coin-time[.]space

PhishDestroy first observed coin-time.space on Feb 5, 2026. The captured page title is “COIN TIME - mining earn money usdt”. Current evidence score: 95/100 (critical).

Positive findings are stored from 2 sources: VirusTotal and DNS security resolvers. VirusTotal recorded 10 detections among 91 engines: ADMINUSLabs, alphaMountain.ai, BitDefender, Chong Lua Dao, CyRadar, Fortinet, G-Data, Gridinsoft, Lionic, Sophos on Jul 27, 2026 at 02:19 UTC. DNS security checks returned 3 blocking results across 14 tested policies: Control D Adblock, Control D Family, Control D Malware; no observation timestamp was retained. Non-positive and contextual checks: ScamAdviser assigned a trust score of 1/100 (Very Likely Unsafe); no observation timestamp was retained. AlienVault OTX listed 1 community pulse reference (not vendor detections) on Mar 1, 2026 at 10:09 UTC. The external blocklist snapshot contained no matches on Aug 8, 2026 at 02:20 UTC. URLQuery recorded no positive detection; no observation timestamp was retained. Google Safe Browsing returned no flag on Mar 2, 2026 at 20:28 UTC. URLScan completed without a malicious verdict (score 0) on Jul 29, 2026 at 02:54 UTC.

HTTP 200 was recorded on Aug 7, 2026 at 22:14 UTC. Registration records for the domain list NameCheap, Inc. as the registrar. At collection time, the hostname resolved to 198.54.116.81 on AS22612 (Namecheap, Inc.). The recorded endpoint location is Phoenix, US. The stored server header is LiteSpeed. DOM analysis on Jul 10, 2026 at 18:21 UTC returned 93/100. The evidence archive retains 2 visual captures from PhishDestroy and URLScan. TLS metadata lists Sectigo Public Server Authentication CA DV R36 as the certificate issuer with validity through Sep 27, 2026; checked Mar 15, 2026 at 05:53 UTC.

The content indicators and 2 positive source findings support the current phishing classification. The stored fields do not identify an impersonated brand or victim interaction.