# PhishDestroy domain threat record: stoffinovacion.com Content language: English Canonical HTML report: https://phishdestroy.io/domain/stoffinovacion.com/ Machine-readable companion: https://phishdestroy.io/domain/stoffinovacion.com/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: not observed active - First observed by PhishDestroy: 2026-09-07 12:19:20 UTC - Last availability or vendor check: 2026-10-21 01:15:21 UTC - Stored record updated: 2026-10-22 14:24:27 UTC - VirusTotal detections in the stored snapshot: 9/89 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: no stored flag ## Stored classification - Targeted brand: spectrum ## Stored infrastructure - Observed IP address: 204.197.252.128 - Registrar in stored WHOIS data: Akky Online Solutions S.A. de C.V. - Registrar country in stored WHOIS data: MX - Last stored HTTP status: 200 - Registration date (registry RDAP, stoffinovacion.com): 2019-10-01 19:52:18 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a07bcd-310a-7198-8145-35cb75899ff7/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/stoffinovacion.com - Certificate Transparency search: https://crt.sh/?q=%25.stoffinovacion.com - Web Archive lookup: https://web.archive.org/web/*/https://stoffinovacion.com/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview stoffinovacion.com hosted a fake Spectrum sign-in page titled "Sign In to Get Started," aimed at Spectrum customers who could be tricked into handing over their account login. PhishDestroy first detected it on 2026-09-07. The site has been offline since 2026-09-11 and was still down when last checked on 2026-10-19. How the scam works Victims typically arrive through an email or text claiming a billing problem, a service interruption or an account update, then land on a page styled to look like Spectrum's login. The "Sign In to Get Started" prompt asks for a username and password, and anything typed is sent straight to the operators. A stolen Spectrum account can expose billing details, the associated email address and personal information. Because people often reuse passwords, it can also open the door to other services. Evidence Nine of 89 VirusTotal engines flagged the domain as of 2026-09-12. The vendors include ESET, Kaspersky, G-Data, Forcepoint ThreatSeeker, alphaMountain.ai, CRDF, Gridinsoft and SOCRadar. Coverage is limited, but agreement among established vendors supports the verdict. urlscan.io rated the page malicious and recognized Spectrum branding on it, matching our classification. The domain is listed on the PhishDestroy and PhishFeed blocklists and appears in four AlienVault OTX threat pulses, which shows other researchers tracked it independently. Infrastructure The domain was registered on 2019-10-01 through Akky Online Solutions S.A. de C.V., nearly seven years before the phishing page appeared. Its Spanish-sounding name has no connection to Spectrum, so the brand lure lived entirely in the page content. The site was hosted in the United States on the PrivateSystems Networks range. What to do If you entered your Spectrum credentials on this page, change your Spectrum password immediately and sign out of all active sessions. Change the password anywhere else you used the same one, starting with your email account. Turn on two-step verification for your Spectrum account and email. Then review your Spectrum account for changed contact details, payment methods or unfamiliar orders, and watch for follow-up calls or texts posing as Spectrum support. Defenders should block the domain, search mail and proxy logs for visits from 2026-09-07 onward, and reset credentials for any user who submitted the form. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a07bcd-310a-7198-8145-35cb75899ff7/ VirusTotal report: https://www.virustotal.com/gui/domain/stoffinovacion.com Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=stoffinovacion.com Archived copy: https://web.archive.org/web/20260921232614/https://stoffinovacion.com/ Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-19 10:21:51 UTC ## Stored page captures - Primary capture: https://urlscan.io/screenshots/01a07bcd-310a-7198-8145-35cb75899ff7.png Captured: 2026-09-07 12:19:20 UTC - URLScan capture: https://screenshots.phishdestroy.io/01a07bcd-310a-7198-8145-35cb75899ff7.png Captured: 2026-09-07 12:19:20 UTC Source report: https://urlscan.io/result/01a07bcd-310a-7198-8145-35cb75899ff7/ - URLQuery: https://screenshots.phishdestroy.io/uq/bf70e7db-bf67-47e8-a071-b67024ab4a35.png Captured: 2026-09-07 12:28:16 UTC Source report: https://urlquery.net/report/bf70e7db-bf67-47e8-a071-b67024ab4a35 SHA-256: 