# PhishDestroy domain threat record: stealthadventure.app

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/stealthadventure.app/
Machine-readable companion: https://phishdestroy.io/domain/stealthadventure.app/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-23 01:38:19 UTC
- Last availability or vendor check: 2026-10-23 02:11:07 UTC
- Stored record updated: 2026-10-23 04:30:34 UTC
- VirusTotal detections in the stored snapshot: 1/92
- Independent public blocklist matches in the stored snapshot: 2
- Matching public blocklists: MetaMask, SEAL
- Google Safe Browsing stored result: no stored flag

## Stored infrastructure

- Observed IP address: 188.114.97.3
- Registrar in stored WHOIS data: PDR Ltd. d/b/a PublicDomainRegistry.com
- Last stored HTTP status: 200
- Registration date (registry RDAP, stealthadventure.app): 2026-07-14 16:00:06 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a16685-4185-771d-b74a-603fe1f290a3/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/stealthadventure.app
- Certificate Transparency search: https://crt.sh/?q=%25.stealthadventure.app
- Web Archive lookup: https://web.archive.org/web/*/https://stealthadventure.app/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
PhishDestroy’s intake AI assessed the site as malicious because the recorded page title “StealthEX” and accompanying text claim to represent the StealthEX cryptocurrency exchange while the domain name is unrelated, and the page advertises an iOS application that could be a malicious download. The domain was first observed by PhishDestroy on 2026-10-23 and returned an HTTP 200 response on that date.

How the scam works
In this category of fraud the attacker registers a domain that mimics a known crypto service’s brand, uses the brand name in titles and copy to lure users, and then offers a downloadable app that may contain malware or phishing components. Victims who install the app can have credentials harvested or wallet actions performed without their consent.

Evidence
VirusTotal’s scan on 2026-10-22 reported one suspicious detection (URLQuery) out of 92 engines. Google Safe Browsing checked on 2026-10-23 did not flag the URL. PhishDestroy’s own blocklist marked the domain as malicious on 2026-10-22, while no external blocklists listed it as of 2026-10-22. OTX showed no pulses on 2026-10-23. URLScan captured the site on 2026-10-20 and returned a clean verdict, but a later scan on 2026-10-23 flagged it as malicious by its machine‑learning model with a score of 95, although the overall verdict remained non‑malicious.

Infrastructure
The domain was created on 2026-07-14 (100 days old when first seen) through PDR Ltd. d/b/a PublicDomainRegistry.com. DNS had resolved to Cloudflare addresses such as 188.114.97.3 and 188.114.96.3, belonging to the CloudFLARENET‑EU network in Great Britain. The site presented a TLS certificate issued by Google Trust Services, valid from 2026-09-11 to 2026-12-10, covering the apex and any sub‑domains.

