# PhishDestroy domain threat record: 494145-coinbase.com Content language: English Canonical HTML report: https://phishdestroy.io/domain/494145-coinbase.com/ Machine-readable companion: https://phishdestroy.io/domain/494145-coinbase.com/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: unknown - First observed by PhishDestroy: 2026-10-26 11:41:09 UTC - Stored record updated: 2026-10-26 20:51:38 UTC - VirusTotal detections in the stored snapshot: 23/92 - Independent public blocklist matches in the stored snapshot: 1 - Matching public blocklists: OpenPhish - Google Safe Browsing stored result: flagged ## Stored classification - Targeted brand: Coinbase ## Stored infrastructure - Observed IP address: 216.245.184.250 - Registrar in stored WHOIS data: Dynadot Inc - Registration date in stored WHOIS data: 2025-10-29 21:52:38 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a176b1-903a-75a8-9773-680110b7f034/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/494145-coinbase.com - Certificate Transparency search: https://crt.sh/?q=%25.494145-coinbase.com - Web Archive lookup: https://web.archive.org/web/*/https://494145-coinbase.com/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored page captures - Primary capture: https://urlscan.io/screenshots/01a176b1-903a-75a8-9773-680110b7f034.png Captured: 2026-10-26 11:41:09 UTC - URLScan capture 1: https://screenshots.phishdestroy.io/01a176b1-903a-75a8-9773-680110b7f034.png Source report: https://urlscan.io/result/01a176b1-903a-75a8-9773-680110b7f034/ - URLScan · 2026-10-26: https://screenshots.phishdestroy.io/us/01a175b8-ebb1-71d8-ae0a-d4b60314b6fc.png Captured: 2026-10-26 01:00:21 UTC Source report: https://urlscan.io/result/01a175b8-ebb1-71d8-ae0a-d4b60314b6fc/ SHA-256: a78d34794426cbe7bdb9aa38fc02fc8687e736a09d93ea3bbfe2bb7aa884d2ee - URLScan · 2026-10-26: https://screenshots.phishdestroy.io/us/01a17679-f467-75ba-8044-b93909b84943.png Captured: 2026-10-26 04:31:12 UTC Source report: https://urlscan.io/result/01a17679-f467-75ba-8044-b93909b84943/ SHA-256: a78d34794426cbe7bdb9aa38fc02fc8687e736a09d93ea3bbfe2bb7aa884d2ee - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/5304dc76-d58a-4cd1-b12a-5cbf542a077e.png Captured: 2026-10-26 11:48:24 UTC Source report: https://radar.cloudflare.com/scan/5304dc76-d58a-4cd1-b12a-5cbf542a077e SHA-256: 5c8da174e520263ea624e8f655380ffa792433ea131cae602c0ce57d8388fc6d ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-26T11:50:34Z", "uuid": "01a176b1-903a-75a8-9773-680110b7f034", "scanned_at": "2026-10-26T05:32:07Z", "final_url": "http://494145-coinbase.com/wireless/step02.php", "status": 200, "redirected": "same-domain", "redirects": [ { "to": "https://494145-coinbase.com/", "from": "http://494145-coinbase.com/", "status": 307 }, { "to": "http://494145-coinbase.com/", "from": "https://494145-coinbase.com/", "status": 307 }, { "to": "http://494145-coinbase.com/wireless/step01.php", "from": "http://494145-coinbase.com/", "status": 302 }, { "to": "http://494145-coinbase.com/wireless/step02.php", "from": "http://494145-coinbase.com/wireless/step01.php" } ], "ip": "216.245.184.250", "ips": [ "216.245.184.250" ], "asns": [ "399629" ], "countries": [ "US" ], "link_domains": [ "www.att.com" ], "doc_hash": "b076acad8c5e456d1ac818fb95896ae0c20419873762f9a26994f85222604154", "script_hashes": [ "3e7501d15c3630e791c8b20392eb9dee31a9f65ce3efdde76cef5c710141ab24", "a106b0f8926e51c250f5055831c1673f12020d3fa1bfcfa4bb14f614dcd31a17" ], "globals": [ "$", "jQuery" ], "cookies": [ "token" ], "domain_age_days": 361, "apex_age_days": 361, "requests": 23, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 100, "malicious": true }, "overall": { "tags": [ "phishing" ], "score": 100, "brands": [ "att" ], "malicious": true, "categories": [ "phishing" ] }, "urlscan": { "tags": [ "phishing" ], "score": 100, "brands": [ "AT&T" ], "malicious": true, "categories": [ "phishing" ] } }, "headers": { "server": "Apache", "content-type": "text/html; charset=UTF-8" } }, "cf": { "v": 