stormcorebotshield[.]co[.]in

On July 29 2026 the domain stormcorebotshield.co.in was classified as a high‑risk generic phishing site and remains active. The domain is listed on a single security blocklist and is actively blocked by the PhishDestroy service. VirusTotal scans have resulted in 12 of 91 security vendors marking the domain as malicious, indicating a moderate level of detection consensus. Google Safe Browsing also flags the site for social engineering, confirming that the URL is recognized as a vector for credential‑stealing or fraud attempts.

The single blocklist entry indicates that the domain has been observed in at least one phishing takedown operation, though the specific blocklist name was not disclosed. No additional infrastructure details such as registrar, hosting IP, ASN, or SSL certificate information were available in the current intelligence set, and the page title or target brand has not been disclosed. The absence of registrar and hosting metadata prevents correlation with other known malicious infrastructures, but the presence of multiple vendor detections and Google Safe Browsing classification provides sufficient confidence for immediate mitigation. The 12 positive detections out of 91 scanners reflect that several reputable engines have identified malicious payloads or phishing templates associated with the domain, reinforcing the high‑risk designation.

Defenders should add stormcorebotshield.co.in to network‑level deny lists, update endpoint protection signatures, and ensure that web filtering solutions reference both the blocklist entry and the Google Safe Browsing classification. Security teams should also consider sharing indicators of compromise, such as the domain name, with industry ISACs to broaden collective awareness. Regular verification of the domain’s status through services like PhishDestroy and Google Safe Browsing is advised, as the threat landscape may evolve rapidly.