invoice-coinbase[.]com

PhishDestroy first observed invoice-coinbase.com on Feb 26, 2026. The hostname explicitly references Coinbase; stored content metadata identifies the same apparent target. The captured page title is “AMLBot - Comprehensive Crypto Compliance Solution | Free AML Crypto Check”. Stored page analysis classifies the content as crypto scam. Current evidence score: 68/100 (high).

One source contains a positive finding: VirusTotal. VirusTotal recorded 6 detections among 95 engines: alphaMountain.ai, BitDefender, CyRadar, Fortinet, G-Data, Webroot on Feb 23, 2026 at 07:13 UTC. Non-positive and contextual checks: The external blocklist snapshot contained no matches on Aug 7, 2026 at 22:20 UTC. URLQuery recorded no positive detection; no observation timestamp was retained. Google Safe Browsing returned no flag on Mar 3, 2026 at 04:14 UTC. URLScan completed without a malicious verdict (score 0) on Jul 29, 2026 at 03:16 UTC.

HTTP 502 was recorded on Aug 7, 2026 at 01:18 UTC; content was unavailable. The recorded creation date for the domain is Feb 21, 2026. Registration preceded first observation by 5 days. At collection time, the hostname resolved to 45.89.110.15 on AS44477 (THE-HOSTING PQ HOSTING PLUS S.R.L., MD). The recorded endpoint location is Meppel, NL. The stored server header is nginx/1.24.0 (Ubuntu). DOM analysis on Mar 23, 2026 at 23:11 UTC returned 63/100. The evidence archive retains 2 visual captures from PhishDestroy and URLScan. TLS metadata lists E6 as the certificate issuer.

Stored content provides classification context, but only one source contains a positive finding.