick.org
This domain security report is maintained by PhishDestroy's automated threat-intelligence pipeline. Our system continuously monitors this domain across 95 security vendors on VirusTotal and 1 public blocklists.
The site displays a page titled “Patrick Market”.
stashpatrick.org has been flagged by 2 security vendors as of May 17, 2026.
If you believe this listing is inaccurate, you can submit an appeal. For more information about our methodology, visit our FAQ page.