# PhishDestroy domain threat record: 97ee1.ralind.at

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/97ee1.ralind.at/
Machine-readable companion: https://phishdestroy.io/domain/97ee1.ralind.at/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-09-06 12:57:02 UTC
- Last availability or vendor check: 2026-10-22 10:11:54 UTC
- Stored record updated: 2026-10-22 16:07:29 UTC
- VirusTotal detections in the stored snapshot: 15/89
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: coinbase

## Stored infrastructure

- Observed IP address: 31.59.121.53
- Registrar in stored WHOIS data: helloly GmbH ( https://nic.at/registrar/743 )
- Registrar country in stored WHOIS data: AUSTRIA
- Last stored HTTP status: 301

## Evidence links

- URLScan report: https://urlscan.io/result/01a076ca-4a57-76bd-a039-6b10487ddac6/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/97ee1.ralind.at
- Certificate Transparency search: https://crt.sh/?q=%25.97ee1.ralind.at
- Web Archive lookup: https://web.archive.org/web/*/https://97ee1.ralind.at/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
97ee1.ralind.at is an impersonation phishing page that poses as Coinbase, presenting itself under the title 'Coinbase Card' to lure Coinbase customers interested in the exchange's debit card. PhishDestroy first flagged it on 2026-09-06. As of 2026-10-19 the site was still alive, and visiting it led to a redirect, so the domain remains an active entry point rather than a dead page.

How the scam works
Pages styled as a Coinbase Card offer typically invite the visitor to sign in, activate or claim the card, then capture whatever is typed: email, password, one-time 2FA codes, and sometimes identity or payment details. With a live login and code in hand, attackers can enter the real Coinbase account, change security settings and move funds out before the owner notices. The card theme gives a plausible reason to ask for sensitive verification data that a plain login page would not.

Evidence
Fifteen of 89 VirusTotal engines flagged the domain on 2026-09-20, including BitDefender, ESET, Fortinet, Forcepoint ThreatSeeker, G-Data, Emsisoft, CRDF and alphaMountain.ai, a spread of independent vendors rather than a single outlier. urlscan.io rated the page malicious and recognised Coinbase branding on it. Spamhaus lists the domain in its DBL as phishing, and it is on the PhishDestroy blocklist.

Infrastructure
The page runs on a random-looking subdomain of ralind.at, an Austrian domain registered through helloly GmbH, a pattern that lets an operator spin up disposable hostnames under one parent domain. It is hosted in France on AS56971 Cloud. Its Let's Encrypt certificate means the browser padlock appears normally, which tells visitors nothing about whether the page is genuine Coinbase.

What to do
If you entered your Coinbase credentials here, change your password at once through the official app or site, reset your 2FA, and sign out all other sessions. Review recent logins, withdrawals, linked devices and address allowlists, and contact Coinbase support if anything looks unfamiliar. If you submitted card numbers or ID documents, alert your bank and watch for identity misuse. Defenders should block 97ee1.ralind.at and consider blocking the wider ralind.at domain, given its use of throwaway subdomains.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a076ca-4a57-76bd-a039-6b10487ddac6/
VirusTotal report: https://www.virustotal.com/gui/domain/97ee1.ralind.at
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=97ee1.ralind.at
Archived copy: https://web.archive.org/web/20260917002856/https://97ee1.ralind.at/
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 10:58:34 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/cfwsDPX/f3763b244bb7.png
  Captured: 2026-09-06 12:57:02 UTC
- URLScan capture: https://screenshots.phishdestroy.io/01a076ca-4a57-76bd-a039-6b10487ddac6.png
  Captured: 2026-09-06 12:57:02 UTC
  Source report: https://urlscan.io/result/01a076ca-4a57-76bd-a039-6b10487ddac6/
- URLQuery: https://screenshots.phishdestroy.io/uq/e4b7a95d-3d20-4476-9c4b-e32b899208c4.png
  Captured: 2026-09-06 13:02:36 UTC
  Source report: https://urlquery.net/report/e4b7a95d-3d20-4476-9c4b-e32b899208c4
  SHA-256: dc0e5ac267d061b8803681fb1db1a5d22af51809579184cfde26650d15abb8c3
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/17cbe0ce-d45b-4c1c-bdc3-405f65667677.png
  Captured: 2026-09-06 13:39:42 UTC
  Source report: https://radar.cloudflare.com/scan/17cbe0ce-d45b-4c1c-bdc3-405f65667677
  SHA-256: 935028bafaad4c1e24ba46156bb71738a0f7a5696a470d41937dc8cf2b4da172
- URLScan · 2026-08-27: https://screenshots.phishdestroy.io/us/01a0434e-fcf6-76a9-aa0a-308dcc5f20c0.png
  Captured: 2026-08-27 13:00:51 UTC
  Source report: https://urlscan.io/result/01a0434e-fcf6-76a9-aa0a-308dcc5f20c0/
  SHA-256: 3a6732196568cdd870bcab77203830e3e253e4d9fece83c038153bfd042231cb
- URLScan · 2026-09-10: https://screenshots.phishdestroy.io/us/01a08b6a-354a-75a8-924b-1e67624766de.png
  Captured: 2026-09-10 13:03:14 UTC
  Source report: https://urlscan.io/result/01a08b6a-354a-75a8-924b-1e67624766de/
  SHA-256: 8d1aa066f12fa64c7a2b341b3d0be3e471ac15c0019e99d0cc240821dc222540
- URLScan · 2026-09-29: https://screenshots.phishdestroy.io/us/01a0ee12-18bc-728d-9a56-47dc9641e4f0.png
  Captured: 2026-09-29 16:49:31 UTC
  Source report: https://urlscan.io/result/01a0ee12-18bc-728d-9a56-47dc9641e4f0/
  SHA-256: bad60947e3ebd280b5b59fe553ce7b84c1ec43178a336ad349e318e610066a68
- URLScan · 2026-10-07: https://screenshots.phishdestroy.io/us/01a113e1-5e91-70bf-94ef-4c41f21a6432.png
  Captured: 2026-10-07 01:01:45 UTC
  Source report: https://urlscan.io/result/01a113e1-5e91-70bf-94ef-4c41f21a6432/
  SHA-256: 47a8f2aa47a81fd0ff11abedf7d243461be9e6058d712c28d59d18c851490fee
- URLScan · 2026-10-13: https://screenshots.phishdestroy.io/us/01a1355e-1735-738b-9199-8ecea8941628.png
  Captured: 2026-10-13 13:05:34 UTC
  Source report: https://urlscan.io/result/01a1355e-1735-738b-9199-8ecea8941628/
  SHA-256: 8d1aa066f12fa64c7a2b341b3d0be3e471ac15c0019e99d0cc240821dc222540
- URLScan · 2026-10-20: https://screenshots.phishdestroy.io/us/01a15993-6433-7469-b6ff-ba6d1df122a4.png
  Captured: 2026-10-20 13:50:00 UTC
  Source report: https://urlscan.io/result/01a15993-6433-7469-b6ff-ba6d1df122a4/
  SHA-256: 08ad6366b147f4543b28227837c5475d39d525a799ccfccd72c2bcca633735ae

