# coda-rwx.event-en.de — Recorded security evidence | PhishDestroy Content language: English Canonical HTML report: https://phishdestroy.io/domain/coda-rwx.event-en.de/ Machine-readable companion: https://phishdestroy.io/domain/coda-rwx.event-en.de/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: Unverified - First observed by PhishDestroy: 2026-10-26 11:40:28 UTC - Selected availability observation: 2026-11-08T00:10:47Z - Stored record updated: 2026-11-08 05:00:54 UTC - VirusTotal detections in the stored snapshot: 23/92 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: checked_clean ## Stored labels and detections - Automated brand label (collector metadata; not a confirmed impersonation finding): cash app ## Stored infrastructure - Observed IP address: 103.30.194.195 - Registrar in stored WHOIS data: REGISTRAR_NOT_FOUND ## Evidence links - URLScan report: https://urlscan.io/result/01a176fd-cd41-74a9-9e9e-44827187bc87/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/coda-rwx.event-en.de - Certificate Transparency search: https://crt.sh/?q=%25.coda-rwx.event-en.de - Web Archive lookup: https://web.archive.org/web/*/https://coda-rwx.event-en.de/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Public report package PhishDestroy stores a record for coda-rwx.event-en.de. Source observations are dated separately; missing checks do not establish safety. PhishDestroy stores a record for coda-rwx.event-en.de. Source observations are dated separately; missing checks do not establish safety. A reviewed analysis is not available for this text revision. Consult the dated source records below. Package revision: 9932d9cd4327838845fd1496c443809638d034ab5a9e4eb831854e06dfd50f98 Source facts (timestamps as stored): {"record_id":1670117,"first_recorded_at":"2026-10-26 12:40:28","virustotal":{"source":"VirusTotal","scope":"unknown","result_state":"complete","numerator":23,"denominator":92,"malicious":20,"suspicious":3,"vendors":{"CRDF":"malicious","DNS8":"suspicious","ESET":"suspicious","Ermes":"phishing","VIPRE":"phishing","G-Data":"phishing","Lionic":"phishing","Sophos":"phishing","CyRadar":"phishing","Webroot":"malicious","Emsisoft":"phishing","Fortinet":"phishing","Netcraft":"malicious","SOCRadar":"suspicious","URLQuery":"malicious","Kaspersky":"phishing","LevelBlue":"phishing","OpenPhish":"phishing","Gridinsoft":"phishing","MalwareURL":"phishing","BitDefender":"phishing","alphaMountain.ai":"phishing","Forcepoint ThreatSeeker":"phishing"},"observed_at":"2026-10-26T10:28:24Z","checked_at":null,"fetched_at":"2026-10-26T11:41:19Z","time_basis":"UTC (provider ISO timestamps)","stored_summary":{"source":"VirusTotal","scope":"unknown","result_state":"observed","numerator":23,"denominator":92,"malicious":null,"suspicious":null,"vendors":["alphaMountain.ai","BitDefender","CRDF","CyRadar","DNS8","Ermes","ESET","Emsisoft","Forcepoint ThreatSeeker","Fortinet","G-Data","Gridinsoft","Kaspersky","LevelBlue","Lionic","MalwareURL","Netcraft","OpenPhish","SOCRadar","Sophos","URLQuery","VIPRE","Webroot"],"observed_at":"2026-10-26 10:28:24","checked_at":"2026-10-26 12:41:21","fetched_at":"2026-10-26 11:41:21","time_basis":"as stored; legacy timezone not