Network Threat Shield — Setup & Architecture Guide

The Stormhood Network Threat Shield provides system-wide, wire-speed protection against cyber threats, crypto drainers, and phishing portals. Powered by Cloudflare Zero Trust Edge infrastructure across 330+ cities worldwide, it intercepts malicious hostnames at the encrypted DNS query phase—before any TCP handshake or HTTP request can open.

---

1. Why Network Threat Shield?

Traditional anti-fraud solutions require browser extensions or intrusive VPN tunnels. Network Threat Shield operates on modern encrypted DNS standards (DNS-over-HTTPS and DNS-over-TLS):

• ⚡ Sub-15ms Wire-Speed Edge: DNS queries are resolved instantaneously at the nearest edge server without proxy bottlenecks.
• 🔒 Zero-Decryption Privacy: Unlike VPNs, Stormhood never inspects, proxies, or decrypts your traffic. Your payloads remain end-to-end encrypted directly with the websites you visit.
• 🔋 0% Battery Drain: Because native operating system socket resolvers are utilized, no background VPN tunnel daemon is kept alive and battery usage remains completely unaffected.
• 🛡️ Whole-Device & Whole-Home: Protects all applications, background daemons, smart TVs, and IoT gadgets—even apps that cannot run browser extensions.

---

2. iOS & macOS Setup (Certified Apple Profile)

Apple platforms natively support system-level encrypted DNS profiles via .mobileconfig:

Important: On iPhone and iPad, you must use Safari to download configuration profiles. Third-party browsers (Chrome, Firefox, Brave) download .mobileconfig as a raw file rather than triggering the native iOS Profile Installation manager.

iOS & iPadOS (iOS 14 through iOS 18+):

1. Sign in to your Pro account on stormhood.xyz/shield using Safari.
2. Under the Apple (iOS / macOS) tab, tap Download Apple Profile (.mobileconfig).
3. When prompted ("This website is trying to download a configuration profile. Do you want to allow this?"), tap Allow.
4. Open the Settings app on your device:
   • Tap the Profile Downloaded banner located right below your Apple Account at the top of Settings.
   • (If the banner is not visible, go to Settings → General → VPN & Device Management).
5. Select Stormhood Network Threat Shield, tap Install in the top-right corner, enter your device passcode, and confirm.
6. Once installed, your DNS traffic across both cellular (5G/LTE) and Wi-Fi networks is automatically routed through your dedicated encrypted sinkhole.

macOS (Big Sur, Monterey, Ventura, Sonoma, Sequoia):

1. Download the profile from stormhood.xyz/shield.
2. Open System Settings (or System Preferences on older versions).
3. Navigate to Privacy & Security → Profiles.
4. Double-click Stormhood Network Threat Shield and click Install....
5. Enter your Mac administrator password to authorize installation.

To uninstall or disable on any Apple device: Go to Settings → General → VPN & Device Management → DNS, and choose Automatic, or remove the profile.

---

3. Android Setup (Private DNS over TLS — Android 9+)

Android 9+ includes native system-wide Private DNS using DNS-over-TLS (DoT, Port 853):

⚠️ Critical Formatting Rule: In the Android hostname field, enter ONLY the hostname (e.g. <your-token>.doh.stormhood.xyz). Do NOT prefix with https:// and do NOT append /dns-query. Android Private DNS uses pure TLS on port 853; adding a URL prefix will result in a "Couldn't connect" error and disrupt Internet access.

Navigation by Device Manufacturer:

• Google Pixel / Stock Android / Motorola / Nothing:
  1. Open Settings → Network & internet → Private DNS.
  2. Select Private DNS provider hostname.
  3. Enter your personal hostname from stormhood.xyz/shield:

     <your-token>.doh.stormhood.xyz
     

  4. Tap Save.
• Samsung Galaxy (One UI):
  1. Open Settings → Connections → More connection settings.
  2. Tap Private DNS → Select Private DNS provider hostname.
  3. Paste your hostname and tap Save.
• Xiaomi / Redmi / POCO (MIUI / HyperOS):
  1. Open Settings → Connection & sharing → Private DNS.
  2. Select Private DNS provider hostname, paste your hostname, and tap Save.

Once saved, Android conducts an immediate TLS handshake on port 853. All system traffic (browsers, Telegram, banking apps, gaming) is instantly shielded.

---

4. Windows 11 & Desktop Browsers (DNS-over-HTTPS)

Windows 11 Native System-Wide DoH:

1. Open Settings (Win + I) → Network & internet → Wi-Fi (or Ethernet).
2. Click Hardware properties for your active network connection.
3. Next to DNS server assignment, click Edit.
4. Change the dropdown from Automatic (DHCP) to Manual, and toggle IPv4 to On.
5. In Preferred DNS, enter 1.1.1.1.
6. Under DNS over HTTPS, select Encrypted only (DNS over HTTPS).
7. In the DNS over HTTPS template field, enter your personal DoH URL:

   https://<your-token>.doh.stormhood.xyz/dns-query
   

8. (Optional) Toggle IPv6 to On, enter 2606:4700:4700::1111, and paste the same DoH template URL. Click Save.

Browser-Level DoH (Chrome, Brave, Edge, Opera, Firefox):

If your OS does not support native DoH or you prefer browser-level sandboxing:

• Chrome / Brave / Edge / Opera:
  1. Open browser Settings → Privacy and security → Security.
  2. Under Use secure DNS, select With: Custom.
  3. Paste your personal DoH URL:

     https://<your-token>.doh.stormhood.xyz/dns-query
     

• Mozilla Firefox:
  1. Open Firefox Settings → Privacy & Security → scroll to DNS over HTTPS.
  2. Select Max Protection (or Increased Protection).
  3. Under Choose provider, select Custom and enter your personal DoH URL.

---

5. Whole-Home Router Protection (Keenetic, Asus, UniFi, pfSense, OpenWrt)

Configuring Network Threat Shield at your home router protects every phone, laptop, gaming console (PlayStation, Xbox, Switch), Smart TV (Samsung, LG, Apple TV), and IoT device in your household simultaneously without requiring individual client installations:

---

6. Verifying Protection & Diagnostics

To confirm that your device or router is actively protected through Stormhood:

1. Web Dashboard Verification: Visit stormhood.xyz/shield and tap Test Shield Connection. The edge telemetry will display a green Shield Active confirmation with live round-trip latency.
2. CLI Verification via cURL (DoH):

   curl -H "accept: application/dns-json" "https://<your-token>.doh.stormhood.xyz/dns-query?name=stormhood.xyz&type=A"
   

3. CLI Verification via kdig (DoT):

   kdig -d @<your-token>.doh.stormhood.xyz +tls stormhood.xyz
   

4. Threat Interception Test: When any device queries a flagged crypto drainer, phishing link, or malicious infrastructure, Stormhood automatically returns 0.0.0.0 or NXDOMAIN. The connection is terminated before any TCP handshake or malicious JavaScript execution occurs.