coinbase-s[.]cc

PhishDestroy first observed coinbase-s.cc on Feb 26, 2026. The hostname explicitly references Coinbase; stored content metadata identifies the same apparent target. The captured page title is “coinbase-s.cc | 522: Connection timed out”. Stored page analysis classifies the content as crypto scam. Current evidence score: 78/100 (critical).

One source contains a positive finding: VirusTotal. VirusTotal recorded 9 detections among 95 engines: ADMINUSLabs, ChainPatrol, alphaMountain.ai, BitDefender, CyRadar, Forcepoint ThreatSeeker, Fortinet, G-Data, Seclookup on Jul 18, 2026 at 18:45 UTC. Non-positive and contextual checks: The separate external-blocklist snapshot contained no matches on Aug 8, 2026 at 14:20 UTC. Google Safe Browsing returned no flag on Mar 2, 2026 at 20:56 UTC. URLScan completed without a malicious verdict (score 0) on Jul 29, 2026 at 02:50 UTC.

The collector marked the hostname reachable on Aug 7, 2026 at 22:14 UTC, but did not retain the HTTP response code. Registration records for the domain list Global Domain Group LLC as the registrar and Feb 21, 2026 as the creation date. Registration preceded first observation by 5 days. At collection time, the hostname resolved to 188.114.97.3 on AS13335 (CLOUDFLARENET - Cloudflare, Inc., US). The IP and ASN identify shared Cloudflare edge infrastructure; the origin server is not established by this address. DOM analysis on Jul 27, 2026 at 02:20 UTC returned 78/100. The evidence archive retains 2 visual captures from PhishDestroy and URLScan. TLS metadata lists Google Trust Services / WE1 as the certificate issuer with validity through May 27, 2026; checked Mar 15, 2026 at 08:11 UTC.

Stored content provides classification context, but only one source contains a positive finding.