45fbb57fc3a45958e490f64177155aec69c8b0c7b2bdc333e3a9081ddaefd07e - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/570df443-387b-4a03-9f8d-0eb5b3588a66.png Captured: 2026-09-07 12:21:19 UTC Source report: https://radar.cloudflare.com/scan/570df443-387b-4a03-9f8d-0eb5b3588a66 SHA-256: eb2274b24752908e0f903b102b438d4938f52ef6e230170488f4e790dcf03df1 - URLScan · 2026-09-06: https://screenshots.phishdestroy.io/us/01a07825-ab8b-7539-b80b-5db74a50b4f8.png Captured: 2026-09-06 19:15:38 UTC Source report: https://urlscan.io/result/01a07825-ab8b-7539-b80b-5db74a50b4f8/ SHA-256: de6fb93fb6e0884fcddf15380a39bfdc100f5f79b7111185dd5f2395695a6f4f - URLScan · 2026-09-07: https://screenshots.phishdestroy.io/us/01a07bc9-f20d-74bd-bb9c-2abb28a33713.png Captured: 2026-09-07 12:13:55 UTC Source report: https://urlscan.io/result/01a07bc9-f20d-74bd-bb9c-2abb28a33713/ SHA-256: df3ce695eeda95f111b61246eece94247a44e1cee863fd5d0198a9abfe6c9599 - URLScan · 2026-09-07: https://screenshots.phishdestroy.io/us/01a07cc4-0d36-703c-b3f0-a415e68f0e87.png Captured: 2026-09-07 16:47:04 UTC Source report: https://urlscan.io/result/01a07cc4-0d36-703c-b3f0-a415e68f0e87/ SHA-256: de6fb93fb6e0884fcddf15380a39bfdc100f5f79b7111185dd5f2395695a6f4f - URLScan · 2026-09-08: https://screenshots.phishdestroy.io/us/01a08111-d626-7743-b529-25031f8ff673.png Captured: 2026-09-08 12:50:32 UTC Source report: https://urlscan.io/result/01a08111-d626-7743-b529-25031f8ff673/ SHA-256: de6fb93fb6e0884fcddf15380a39bfdc100f5f79b7111185dd5f2395695a6f4f - URLScan · 2026-09-23: https://screenshots.phishdestroy.io/us/01a0cf95-1122-77dc-b72a-6113be928a7b.png Captured: 2026-09-23 18:44:18 UTC Source report: https://urlscan.io/result/01a0cf95-1122-77dc-b72a-6113be928a7b/ SHA-256: df3ce695eeda95f111b61246eece94247a44e1cee863fd5d0198a9abfe6c9599 - URLScan · 2026-10-08: https://screenshots.phishdestroy.io/us/01a1191b-76d0-762d-99b9-3061fa0a4951.png Captured: 2026-10-08 01:23:18 UTC Source report: https://urlscan.io/result/01a1191b-76d0-762d-99b9-3061fa0a4951/ SHA-256: df3ce695eeda95f111b61246eece94247a44e1cee863fd5d0198a9abfe6c9599 ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-21T02:29:18Z", "uuid": "01a07bcd-310a-7198-8145-35cb75899ff7", "scanned_at": "2026-09-07T12:17:26Z", "final_url": "https://stoffinovacion.com/class/", "status": 200, "redirected": "same-domain", "redirects": [ { "to": "https://stoffinovacion.com/class", "from": "http://stoffinovacion.com/class", "status": 307 }, { "to": "https://stoffinovacion.com/class/", "from": "https://stoffinovacion.com/class", "status": 301 } ], "ip": "204.197.252.128", "ptr": "ca.enetnube.com", "domains": [ "cdnjs.cloudflare.com" ], "ips": [ "104.17.25.14", "204.197.252.128" ], "asns": [ "13335", "63410" ], "countries": [ "US" ], "link_domains": [ "id.spectrum.net", "www.spectrum.com", "spectrum.com", "www.spectrum.net" ], "doc_hash": "8f15549784bd144107a9753ac17bc5a327e5834bff61cf37d25eb7d77181d180", "globals": [ "$", "jQuery", "$jscomp" ], "tls": { "san": [ "*.stoffinovacion.com", "stoffinovacion.com" ], "cipher": "AES_128_GCM", "issuer": "YR1", "subject": "*.stoffinovacion.com", "protocol": "TLS 1.3", "valid_to": "2026-11-14T08:47:24Z", "valid_from": "2026-08-16T08:47:25Z" }, "domain_age_days": 2408, "apex_age_days": 2408, "tls_age_days": 22, "tls_valid_days": 89, "requests": 5, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 93, "malicious": true }, "overall": { "tags": [ "phishing" ], "score": 100, "brands": [ "spectrum" ], "malicious": true, "categories": [ "phishing" ] }, "urlscan": { "tags": [ "phishing" ], "score": 100, "brands": [ "Spectrum" ], "malicious": true, "categories": [ "phishing" ] } }, "headers": { "server": "Apache", "content-type": "text/html" } }, "cf": { "v": 1, "fetched_at": "2026-10-21T03:58:20Z", "uuid": "570df443-387b-4a03-9f8d-0eb5b3588a66", "scanned_at": "2026-09-07T12:21:19Z", "final_url": "https://tpnflvpf.info/", "status": 200, "redirected": "off-domain", "history": [ { "url": "https://stoffinovacion.com/", "status": 301 }, { "url": "https://tpnflvpf.info/", "status": 200 } ], "dom_hash": "d3b0c18fe3cb93650a6b55841b27f9b650d6678c40d65ec8784e8b2525172331", "doc_hash": "7b071ffaa532472b85b608e22aa2c3d9bc88cdf7f42fd73a4c44511e0291eca5", "phishing_v2": [ "phishing" ], "domain_risks": [ "DGA Domains", "Security threats", "New Domains", "Security Risks", "Newly Seen Domains", "CIPA Filter", "CIPA" ], "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "tpnflvpf.info", "type": "A", "value": "66.29.132.226" } ], "dnssec_valid": false, "ip": "66.29.132.226", "verdict": { "tags": [ "dga domains" ], "malicious": true, "categories": [ "dga domains" ] } } } ```