# PhishDestroy threat dossier — store.communitygamesarts.shop ================================================================ Fetched: 2026-04-30 13:55:11 UTC Canonical: https://phishdestroy.io/domain/store.communitygamesarts.shop/ ## VERDICT ---------------------------------------------------------------- CRITICAL THREAT — DO NOT VISIT Composite threat score: 100/100 (PhishDestroy scoring — see methodology below) ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 7/95 security vendors flagged this domain Flagging vendors: ADMINUSLabs, Cluster25, Fortinet, Gridinsoft, MalwareURL, Seclookup, SOCRadar Public blocklists: listed on 2 independent blocklists ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 138.226.236.62 Registrar: REGISTRAR_NOT_FOUND Nameservers: NS_NOT_FOUND Registered: 2026-04-30 HTTP response: 200 ## TLS CERTIFICATE ---------------------------------------------------------------- Issuer: Let's Encrypt / R12 Expires: 2026-07-28 Status: INVALID chain Fingerprint: 66d902ebf1f213328b49fbdc0626559251d6c0417e9b1d1823455c3cf9260ab9 Subject Alternative Names (related infrastructure — often same operator): - store.communityapp.shop - www.store.communityapp.shop ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: pending notification queue. No abuse reports filed yet — this domain is waiting for the next cycle of our automated abuse-reporter. ## TIMELINE ---------------------------------------------------------------- Domain registered: 2026-04-30 (per WHOIS / CT — may reflect a renewal or transfer date, not first-ever registration) First detected: 2026-04-30 13:37:59 UTC (by PhishDestroy tracker) Last verified: 2026-04-30 16:00:09 UTC Current status: ACTIVE / observable ## EXTERNAL CORROBORATION (third-party evidence) ---------------------------------------------------------------- URLScan.io: https://urlscan.io/result/019dddf6-0e67-7199-bf59-1942a986a318/ Wayback Machine: https://web.archive.org/web/*/store.communitygamesarts.shop crt.sh CT logs: https://crt.sh/?q=%25.store.communitygamesarts.shop Google transparency: https://transparencyreport.google.com/safe-browsing/search?url=store.communitygamesarts.shop AlienVault OTX: https://otx.alienvault.com/indicator/domain/store.communitygamesarts.shop URLhaus: https://urlhaus.abuse.ch/host/store.communitygamesarts.shop/ ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-04-30 13:38:18 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] PhishDestroy identifies store.communitygamesarts.shop as an active phishing domain designed to impersonate a legitimate community gaming arts store. This fraudulent website specifically targets gamers by masquerading as a digital storefront for game-related merchandise or services. The domain employs social engineering tactics to trick users into entering sensitive login credentials or payment details, which are then harvested by the attackers for financial fraud or identity theft. This domain poses an elevated risk due to its inclusion on two prominent security blocklists: OpenPhish and PhishingArmy, indicating widespread recognition of its malicious nature. Technical analysis reveals that store.communitygamesarts.shop resolves to IP address 138.226.236.62 and utilizes a Let's Encrypt SSL certificate to appear legitimate. Alarmingly, 7 out of 95 security vendors on VirusTotal have flagged this domain as malicious, underscoring its high threat potential. The combination of a deceptive domain name, active phishing infrastructure, and multiple blocklist detections demonstrates a well-coordinated effort to deceive unsuspecting users. Users who have visited store.communitygamesarts.shop should immediately cease any interaction with the site and avoid entering personal information, including usernames, passwords, or payment details. If credentials were entered, change passwords on all accounts using the same login information and enable two-factor authentication where available. Monitor financial accounts closely for unauthorized transactions and consider reporting the incident to your bank or payment provider. To prevent future exposure, install and update antivirus software, use a reputable ad-blocker, and verify website authenticity through independent sources before making purchases. Always check for HTTPS encryption and domain spelling discrepancies when shopping online. ## EVIDENCE HASHES ---------------------------------------------------------------- TLS cert SHA-256: 66d902ebf1f213328b49fbdc0626559251d6c0417e9b1d1823455c3cf9260ab9 ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (volunteer takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/store.communitygamesarts.shop/ JSON API: https://api.destroy.tools/v1/check?domain=store.communitygamesarts.shop Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: volunteer-driven open-source threat-intelligence platform. Tracked: 131,000+ phishing domains. Confirmed takedowns: 91,000+. Site: https://phishdestroy.io