What to do
Do not install the advertised iOS application; verify any StealthEX software only from official sources and change credentials on the legitimate service if they were entered here. Network defenders should add stealthadventure.app to blocklists, monitor DNS queries and HTTP requests to the recorded IPs, and ensure no outbound connections from internal hosts to that address.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a16685-4185-771d-b74a-603fe1f290a3/
Cloudflare Radar report: https://radar.cloudflare.com/scan/9de7b85a-fbcd-425a-8ab4-77cfcd4f5e51
Stored capture screenshot: https://i.ibb.co/7xXrsPqY/3946f4a39a0b.png
Cloudflare Radar screenshot (2026-10-23T02:03:38Z): https://screenshots.phishdestroy.io/cf/9de7b85a-fbcd-425a-8ab4-77cfcd4f5e51.png
URLScan screenshot (2026-10-03T14:38:17Z): https://screenshots.phishdestroy.io/us/01a10233-815c-71eb-9e59-fc02df4fed5e.png
URLScan capture report: https://urlscan.io/result/01a10233-815c-71eb-9e59-fc02df4fed5e/
URLScan screenshot (2026-10-03T21:50:47Z): https://screenshots.phishdestroy.io/us/01a103bf-7772-764a-928e-35a183b963ec.png
URLScan capture report: https://urlscan.io/result/01a103bf-7772-764a-928e-35a183b963ec/
URLScan screenshot (2026-10-04T05:51:10Z): https://screenshots.phishdestroy.io/us/01a10577-45c6-76bc-bbf0-43b9d43588a6.png
URLScan capture report: https://urlscan.io/result/01a10577-45c6-76bc-bbf0-43b9d43588a6/
URLScan screenshot (2026-10-08T05:36:11Z): https://screenshots.phishdestroy.io/us/01a11a02-efbb-7154-b4eb-076ff4f89858.png
URLScan capture report: https://urlscan.io/result/01a11a02-efbb-7154-b4eb-076ff4f89858/
URLScan screenshot (2026-10-16T07:11:32Z): https://screenshots.phishdestroy.io/us/01a1438d-2a23-767f-ab3f-0053716f4518.png
URLScan capture report: https://urlscan.io/result/01a1438d-2a23-767f-ab3f-0053716f4518/
URLScan screenshot (2026-10-20T07:15:28Z): https://screenshots.phishdestroy.io/us/01a1582a-327e-76af-a1d1-fce8f98e333a.png
URLScan capture report: https://urlscan.io/result/01a1582a-327e-76af-a1d1-fce8f98e333a/
VirusTotal report: https://www.virustotal.com/gui/domain/stealthadventure.app
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=stealthadventure.app
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-23 02:13:42 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/7xXrsPqY/3946f4a39a0b.png
  Captured: 2026-10-23 02:11:07 UTC
- URLScan capture 1: https://screenshots.phishdestroy.io/01a16685-4185-771d-b74a-603fe1f290a3.png
  Captured: 2026-10-23 02:11:07 UTC
  Source report: https://urlscan.io/result/01a16685-4185-771d-b74a-603fe1f290a3/
- URLScan capture 2: https://urlscan.io/screenshots/01a1582a-327e-76af-a1d1-fce8f98e333a.png
  Captured: 2026-10-23 01:38:19 UTC
  Source report: https://urlscan.io/result/01a16685-4185-771d-b74a-603fe1f290a3/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/9de7b85a-fbcd-425a-8ab4-77cfcd4f5e51.png
  Captured: 2026-10-23 02:03:38 UTC
  Source report: https://radar.cloudflare.com/scan/9de7b85a-fbcd-425a-8ab4-77cfcd4f5e51
  SHA-256: 465aaffd7540fd5ec4abfd3c3d8381300a245feb83ccce3ca5c0cb9c7e1489e4
- URLQuery: https://screenshots.phishdestroy.io/uq/c4776bdf-555e-4c11-b1f1-49cf10f447b4.png
  Source report: https://urlquery.net/report/c4776bdf-555e-4c11-b1f1-49cf10f447b4
  SHA-256: 22da3dd8327bd1708d48897ebd3bd3d8c57ede95c79754260a8728081f8d22b2
- URLScan · 2026-10-03: https://screenshots.phishdestroy.io/us/01a10233-815c-71eb-9e59-fc02df4fed5e.png
  Captured: 2026-10-03 14:38:17 UTC
  Source report: https://urlscan.io/result/01a10233-815c-71eb-9e59-fc02df4fed5e/
  SHA-256: d7d35a3d4844d328d8aeae3f398201f4e8024b25453c3f6d2e48dce1503f4f19
- URLScan · 2026-10-04: https://screenshots.phishdestroy.io/us/01a10495-df0c-7469-9275-6168d0bd0be4.png
  Captured: 2026-10-04 01:44:58 UTC
  Source report: https://urlscan.io/result/01a10495-df0c-7469-9275-6168d0bd0be4/
  SHA-256: d7d35a3d4844d328d8aeae3f398201f4e8024b25453c3f6d2e48dce1503f4f19
- URLScan · 2026-10-04: https://screenshots.phishdestroy.io/us/01a10577-45c6-76bc-bbf0-43b9d43588a6.png
  Captured: 2026-10-04 05:51:10 UTC
  Source report: https://urlscan.io/result/01a10577-45c6-76bc-bbf0-43b9d43588a6/
  SHA-256: d7d35a3d4844d328d8aeae3f398201f4e8024b25453c3f6d2e48dce1503f4f19
- URLScan · 2026-10-12: https://screenshots.phishdestroy.io/us/01a12f5f-a075-76ea-9e12-6576251ece8f.png
  Captured: 2026-10-12 09:09:26 UTC
  Source report: https://urlscan.io/result/01a12f5f-a075-76ea-9e12-6576251ece8f/
  SHA-256: d7d35a3d4844d328d8aeae3f398201f4e8024b25453c3f6d2e48dce1503f4f19
- URLScan · 2026-10-16: https://screenshots.phishdestroy.io/us/01a1438d-2a23-767f-ab3f-0053716f4518.png
  Captured: 2026-10-16 07:11:32 UTC
  Source report: https://urlscan.io/result/01a1438d-2a23-767f-ab3f-0053716f4518/
  SHA-256: d7d35a3d4844d328d8aeae3f398201f4e8024b25453c3f6d2e48dce1503f4f19
- URLScan · 2026-10-23: https://screenshots.phishdestroy.io/us/01a1668d-3499-771c-8a91-108b6a8c01cd.png
  Captured: 2026-10-23 02:18:22 UTC
  Source report: https://urlscan.io/result/01a1668d-3499-771c-8a91-108b6a8c01cd/
  SHA-256: 29e57edf599cc36130a7ab89fed6103eb00f5521c18b5a58aa20e0fd779546e2

