Domain security and threat intelligence

the-robo.web.app

Name: the-robo.web.app — PhishDestroy evidence record
Published: 2026-09-08
License: https://creativecommons.org/licenses/by/4.0/

In short

PhishDestroy stores a record for the-robo.web.app. Source observations are dated separately; missing checks do not establish safety.

“THE ROBO NFT Collection | 3333 Hand-Drawn Robots”

Review the evidence

Registrar: Google Domains
Resolved IP: 199.36.158.100Fastly, Inc. · CDN
First observed: Sep 8, 2026

PhishDestroy assessment High

68/100

Evidence score

Availability Last known active Latest stored reachability observation Observed Nov 1, 2026 · 03:11 UTCHTTP probe

Risk signals

VirusTotal detections: 2/92 Stored blocklist matches: 1

VirusTotal

2 / 92

engine detections · 2026-10-08

Blocklist matches

ScamSniffer

URLQuery

detections

URLScan

Malicious

engine verdict · score 100

Page captures

open gallery

Questions about the-robo.web.app

Is the-robo.web.app legit?

PhishDestroy stores a record for the-robo.web.app. Source observations are dated separately; missing checks do not establish safety.

Is the-robo.web.app safe to connect a wallet?

This report does not record which wallet requests the-robo.web.app makes. Because of the risk signals above, do not connect a wallet, sign messages or approve token permissions there. A confirmed blockchain transaction cannot be reversed.

What should I do if I used the-robo.web.app?

It depends on what you did. If you entered a password, change it, and also on every other site where you used the same password; turn on two-factor authentication where it is offered. If you paid or gave card or bank details, contact your bank or payment service through the contacts on your card or its official website. If you only connected a wallet, disconnect the site in the wallet and reject pending requests; a connection by itself does not move funds. If you signed a token approval or permit, revoke it with a token-approval checker. If you shared a seed phrase or private key, treat the wallet as compromised and move the remaining funds to a new wallet with a new seed phrase. If you downloaded a file, do not open it and scan the device with security software. Keep the address, dates, payment or transaction details and messages for a report to the police or another competent authority; a report does not guarantee that money is returned. Step-by-step help: emergency guide.

Explore

Source evidenceVirusTotal 2 / 92 8 sources

VirusTotal

2 / 92 engine detections · stored summary

2026-10-23 02:03 UTC

Open report

VirusTotalOriginal source recordObserved: 2026-10-08 16:36:23 UTC14 fields

Observed: 2026-10-08T16:36:23Z · Retrieved: 2026-10-22T23:31:32Z

Vendor result counts

Timeout: 0
Harmless: 55
Malicious: 1
Suspicious: 1
Undetected: 35

Vendor labels

Gridinsoft: suspicious
Forcepoint ThreatSeeker: phishing

Reputation score

Registrar

MarkMonitor Inc.

Created

2019-01-08 22:05:04 UTC

Expires

2026-01-08 22:05:04 UTC

Updated

2024-12-12 10:14:49 UTC

First seen

2026-09-08 13:55:44 UTC

DNS records

TTL, seconds
21600
Type
AAAA
Value
2620:0:890::100
TTL, seconds
21600
Type
A
Value
199.36.158.100

DNS records observed

2026-10-08 16:38:53 UTC

JARM fingerprint

29d3fd00029d29d00041d41d00041d6b5eefa2404a56c2ced79a0d16afe36c

Certificate

Subject alternative names: web.app
*.web.app
Issuer: Google Trust Services / WR4
Serial: e26d762a101120cd12a8f68d86c31d05
SHA-256: 7175912cef4e9b3d3f320d60e4e926f7cb6a2f624028de25218038a3f679e095
Subject: web.app
Valid until: 2026-12-22 17:59:57 UTC
Valid from: 2026-09-23 17:59:58 UTC

Registration record

Registrar: MarkMonitor Inc.
Registrar IANA ID: 292
Registrar URL: http://www.markmonitor.com
Registered: 2019-01-08 22:05:04 UTC
Updated: 2024-12-12 10:14:49 UTC
Expires: 2026-01-08 22:05:04 UTC
Status: clientDeleteProhibited
clientTransferProhibited
clientUpdateProhibited
Nameservers: ns1.googledomains.com
ns2.googledomains.com
ns3.googledomains.com
ns4.googledomains.com
DNSSEC: unsigned