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-21T03:48:22Z",
        "uuid": "01a076ca-4a57-76bd-a039-6b10487ddac6",
        "scanned_at": "2026-09-06T12:56:11Z",
        "final_url": "https://97ee1.ralind.at/cnbcard/signin.php",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://97ee1.ralind.at/cnbcard/signin.php",
                "from": "http://97ee1.ralind.at/cnbcard/signin.php",
                "status": 307
            }
        ],
        "ip": "31.59.121.53",
        "domains": [
            "cdnjs.cloudflare.com",
            "cdn.tailwindcss.com",
            "images.ctfassets.net"
        ],
        "ips": [
            "13.225.196.110",
            "104.17.25.14",
            "104.26.2.143",
            "31.59.121.53"
        ],
        "asns": [
            "16509",
            "13335",
            "56971"
        ],
        "countries": [
            "US",
            "FR"
        ],
        "doc_hash": "66c2991e307a38a13e91969747a92aaef7e1848e773232ef5206e5e21954698f",
        "script_hashes": [
            "9fc4de3632844cd0d933464afb34d27818101adb004e95f4a6f60e861a0eda42",
            "dd6b787ac7959f74254fb0da4d1de07fb8c7c5310eebffbfec28b88ce2e610ee"
        ],
        "globals": [
            "page_id",
            "CRedirectName",
            "redirectLastPage",
            "cookee_page_id",
            "pages",
            "getCookie",
            "setCookie",
            "readCookie",
            "redirectPage",
            "load",
            "init",
            "notificationHideShow",
            "notificationHideInt",
            "notificationShow",
            "notificationHide",
            "isAddNotificationPage",
            "addNotificationPage",
            "tailwind",
            "/template.html",
            "isValidEmail",
            "navigateForward2",
            "emailInput",
            "form",
            "errorMessage"
        ],
        "storage_keys": [
            "page_id_mist"
        ],
        "tls": {
            "san": [
                "*.ralind.at",
                "ralind.at"
            ],
            "cipher": "AES_256_GCM",
            "issuer": "YR2",
            "subject": "ralind.at",
            "protocol": "TLS 1.3",
            "valid_to": "2026-10-06T09:54:20Z",
            "valid_from": "2026-07-08T09:54:21Z"
        },
        "domain_age_days": 10,
        "apex_age_days": 144,
        "tls_age_days": 60,
        "tls_valid_days": 89,
        "requests": 9,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 98,
                "malicious": true
            },
            "overall": {
                "tags": [
                    "phishing"
                ],
                "score": 100,
                "brands": [
                    "coinbase"
                ],
                "malicious": true,
                "categories": [
                    "phishing"
                ]
            },
            "urlscan": {
                "tags": [
                    "phishing"
                ],
                "score": 100,
                "brands": [
                    "Coinbase"
                ],
                "malicious": true,
                "categories": [
                    "phishing"
                ]
            }
        },
        "headers": {
            "server": "nginx",
            "content-type": "text/html; charset=UTF-8"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-21T03:59:20Z",
        "uuid": "17cbe0ce-d45b-4c1c-bdc3-405f65667677",
        "scanned_at": "2026-09-06T13:39:42Z",
        "final_url": "https://97ee1.ralind.at/",
        "status": 200,
        "history": [
            {
                "url": "https://97ee1.ralind.at/",
                "status": 200
            }
        ],
        "dom_hash": "a7fe83ec64bb23eb28090598db3d166ed98e52e39d1afbbfd74c579553f93e4e",
        "doc_hash": "5f04ae9ed6a865bb382c66ef4bd4e57df4ce19d4142b8c87ac40d65ae54d278f",
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "97ee1.ralind.at",
                "type": "A",
                "value": "31.59.121.53"
            }
        ],
        "dnssec_valid": false,
        "ip": "31.59.121.53"
    }
}
```