# PhishDestroy domain threat record: catcoin.ws

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/catcoin.ws/
Machine-readable companion: https://phishdestroy.io/domain/catcoin.ws/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: not observed active
- First observed by PhishDestroy: 2026-10-13 15:49:39 UTC
- Last availability or vendor check: 2026-10-21 22:32:48 UTC
- Stored record updated: 2026-10-22 14:21:28 UTC
- VirusTotal detections in the stored snapshot: 6/92
- Independent public blocklist matches in the stored snapshot: 2
- Matching public blocklists: MetaMask, SEAL
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: Solana

## Stored infrastructure

- Observed IP address: 188.114.97.3
- Registrar in stored WHOIS data: REGISTRAR_NOT_FOUND
- Registration date (registry RDAP, catcoin.ws): 2026-10-08 07:11:21 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a135f2-c3f7-7434-8dcd-f53fb4444dcd/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/catcoin.ws
- Certificate Transparency search: https://crt.sh/?q=%25.catcoin.ws
- Web Archive lookup: https://web.archive.org/web/*/https://catcoin.ws/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
catcoin.ws is a phishing page that impersonates Solana under the page title "Solana Claim." It targets Solana wallet holders who expect a token airdrop or reward. PhishDestroy first saw it on 2026-10-13. On 2026-10-19 the site was still online and serving its phishing content.

How the scam works
Fake "claim" pages promise free tokens and tell visitors to connect their wallet to collect them. The connect button leads to a transaction or approval that hands control of the victim's assets to the attacker. Some versions instead ask for a recovery phrase to "verify" the wallet. Either way, the victim gets no tokens and can lose the SOL and tokens in the connected wallet. A phrase typed into the page gives the attacker the whole wallet.

Evidence
On 2026-10-17, VirusTotal showed 6 of 92 engines flagging the domain: alphaMountain.ai, CRDF, Forcepoint ThreatSeeker, Fortinet, Gridinsoft and SOCRadar. That count is modest, so many browsers and security tools may still let the page load without a warning. Wallet-focused blocklists already list it, including MetaMask, SEAL and PhishDestroy. Spamhaus lists it in its domain blocklist under the phishing category (DBL_PHISH), and it appears in 4 AlienVault OTX threat pulses.

Infrastructure
The domain resolves to 188.114.97.3 on Cloudflare's network (AS13335, United States). This address belongs to Cloudflare's proxy layer, so it hides the server that actually hosts the page. The site uses a free Let's Encrypt certificate, so the padlock in the browser only means the connection is encrypted. It says nothing about whether the site is legitimate.

What to do
Do not connect a wallet or sign anything on catcoin.ws. If you already connected and approved a transaction, move your remaining assets to a fresh wallet right away and revoke any token delegations or permissions you granted from that session. If you typed your recovery phrase into the page, treat the wallet as compromised and move everything you can to a new wallet with a new phrase. Defenders should block the domain at DNS and web proxies and add it to wallet and browser protection lists. Report it to Cloudflare so the content can be taken down while it is still live.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a135f2-c3f7-7434-8dcd-f53fb4444dcd/
VirusTotal report: https://www.virustotal.com/gui/domain/catcoin.ws
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=catcoin.ws
Archived copy: https://web.archive.org/web/20261013155116/https://catcoin.ws/
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 09:25:11 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/NBdhf2v/7113e15c002f.png
  Captured: 2026-10-13 15:49:39 UTC
- URLScan capture: https://screenshots.phishdestroy.io/01a135f2-c3f7-7434-8dcd-f53fb4444dcd.png
  Captured: 2026-10-13 15:49:39 UTC
  Source report: https://urlscan.io/result/01a135f2-c3f7-7434-8dcd-f53fb4444dcd/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/245e857b-7258-47bc-be6f-6952d47bdb25.png
  Captured: 2026-10-13 16:21:10 UTC
  Source report: https://radar.cloudflare.com/scan/245e857b-7258-47bc-be6f-6952d47bdb25
  SHA-256: 39a9c054aed0b9ef6e4c8c4c9021843210bdb4feed8c0976598dfe80e6147252
- URLScan · 2026-10-13: https://screenshots.phishdestroy.io/us/01a135f7-7260-7439-873a-98a052f09b04.png
  Captured: 2026-10-13 15:52:59 UTC
  Source report: https://urlscan.io/result/01a135f7-7260-7439-873a-98a052f09b04/
  SHA-256: 38a1bcb9d3a6fd024ed8bf14b4ec5cb85b7dc6062ad7ad842a3b2fe2177c920c
- URLScan · 2026-10-14: https://screenshots.phishdestroy.io/us/01a13945-6a7e-723c-b924-f57228424d94.png
  Captured: 2026-10-14 07:17:00 UTC
  Source report: https://urlscan.io/result/01a13945-6a7e-723c-b924-f57228424d94/
  SHA-256: 38a1bcb9d3a6fd024ed8bf14b4ec5cb85b7dc6062ad7ad842a3b2fe2177c920c
- URLScan · 2026-10-17: https://screenshots.phishdestroy.io/us/01a14ba6-d057-752c-9b1b-54694a6d0827.png
  Captured: 2026-10-17 20:56:31 UTC
  Source report: https://urlscan.io/result/01a14ba6-d057-752c-9b1b-54694a6d0827/
  SHA-256: 38a1bcb9d3a6fd024ed8bf14b4ec5cb85b7dc6062ad7ad842a3b2fe2177c920c