Original source fields · JSON

Vendor result counts	{ "timeout": 0, "harmless": 55, "malicious": 1, "suspicious": 1, "undetected": 35 }
Vendor labels	{ "Gridinsoft": "suspicious", "Forcepoint ThreatSeeker": "phishing" }
Reputation	0
Categories	{ "Google": "technology", "Sophos": "information technology", "Forcepoint ThreatSeeker": "web hosting" }
Registrar	MarkMonitor Inc.
Created	2019-01-08T22:05:04Z
Expires	2026-01-08T22:05:04Z
Updated	2024-12-12T10:14:49Z
First seen	2026-09-08T13:55:44Z
DNS records	[ { "ttl": 21600, "type": "AAAA", "value": "2620:0:890::100" }, { "ttl": 21600, "type": "A", "value": "199.36.158.100" } ]
Dns at	2026-10-08T16:38:53Z
Jarm	29d3fd00029d29d00041d41d00041d6b5eefa2404a56c2ced79a0d16afe36c
Certificate	{ "san": [ "web.app", "*.web.app" ], "issuer": "Google Trust Services / WR4", "serial": "e26d762a101120cd12a8f68d86c31d05", "sha256": "7175912cef4e9b3d3f320d60e4e926f7cb6a2f624028de25218038a3f679e095", "subject": "web.app", "valid_to": "2026-12-22T17:59:57Z", "valid_from": "2026-09-23T17:59:58Z" }
Registration record	{ "registrar": "MarkMonitor Inc.", "registrar_iana_id": "292", "registrar_url": "http://www.markmonitor.com", "created": "2019-01-08T22:05:04Z", "updated": "2024-12-12T10:14:49Z", "expires": "2026-01-08T22:05:04Z", "status": [ "clientDeleteProhibited", "clientTransferProhibited", "clientUpdateProhibited" ], "nameservers": [ "ns1.googledomains.com", "ns2.googledomains.com", "ns3.googledomains.com", "ns4.googledomains.com" ], "dnssec": "unsigned" }

Separate source record · 1 malicious + 1 suspicious / 92 · 2026-10-08 16:36:23 UTC

The summary above and this provider record were collected at different times. Both remain available; malicious and suspicious classifications are shown separately.

record_source: collected_observations.vt
analysis_at: 2026-10-08T16:36:23Z
fetched_at: 2026-10-22T23:31:32Z
stats: {"timeout":0,"harmless":55,"malicious":1,"suspicious":1,"undetected":35}

URLQuery

1 det.

2026-10-25 11:50 UTC

Open report

URLScan

Malicious · engine verdict · score 100

2026-09-08 18:30 UTC

Open report

URLScanOriginal source recordObserved: 2026-09-08 18:30:05 UTC21 fields

Observed: 2026-09-08T18:30:05Z · Retrieved: 2026-10-21T02:27:52Z

Report ID

01a08248-ba6c-7617-a875-98b34aacc809

Final URL

https://the-robo.web.app/

HTTP response

200

Redirect type

https-only

Redirects

To
https://the-robo.web.app/
From
http://the-robo.web.app/
Status
307

IP address

199.36.158.100

Contacted domains

esm.sh
zennnnnnn.xyz
explorer-api.walletconnect.com
c.animaapp.com
fonts.gstatic.com
relay.walletconnect.org
kim-oriental-proteins-useful.trycloudflare.com
bsc.blockrazor.xyz
cdn.tailwindcss.com
fonts.googleapis.com

Contacted IP addresses

104.26.14.209
104.26.15.209
104.16.231.132
172.66.147.126
104.21.40.197
172.67.72.107
142.251.110.94
18.245.60.122
104.26.3.143
142.250.154.95
199.36.158.100

Autonomous systems (ASN)

13335
15169
16509
54113

Server countries

Document hash

371a1196de67eb3b7b1310f2f4ba4b7a3b3bedb6a906091edb8e33b30127d152

Script hashes

dd01b8efdfb1648cb56030f6ee352695562114614a681bdd35474b343b5349f4

JavaScript globals

tailwind
/template.html
_0x58bc
_0x5300
__PROXY__
__RC__
__SAFE_KIT__
__SAFE_ADAPTER__
_ethers
Buffer
__PM_CLICK_BOUND__
CFG
__PM_HIDE_WALLET_UI__
__PM_BOOTED__
_walletConnectCore__count
downloadLogsBlobInBrowser
_walletConnectCore_

TLS session and certificate

Subject alternative names: web.app
*.web.app
Cipher: AES_128_GCM
Issuer: WR4
Subject: web.app
Protocol: TLS 1.3
Valid until: 2026-10-18 14:59:54 UTC
Valid from: 2026-07-20 14:59:55 UTC

