coinbase-refunds[.]com

PhishDestroy first observed coinbase-refunds.com on Feb 26, 2026. The hostname explicitly references Coinbase; stored content metadata identifies the same apparent target. The captured page title is “www.coinbase-refunds.com”. Stored page analysis classifies the content as crypto scam. Current evidence score: 95/100 (critical).

One source contains a positive finding: VirusTotal. VirusTotal recorded 16 detections among 93 engines: ADMINUSLabs, ChainPatrol, alphaMountain.ai, BitDefender, CRDF, CyRadar, ESET, Forcepoint ThreatSeeker, Fortinet, G-Data, Lionic, Seclookup, SOCRadar, Sophos, VIPRE, Webroot on Feb 23, 2026 at 12:37 UTC. Non-positive and contextual checks: The external blocklist snapshot contained no matches on Aug 7, 2026 at 22:20 UTC. URLQuery recorded no positive detection; no observation timestamp was retained. Google Safe Browsing returned no flag on Mar 3, 2026 at 04:14 UTC. URLScan completed without a malicious verdict (score 0) on Jul 29, 2026 at 03:21 UTC. PhishStats returned no feed match on Mar 2, 2026 at 09:00 UTC.

HTTP 502 was recorded on Aug 7, 2026 at 01:13 UTC; content was unavailable. The recorded creation date for the domain is Feb 21, 2026. Registration preceded first observation by 5 days. At collection time, the hostname resolved to 91.195.240.12 on AS47846 (SEDO-AS SEDO GmbH, DE). The recorded endpoint location is Stuttgart, DE. The stored server header is Parking/1.0. DOM analysis on Mar 24, 2026 at 01:21 UTC returned 73/100. The evidence archive retains 1 visual capture from PhishDestroy. TLS metadata lists Encryption Everywhere DV TLS CA - G2 as the certificate issuer with validity through Apr 28, 2026.

Stored content provides classification context, but only one source contains a positive finding.