established"},"record_source":"phishdestroy.technologies.vt","vendor_labels":{"CRDF":"malicious","DNS8":"suspicious","ESET":"suspicious","Ermes":"phishing","VIPRE":"phishing","G-Data":"phishing","Lionic":"phishing","Sophos":"phishing","CyRadar":"phishing","Webroot":"malicious","Emsisoft":"phishing","Fortinet":"phishing","Netcraft":"malicious","SOCRadar":"suspicious","URLQuery":"malicious","Kaspersky":"phishing","LevelBlue":"phishing","OpenPhish":"phishing","Gridinsoft":"phishing","MalwareURL":"phishing","BitDefender":"phishing","alphaMountain.ai":"phishing","Forcepoint ThreatSeeker":"phishing"},"vendor_names":["CRDF","DNS8","ESET","Ermes","VIPRE","G-Data","Lionic","Sophos","CyRadar","Webroot","Emsisoft","Fortinet","Netcraft","SOCRadar","URLQuery","Kaspersky","LevelBlue","OpenPhish","Gridinsoft","MalwareURL","BitDefender","alphaMountain.ai","Forcepoint ThreatSeeker"],"stats":{"timeout":0,"harmless":41,"malicious":20,"suspicious":3,"undetected":28}},"google_safe_browsing":{"source":"Google Safe Browsing","state":"checked_clean","verdict":0,"checked_at":"2026-11-08 06:00:54"},"spamhaus":{"source":"Spamhaus","verdict":null,"checked_at":"2026-10-26 16:30:23"},"availability":{"state":"unknown","label_key":"availability.unverified","detail_key":"detail.no_response","params":[],"source":"current_http_probe","record_id":1670117,"scope":"checked_url","observed_at":"2026-11-08T00:10:47Z","http_status":null,"http_observed_at":"2026-11-08T00:10:47Z","stored_http_code":0,"stored_http_observed_at":"2026-11-08T00:10:47Z","legacy_site_status":"alive","supports_outcome_badge":false,"content_classification":"unreachable","content_classification_at":null,"registration_state":"unknown","policy":"20261102-dated-availability-v2"}} ## Stored page captures - URLScan · 2026-10-26: https://screenshots.phishdestroy.io/01a176fd-cd41-74a9-9e9e-44827187bc87.png Captured: 2026-10-26 06:55:22 UTC Source report: https://urlscan.io/result/01a176fd-cd41-74a9-9e9e-44827187bc87/ - URLScan · 2026-10-26: https://screenshots.phishdestroy.io/us/01a175bb-1589-7298-8aca-3e7c7141b881.png Captured: 2026-10-26 01:02:52 UTC Source report: https://urlscan.io/result/01a175bb-1589-7298-8aca-3e7c7141b881/ SHA-256: f65b89a316576c25dd19c8e3ea822e3c535e778e68641bbeec62c9489948c306 - URLScan · 2026-10-26: https://screenshots.phishdestroy.io/us/01a1768a-8be4-75f9-a6a7-e7935b4953c3.png Captured: 2026-10-26 04:51:00 UTC Source report: https://urlscan.io/result/01a1768a-8be4-75f9-a6a7-e7935b4953c3/ SHA-256: 584e773354fcbc65dffdfa194501acbfd37fd47f0d4c067ab0b3d33a77070c8c - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/f4e2ec8f-6e1f-4f28-a42c-a9b5e581d017.png Captured: 2026-10-26 11:42:31 UTC Source report: https://radar.cloudflare.com/scan/f4e2ec8f-6e1f-4f28-a42c-a9b5e581d017 SHA-256: eb80f12f63f463f460def1928dd3a95a1abcb3eefdd7dc44f74369e9a65841b3 ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-26T11:43:15Z", "uuid": "01a176fd-cd41-74a9-9e9e-44827187bc87", "scanned_at": "2026-10-26T06:55:22Z", "final_url": "https://coda-rwx.event-en.de/", "status": 200, "redirected": "https-only", "redirects": [ { "to": "https://coda-rwx.event-en.de/", "from": "http://coda-rwx.event-en.de/", "status": 307 } ], "ip": "103.30.194.195", "ptr": "ezzy2.planete.my.id", "domains": [ "cdn1.codashop.com", "d1qgcmfii0ptfa.cloudfront.net", "cdnjs.cloudflare.com", "cdn.tailwindcss.com", "ph.support.codashop.com", "code.jquery.com" ], "ips": [ "216.198.54.11", "18.64.181.212", "18.66.102.6", "104.17.25.14", "2606:4700:20::ac43:440b", "2a04:4e42::411", "103.30.194.195" ], "asns": [ "209242", "16509", "13335", "54113", "138608" ], "countries": [ "US", "ID" ], "link_domains": [ "www.codashop.com", "apps.apple.com", "play.google.com", "www.coda.co", "us.support.codashop.com", "portal.coda.co", "www.facebook.com", "twitter.com", "instagram.com", "www.tiktok.com", "news.codashop.com", "marketing.codashop.com", "share-na2.hsforms.com" ], "social": [ "https://www.facebook.com/Codashop.us", "https://twitter.com/codashop_us", "https://instagram.com/codashop_us", "https://www.tiktok.com/@codashop_us" ], "doc_hash": "443d34f258b407e888f09907eca104aaf8e70dac0af7dc69e54be8474558f838", "script_hashes": [ "5c2b6516f1d7518a0eae2c5b2fba2d5e9d90e6a4dbba24b5489fd410b96a5d16", "f0e9d977d44333be10d849221763b7998ab2ff78ba5173c9782b7bb23dd641ca", "283150fad932293e0c1c01f591069874f58d3d62f61c3bc78e0cdf026a69e2ce", "329fd45c1e6a127fe41227e229698737b8f58034a8c92a0cff7dcd0274118f9a", "7ec6a16cb41da94e1b2bf13aa031c3a450bd5bca8a9dd6e729e3634241f85aa0", "0841dbea0247f60098c688d5dce0377373889e36f3d9e0eefa2a1e308ed8b8d7", "f0fc92ea037550a30b70ed3033f047fd9778386b3b7b70608deac436970fcbdf", "f74441719b1877d5497ead9357ccf15cace94aea4f73882d818ccd04a2438f18", "bac26bca83c1d803fbe728dc755a23adabba22907f661a9a76b0561a56c5e4c5", "8704702d0072efefb9170221dd7e5cf769746fab839cc149c7bc0c4a9f3405fb" ], "globals": [ "$", "jQuery", "tailwind", "/template.html", "tutupReward", "bukaReward", "tutupMt", "openVerificationModal", "checkoutState" ], "cookies": [ "__cf_bm", "_cfuvid" ], "tls": { "san": [ "coda-rwx.event-en.de" ], "cipher": "AES_128_GCM", "issuer": "YR2", "subject": "coda-rwx.event-en.de", "protocol": "TLS 1.3", "valid_to": "2027-01-21T07:36:00Z", "valid_from": "2026-10-23T07:36:01Z" }, "domain_age_days": 0, "apex_age_days": 32, "tls_age_days": 2, "tls_valid_days": 89, "requests": 177, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 98, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "Apache", "content-type": "text/html; charset=UTF-8" } }, "cf": { "v": 1, "fetched_at": "2026-10-26T11:43:17Z", "uuid": "f4e2ec8f-6e1f-4f28-a42c-a9b5e581d017", "scanned_at": "2026-10-26T11:42:31Z", "final_url": "https://coda-rwx.event-en.de/", "status": 200, "history": [ { "url": "https://coda-rwx.event-en.de/", "status": 200 } ], "dom_hash": "d47c6ac00b270c3ef6a0dc2124238d31a2e3050fef345fb405dd09fc3e552bff", "doc_hash": "443d34f258b407e888f09907eca104aaf8e70dac0af7dc69e54be8474558f838", "phishing_v2": [ "phishing" ], "domain_risks": [ "Phishing", "Security threats", "CIPA Filter", "CIPA" ], "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "coda-rwx.event-en.de", "type": "A", "value": "103.30.194.195" } ], "dnssec_valid": false, "ip": "103.30.194.195", "verdict": { "tags": [ "phishing" ], "malicious": true, "categories": [ "phishing" ] }, "whois": { "updated": "2026-09-23T07:45:27Z", "nameservers": [ "ns2.inwx.com", "ns3.inwx.eu", "ns.inwx.com" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-26T11:41:19Z", "analysis_at": "2026-10-26T10:28:24Z", "stats": { "timeout": 0, "harmless": 41, "malicious": 20, "suspicious": 3, "undetected": 28 }, "detections": { "CRDF": "malicious", "DNS8": "suspicious", "ESET": "suspicious", "Ermes": "phishing", "VIPRE": "phishing", "G-Data": "phishing", "Lionic": "phishing", "Sophos": "phishing", "CyRadar": "phishing", "Webroot": "malicious", "Emsisoft": "phishing", "Fortinet": "phishing", "Netcraft": "malicious", "SOCRadar": "suspicious", "URLQuery": "malicious", "Kaspersky": "phishing", "LevelBlue": "phishing", "OpenPhish": "phishing", "Gridinsoft": "phishing", "MalwareURL": "phishing", "BitDefender": "phishing", "alphaMountain.ai": "phishing", "Forcepoint ThreatSeeker": "phishing" }, "reputation": 0, "first_seen": "2026-10-23T08:41:19Z", "dns": [ { "ttl": 3600, "type": "A", "value": "103.30.194.195" } ], "dns_at": "2026-10-26T10:28:52Z", "jarm": "15d3fd16d29d29d00042d43d0000001ae0802418786940cae38f1d9eed5b9b", "cert": { "san": [ "coda-rwx.event-en.de" ], "issuer": "Let's Encrypt / YR2", "serial": "6ba205a69f6d1fb9036f21067b70199f2fd", "sha256": "b66913bda510b72ca6e0becc4c9ec901c381a418e6727d3ad0c9a738d5105d14", "subject": "coda-rwx.event-en.de", "valid_to": "2027-01-21T07:36:00Z", "valid_from": "2026-10-23T07:36:01Z" } }, "webcheck": { "v": 1, "fetched_at": "2026-10-26T11:43:59Z", "caa_records": { "domain": "coda-rwx.event-en.de" }, "block_lists": { "resolvers": 12, "blocked_by": [ "CloudFlare Family" ], "blocked_count": 1 }, "status": { "up": true, "code": 200, "timings": { "dns": 14190, "tls": 207, "wait": 246, "connect": 1262, "download": 799 }, "response_ms": 16704 }, "dns_server": { "ns": [ { "ip": "176.97.158.104", "host": "b.xnameserver.de" }, { "ip": "45.87.158.53", "host": "c.xnameserver.de" }, { "ip": "192.174.68.104", "host": "a.xnameserver.de" } ], "zone": "event-en.de" }, "dns": { "A": [ "103.30.194.195" ] } } } ``` ## Complete dated records Availability observations: https://phishdestroy.io/domain/coda-rwx.event-en.de/records.json?source=availability&format=json Source observation history: https://phishdestroy.io/domain/coda-rwx.event-en.de/records.json?source=detections&format=json PhishStats records: https://phishdestroy.io/domain/coda-rwx.event-en.de/records.json?source=phishstats&format=json Sent report records: https://phishdestroy.io/domain/coda-rwx.event-en.de/records.json?source=sent_reports&format=json Report history: https://phishdestroy.io/domain/coda-rwx.event-en.de/records.json?source=report_history&format=json Repeat report records: https://phishdestroy.io/domain/coda-rwx.event-en.de/records.json?source=rereports&format=json Follow-up records: https://phishdestroy.io/domain/coda-rwx.event-en.de/records.json?source=followups&format=json Content observations: https://phishdestroy.io/domain/coda-rwx.event-en.de/records.json?source=content&format=json ## Dated availability observation No conclusive current response is stored ```json { "state": "unknown", "label_key": "availability.unverified", "detail_key": "detail.no_response", "params": [], "source": "current_http_probe", "record_id": 1670117, "scope": "checked_url", "observed_at": "2026-11-08T00:10:47Z", "http_status": null, "http_observed_at": "2026-11-08T00:10:47Z", "stored_http_code": 0, "stored_http_observed_at": "2026-11-08T00:10:47Z", "legacy_site_status": "alive", "supports_outcome_badge": false, "content_classification": "unreachable", "content_classification_at": null, "registration_state": "unknown", "policy": "20261102-dated-availability-v2" } ```