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-20T17:48:29Z",
        "uuid": "01a135f2-c3f7-7434-8dcd-f53fb4444dcd",
        "scanned_at": "2026-10-13T15:47:50Z",
        "final_url": "https://catcoin.ws/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://catcoin.ws/",
                "from": "http://catcoin.ws/",
                "status": 307
            }
        ],
        "ip": "2a06:98c1:3120::3",
        "domains": [
            "cdn.jsdelivr.net"
        ],
        "ips": [
            "2606:4700::6811:cf05",
            "2a06:98c1:3120::3"
        ],
        "asns": [
            "13335"
        ],
        "countries": [
            "US"
        ],
        "doc_hash": "46078ec3cef0e5acacab74a2f750ebe01ff09de86d837765368a52f75a0de2eb",
        "globals": [
            "global",
            "process",
            "Buffer",
            "solanaWeb3"
        ],
        "tls": {
            "san": [
                "*.catcoin.ws",
                "catcoin.ws"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "YE2",
            "subject": "catcoin.ws",
            "protocol": "TLS 1.3",
            "valid_to": "2027-01-06T05:20:06Z",
            "valid_from": "2026-10-08T05:20:07Z"
        },
        "domain_age_days": 2,
        "apex_age_days": 2,
        "tls_age_days": 5,
        "tls_valid_days": 89,
        "requests": 3,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 99,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "cloudflare",
            "content-type": "text/html; charset=UTF-8"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-20T18:00:54Z",
        "uuid": "245e857b-7258-47bc-be6f-6952d47bdb25",
        "scanned_at": "2026-10-13T16:21:10Z",
        "final_url": "https://catcoin.ws/",
        "status": 200,
        "history": [
            {
                "url": "https://catcoin.ws/",
                "status": 200
            }
        ],
        "dom_hash": "a8d7ba2bd36137aa0dd2482fb3b06f5f901b0ce2cdf1e6ad71d2644f4c92cb96",
        "doc_hash": "76a4ca9fe1d6a611a5e04cd05711693d167484af164802a0b595d1128dbe79fa",
        "domain_risks": [
            "Newly Seen Domains",
            "Security Risks"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "catcoin.ws",
                "type": "A",
                "value": "104.21.21.97"
            },
            {
                "name": "catcoin.ws",
                "type": "A",
                "value": "172.67.197.168"
            },
            {
                "name": "catcoin.ws",
                "type": "AAAA",
                "value": "2606:4700:3031::6815:1561"
            },
            {
                "name": "catcoin.ws",
                "type": "AAAA",
                "value": "2606:4700:3031::ac43:c5a8"
            }
        ],
        "dnssec_valid": false,
        "ip": "104.21.21.97",
        "whois": {
            "registrar": "NameSilo, LLC",
            "created": "2026-10-08T07:11:21Z",
            "updated": "2026-10-08T07:13:29Z",
            "expires": "2027-10-08T07:11:21Z",
            "nameservers": [
                "aleena.ns.cloudflare.com",
                "toby.ns.cloudflare.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-20T21:12:51Z",
        "analysis_at": "2026-10-19T17:14:06Z",
        "stats": {
            "timeout": 0,
            "harmless": 52,
            "malicious": 3,
            "suspicious": 3,
            "undetected": 34
        },
        "detections": {
            "CRDF": "malicious",
            "Fortinet": "spam",
            "SOCRadar": "phishing",
            "Gridinsoft": "suspicious",
            "alphaMountain.ai": "phishing",
            "Forcepoint ThreatSeeker": "spam"
        },
        "reputation": 0,
        "registrar": "NameSilo, LLC",
        "created": "2026-10-08T07:11:21Z",
        "updated": "2026-10-08T07:13:29Z",
        "first_seen": "2026-10-08T08:52:58Z",
        "dns": [
            {
                "ttl": 21600,
                "type": "NS",
                "value": "aleena.ns.cloudflare.com"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "toby.ns.cloudflare.com"
            },
            {
                "ttl": 1800,
                "type": "SOA",
                "rname": "dns.cloudflare.com",
                "value": "aleena.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3031::ac43:c5a8"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "172.67.197.168"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3031::6815:1561"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "104.21.21.97"
            }
        ],
        "dns_at": "2026-10-19T17:14:38Z",
        "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c",
        "cert": {
            "san": [
                "*.catcoin.ws",
                "catcoin.ws"
            ],
            "issuer": "Let's Encrypt / YE2",
            "serial": "6604756ec7008fea7afd186c001dce90b23",
            "sha256": "e107d8ac928bcd3effae7e1130961db3d037f25e23b9b42ca5667c41d81492a6",
            "subject": "catcoin.ws",
            "valid_to": "2027-01-06T05:20:06Z",
            "valid_from": "2026-10-08T05:20:07Z"
        },
        "whois": {
            "registrar": "NameSilo, LLC",
            "registrar_iana_id": "1479",
            "registrar_url": "https://www.namesilo.com/",
            "created": "2026-10-07T07:00:00Z",
            "updated": "2026-10-08T07:00:00Z",
            "expires": "2027-10-08T07:00:00Z",
            "status": [
                "client",
                "clientTransferProhibited",
                "serverTransferProhibited"
            ],
            "nameservers": [
                "aleena.ns.cloudflare.com",
                "toby.ns.cloudflare.com"
            ],
            "dnssec": "unsigned"
        }
    }
}
```