Domain age, days

Registered domain age, days

Certificate age, days

Certificate validity, days

Page requests

Provider verdicts

Engine verdict

Tags: urlscan-ml
urlscan-ml-60c5e22
Score: 100
Malicious: Yes

Overall verdict

Score: 0
Malicious: No

HTTP headers

Content-type: text/html; charset=utf-8
Strict-transport-security: max-age=31556926; includeSubDomains; preload

Original source fields · JSON

Uuid	01a08248-ba6c-7617-a875-98b34aacc809
Final url	https://the-robo.web.app/
Status	200
Redirected	https-only
Redirects	[ { "to": "https://the-robo.web.app/", "from": "http://the-robo.web.app/", "status": 307 } ]
Ip	199.36.158.100
Contacted domains	[ "esm.sh", "zennnnnnn.xyz", "explorer-api.walletconnect.com", "c.animaapp.com", "fonts.gstatic.com", "relay.walletconnect.org", "kim-oriental-proteins-useful.trycloudflare.com", "bsc.blockrazor.xyz", "cdn.tailwindcss.com", "fonts.googleapis.com" ]
Contacted IP addresses	[ "104.26.14.209", "104.26.15.209", "104.16.231.132", "172.66.147.126", "104.21.40.197", "172.67.72.107", "142.251.110.94", "18.245.60.122", "104.26.3.143", "142.250.154.95", "199.36.158.100" ]
Asns	[ "13335", "15169", "16509", "54113" ]
Countries	[ "US" ]
Document hash	371a1196de67eb3b7b1310f2f4ba4b7a3b3bedb6a906091edb8e33b30127d152
Script hashes	[ "dd01b8efdfb1648cb56030f6ee352695562114614a681bdd35474b343b5349f4" ]
Globals	[ "tailwind", "/template.html", "_0x58bc", "_0x5300", "__PROXY__", "__RC__", "__SAFE_KIT__", "__SAFE_ADAPTER__", "_ethers", "Buffer", "__PM_CLICK_BOUND__", "CFG", "__PM_HIDE_WALLET_UI__", "__PM_BOOTED__", "_walletConnectCore__count", "downloadLogsBlobInBrowser", "_walletConnectCore_" ]
Tls	{ "san": [ "web.app", "*.web.app" ], "cipher": "AES_128_GCM", "issuer": "WR4", "subject": "web.app", "protocol": "TLS 1.3", "valid_to": "2026-10-18T14:59:54Z", "valid_from": "2026-07-20T14:59:55Z" }
Domain age days	0
Apex age days	0
Tls age days	50
Tls valid days	89
Requests	46
Provider verdicts	{ "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 100, "malicious": true }, "overall": { "score": 0, "malicious": false } }
HTTP headers	{ "content-type": "text/html; charset=utf-8", "strict-transport-security": "max-age=31556926; includeSubDomains; preload" }

Separate monitor record · 2026-09-08 23:09 UTC

Separate stored monitor snapshot; does not replace the primary report record or establish current availability.

record_source: domain_monitor.urlscan
uuid: 01a08248-ba6c-7617-a875-98b34aacc809
report_url: https://urlscan.io/result/01a08248-ba6c-7617-a875-98b34aacc809/
score: 0
malicious: false
result_at: 2026-09-08T23:09:29Z
enriched_at: 2026-09-09T08:26:31Z
source_timestamps: {"urlscan_result_at":"2026-09-09 01:09:29","urlscan_enriched_at":"2026-09-09 10:26:31"}
timestamp_basis: Europe/Berlin, as used by the existing report; source timestamps are retained verbatim

OTX

no community references

2026-10-16 22:16 UTC

Open report

Cloudflare Radar

provider verdict: clean

Open report

Cloudflare RadarOriginal source recordObserved: 2026-09-08 18:33:43 UTC11 fields

Observed: 2026-09-08T18:33:43Z · Retrieved: 2026-10-21T03:57:21Z

Report ID

04573a80-1a7b-42ca-a5e6-b4d5850442db

Final URL

https://the-robo.web.app/

HTTP response

200

Navigation history

URL
https://the-robo.web.app/
Status
200

DOM structure hash

36a48a8bdd013be499661a7db75e728b993b5badacc8379e563668a7f98ae03c

Document hash

371a1196de67eb3b7b1310f2f4ba4b7a3b3bedb6a906091edb8e33b30127d152