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-23T02:12:52Z",
        "uuid": "01a16685-4185-771d-b74a-603fe1f290a3",
        "scanned_at": "2026-10-23T02:09:36Z",
        "final_url": "https://stealthadventure.app/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://stealthadventure.app/",
                "from": "http://stealthadventure.app/",
                "status": 307
            }
        ],
        "ip": "188.114.96.3",
        "ips": [
            "188.114.96.3"
        ],
        "asns": [
            "13335"
        ],
        "doc_hash": "8bc5e0daf69a48045176bb2a7d1dc439be15f9856150da9dec87dee58f3d5240",
        "tls": {
            "san": [
                "stealthadventure.app",
                "*.stealthadventure.app"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "WE1",
            "subject": "stealthadventure.app",
            "protocol": "QUIC",
            "valid_to": "2026-12-10T16:28:54Z",
            "valid_from": "2026-09-11T15:31:30Z"
        },
        "domain_age_days": 100,
        "apex_age_days": 100,
        "tls_age_days": 41,
        "tls_valid_days": 90,
        "requests": 3,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 95,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "cloudflare",
            "content-type": "text/html"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-23T02:12:53Z",
        "uuid": "9de7b85a-fbcd-425a-8ab4-77cfcd4f5e51",
        "scanned_at": "2026-10-23T02:03:38Z",
        "final_url": "https://stealthadventure.app/",
        "status": 200,
        "history": [
            {
                "url": "https://stealthadventure.app/",
                "status": 200
            }
        ],
        "dom_hash": "24c6044a3d33523ec49f17c998200ceebb720649a780d9501cc69a4c4acb21a8",
        "doc_hash": "55c97f899ba9b73a16dd330a58eb5b785c9adfa8699852bfe2509843ccd56e2e",
        "domain_risks": [
            "Shareware/Freeware",
            "Technology"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "stealthadventure.app",
                "type": "A",
                "value": "188.114.97.0"
            },
            {
                "name": "stealthadventure.app",
                "type": "A",
                "value": "188.114.96.0"
            },
            {
                "name": "stealthadventure.app",
                "type": "AAAA",
                "value": "2a06:98c1:3120::"
            },
            {
                "name": "stealthadventure.app",
                "type": "AAAA",
                "value": "2a06:98c1:3121::"
            }
        ],
        "dnssec_valid": false,
        "ip": "188.114.97.0"
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-23T02:02:06Z",
        "analysis_at": "2026-10-22T12:44:14Z",
        "stats": {
            "timeout": 0,
            "harmless": 54,
            "malicious": 0,
            "suspicious": 1,
            "undetected": 37
        },
        "detections": {
            "URLQuery": "suspicious"
        },
        "reputation": 0,
        "first_seen": "2026-07-14T16:42:17Z",
        "dns": [
            {
                "ttl": 300,
                "type": "A",
                "value": "104.21.2.199"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "reza.ns.cloudflare.com"
            },
            {
                "ttl": 1800,
                "type": "SOA",
                "rname": "dns.cloudflare.com",
                "value": "mark.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3036::6815:2c7"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "172.67.129.155"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3031::ac43:819b"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "mark.ns.cloudflare.com"
            }
        ],
        "dns_at": "2026-10-22T12:44:32Z",
        "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c",
        "cert": {
            "san": [
                "stealthadventure.app",
                "*.stealthadventure.app"
            ],
            "issuer": "Google Trust Services / WE1",
            "serial": "2f5991d98d5a13f913ae4f835d166437",
            "sha256": "239fa42905bf82b461b162306f4dd6bfffbc0c0c9f38141a3ffa5b369f693d37",
            "subject": "stealthadventure.app",
            "valid_to": "2026-12-10T16:28:54Z",
            "valid_from": "2026-09-11T15:31:30Z"