1, "fetched_at": "2026-10-26T11:59:08Z", "uuid": "5304dc76-d58a-4cd1-b12a-5cbf542a077e", "scanned_at": "2026-10-26T11:48:24Z", "final_url": "https://494145-coinbase.com/", "history": [ { "url": "https://494145-coinbase.com/", "status": 0 } ], "dom_hash": "222edc6576ce4f900a55dd02c5523f77c5fa64ee8b4e540f3ff8452026c169a8", "url_risks": [ "Phishing" ], "domain_risks": [ "Phishing", "Security threats", "CIPA Filter", "CIPA" ], "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "494145-coinbase.com", "type": "A", "value": "216.245.184.250" } ], "dnssec_valid": false, "verdict": { "tags": [ "phishing" ], "malicious": true, "categories": [ "phishing" ] }, "whois": { "registrar": "Dynadot Inc", "created": "2025-10-29T22:52:38Z", "updated": "2025-10-29T22:52:57Z", "expires": "2026-10-29T22:52:38Z", "nameservers": [ "ns1.dyna-ns.net", "ns2.dyna-ns.net" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-26T20:51:14Z", "analysis_at": "2026-10-26T17:04:56Z", "stats": { "timeout": 0, "harmless": 42, "malicious": 20, "suspicious": 3, "undetected": 27 }, "detections": { "DNS8": "suspicious", "ESET": "phishing", "VIPRE": "phishing", "Fortra": "phishing", "G-Data": "phishing", "Lionic": "phishing", "Sophos": "phishing", "CyRadar": "phishing", "Webroot": "malicious", "Emsisoft": "phishing", "Fortinet": "phishing", "Netcraft": "malicious", "SOCRadar": "suspicious", "URLQuery": "malicious", "OpenPhish": "phishing", "Gridinsoft": "suspicious", "MalwareURL": "phishing", "BitDefender": "phishing", "ChainPatrol": "malicious", "Chong Lua Dao": "malicious", "alphaMountain.ai": "phishing", "Google Safe Browsing": "phishing", "Forcepoint ThreatSeeker": "phishing" }, "reputation": 0, "tags": [ "dga" ], "created": "2025-10-29T00:00:00Z", "updated": "2025-10-29T00:00:00Z", "first_seen": "2025-10-29T23:27:21Z", "dns": [ { "ttl": 300, "type": "NS", "value": "ns2.dyna-ns.net" }, { "ttl": 300, "type": "NS", "value": "ns1.dyna-ns.net" }, { "ttl": 300, "type": "A", "value": "216.245.184.250" }, { "ttl": 300, "type": "SOA", "rname": "hostmaster.494145-coinbase.com", "value": "ns1.dyna-ns.net" } ], "dns_at": "2026-10-26T17:05:54Z", "jarm": "27d40d40d00040d00042d43d000000b5ce48eb9aaa95d750e8df42b900e12b", "cert": { "san": [ "ticket-att.com", "www.ticket-att.com" ], "issuer": "Let's Encrypt / YE2", "serial": "68c6dbdc920bd8a363dce5ce37fee5a3218", "sha256": "a6432c2b1838fd231e1269bd6ae456823c5c7c1534ebdccd7c33d3cab48a9342", "subject": "ticket-att.com", "valid_to": "2027-01-22T21:21:44Z", "valid_from": "2026-10-24T21:21:45Z" }, "whois": [], "rdap": { "status": [ "transfer prohibited" ], "events": { "expiration": "2026-10-29T22:52:38Z", "last changed": "2025-10-29T23:06:38Z", "registration": "2025-10-29T22:52:38Z", "registrar expiration": "2026-10-29T22:52:38Z", "last update of RDAP database": "2026-10-16T06:34:10Z" }, "registrar": "DYNADOT LLC", "registrar_iana_id": "472" } }, "webcheck": { "v": 1, "fetched_at": "2026-10-26T11:51:13Z", "mail_config": { "spf_lookups": 0 }, "caa_records": { "domain": "494145-coinbase.com" }, "block_lists": { "resolvers": 12, "blocked_by": [ "CloudFlare Family" ], "blocked_count": 1 }, "dns_server": { "ns": [ { "ip": "162.159.26.92", "host": "ns1.dyna-ns.net" }, { "ip": "162.159.24.5", "host": "ns2.dyna-ns.net" } ], "zone": "494145-coinbase.com" }, "location": { "ip": "216.245.184.250", "asn": "399629", "org": "BL Networks", "city": "Chicago", "country": "US" }, "dns": { "A": [ "216.245.184.250" ], "NS": [ "ns2.dyna-ns.net", "ns1.dyna-ns.net" ], "SOA": "{\"nsname\": \"ns1.dyna-ns.net\", \"hostmaster\": \"hostmaster.494145-coinbase.com\", \"serial\": 2026012001, \"refresh\": 16384, \"retry\": 2048, \"expire\": 1209600, \"minttl\": 300}" }, "dnssec": { "ds": false, "rrsig": false, "dnskey": false }, "get_ip": { "ip": "216.245.184.250", "family": 4 }, "whois": { "registrar": "Dynadot Inc", "created": "2025-10-29T22:52:38Z", "updated": "2025-10-29T22:52:57Z", "expires": "2026-10-29T22:52:38Z", "status": [ "clientTransferProhibited https://icann.org/epp" ], "nameservers": [ "ns1.dyna-ns.net", "ns2.dyna-ns.net" ] } } } ```