# PhishDestroy threat dossier — stonblo.com ================================================================ Fetched: 2026-07-12 21:45:14 UTC Canonical: https://phishdestroy.io/domain/stonblo.com/ ## VERDICT ---------------------------------------------------------------- CRITICAL THREAT — DO NOT VISIT Composite threat score: 87/100 (PhishDestroy scoring — see methodology below) Scam classification: Brand Impersonation ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 2/91 security vendors flagged this domain Flagging vendors: Kaspersky, SOCRadar Public blocklists: listed on 1 independent blocklist ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 188.114.97.3 (CA, Toronto) ASN: AS13335 Cloudflare, Inc. Hosting org: CloudFlare, Inc. Registrar: Dominet (HK) Limited Nameservers: marge.ns.cloudflare.com, stanley.ns.cloudflare.com Registered: 2026-07-06 Expires: 2027-07-06 Page title: Stonblo | Decentralized Web3 Gambling Site with Provable Trust HTTP response: 404 ## TLS CERTIFICATE ---------------------------------------------------------------- Issuer: Google Trust Services / WE1 Expires: 2026-10-04 Status: INVALID chain Fingerprint: 47fbcb038e08af43dd2faa3e615ca039bf59f58c5d4bdb56305b9d3433c59ea3 ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: pending notification queue. No abuse reports filed yet — this domain is waiting for the next cycle of our automated abuse-reporter. ## TIMELINE ---------------------------------------------------------------- Domain registered: 2026-07-06 (per WHOIS / CT — may reflect a renewal or transfer date, not first-ever registration) First detected: 2026-07-12 18:17:24 UTC (by PhishDestroy tracker) First reported: 2026-07-12 21:35:00 UTC (abuse notice filed) Last verified: 2026-07-12 23:45:12 UTC Current status: ACTIVE / observable ## EXTERNAL CORROBORATION (third-party evidence) ---------------------------------------------------------------- URLScan.io: https://urlscan.io/result/019f571e-1a1b-712c-abd1-973e8e2972a2/ URLQuery: https://urlquery.net/report/31e7664f-b26d-482c-a320-3941c03ee5da Wayback Machine: https://web.archive.org/web/*/stonblo.com crt.sh CT logs: https://crt.sh/?q=%25.stonblo.com Google transparency: https://transparencyreport.google.com/safe-browsing/search?url=stonblo.com AlienVault OTX: https://otx.alienvault.com/indicator/domain/stonblo.com URLhaus: https://urlhaus.abuse.ch/host/stonblo.com/ ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-07-12 18:45:17 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] Analysis indicates that the domain stonblo.com was registered on July 06, 2026 through Dominet (HK) Limited and is currently resolvable to the IP address 188.114.97.3. The domain is delegated to the Cloudflare name servers marge.ns.cloudflare.com and stanley.ns.cloudflare.com. The page title associated with the domain reads “Stonblo | Decentralized Web3 Gambling Site with Provable Trust,” and the threat taxonomy lists the activity as generic_phishing. The risk level is marked under_investigation and the operational status is active. Network observations show that HTTP requests to the host return a 404 status code, indicating that the web server does not deliver a valid page at the time of testing. No detections were reported by VirusTotal across 95 scanning engines, and the domain has not yet been flagged by external intelligence feeds. The use of Cloudflare’s DNS infrastructure is consistent with a pattern of fast‑flux or proxy‑based hosting often employed by threat actors to obscure source locations. Current intelligence gaps include the absence of a payload sample, lack of visible malicious content, and no confirmed victim reports. Because the domain’s page title advertises a Web3 gambling service, it may be intended to lure users into credential harvesting or financial deception, yet no concrete evidence of such behavior has been captured. The recent creation date and the active status suggest the infrastructure is newly deployed and may evolve rapidly. Defensive operators should consider preemptive containment by adding stonblo.com to block lists and monitoring DNS queries for resolution to 188.114.97.3. Continuous re‑scanning of the domain on VirusTotal and other sandbox environments is advised to capture any future changes in payload delivery. Correlation of network traffic to the identified IP with internal logs can help identify potential compromise attempts, and any observed phishing‑related communications should be escalated for further investigation. ## EVIDENCE HASHES ---------------------------------------------------------------- PhishDestroy Case ID: PD-20260712-906FCF Favicon MD5: 0b597a340b4d6f9e2092e365088b9915 TLS cert SHA-256: 47fbcb038e08af43dd2faa3e615ca039bf59f58c5d4bdb56305b9d3433c59ea3 ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (operator takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/stonblo.com/ JSON API: https://api.destroy.tools/v1/check?domain=stonblo.com Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: independent open-source threat-intelligence platform. Tracked: 177,899 domains (49,643 alive under monitoring, 128,256 confirmed takedowns/dead). Site: https://phishdestroy.io