        },
        "rdap": {
            "status": [
                "client transfer prohibited"
            ],
            "events": {
                "last changed": "2026-09-13T01:07:22Z",
                "registration": "2026-07-14T16:00:06Z",
                "registrar expiration": "2027-07-14T16:00:06Z",
                "last update of RDAP database": "2026-10-21T14:20:47Z"
            },
            "registrar": "PDR Ltd. d/b/a PublicDomainRegistry.com",
            "registrar_iana_id": "303"
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-23T02:13:02Z",
        "mail_config": {
            "spf_lookups": 0
        },
        "caa_records": {
            "domain": "stealthadventure.app"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_count": 0
        },
        "archives": {
            "last": "2026-10-23T01:46:26Z",
            "first": "2026-10-23T01:46:26Z",
            "changes": 0,
            "days_archived": 1,
            "avg_page_bytes": 2203
        },
        "social_tags": {
            "title": "StealthEX",
            "robots": "noindex,nofollow"
        },
        "trackers": {
            "requests": 2
        },
        "mixed_content": {
            "third_party_scripts": 0
        },
        "status": {
            "up": true,
            "code": 200,
            "timings": {
                "dns": 75,
                "tls": 29,
                "wait": 70,
                "connect": 9,
                "download": 0
            },
            "response_ms": 183
        },
        "tls_connection": {
            "alpn": "h2",
            "cipher": "TLS_AES_256_GCM_SHA384",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1",
                "TLSv1.1",
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                80,
                443,
                8080
            ]
        },
        "carbon": {
            "bytes": 1630,
            "co2_grams": 0.0001,
            "cleaner_than": 95
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "108.162.193.130",
                    "host": "mark.ns.cloudflare.com"
                },
                {
                    "ip": "172.64.32.217",
                    "host": "reza.ns.cloudflare.com"
                }
            ],
            "zone": "stealthadventure.app"
        },
        "location": {
            "ip": "2a06:98c1:3120::9",
            "asn": "13335",
            "org": "CloudFLARENET-EU",
            "city": "London",
            "country": "GB"
        },
        "ssl": {
            "issuer": "Google Trust Services / WE1",
            "subject": "stealthadventure.app"
        },
        "dns": {
            "A": [
                "188.114.97.9",
                "188.114.96.9"
            ],
            "NS": [
                "mark.ns.cloudflare.com",
                "reza.ns.cloudflare.com"
            ],
            "SOA": "{\"nsname\": \"mark.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2414864706, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}",
            "AAAA": [
                "2a06:98c1:3120::9",
                "2a06:98c1:3121::9"
            ]
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "hsts": {
            "message": "Site does not serve any HSTS headers."
        },
        "http_security": {
            "xFrameOptions": false,
            "referrerPolicy": false,
            "xXSSProtection": false,
            "permissionsPolicy": false,
            "xContentTypeOptions": false,
            "contentSecurityPolicy": false,
            "strictTransportPolicy": false,
            "crossOriginOpenerPolicy": false,
            "crossOriginEmbedderPolicy": false,
            "crossOriginResourcePolicy": false
        },
        "firewall": {
            "waf": "Cloudflare",
            "has_waf": true
        },
        "get_ip": {
            "ip": "2a06:98c1:3121::9",
            "family": 6
        },
        "redirects": {
            "chain": [
                "https://stealthadventure.app"
            ]
        },
        "tech_stack": {
            "technologies": [
                "Cloudflare",
                "HTTP/3"
            ]
        },
        "headers": {
            "headers": {
                "server": "cloudflare",
                "content-type": "text/html"
            }
        }
    }
}
```