# PhishDestroy domain threat record: coordinacionnacional.org Content language: English Canonical HTML report: https://phishdestroy.io/domain/coordinacionnacional.org/ Machine-readable companion: https://phishdestroy.io/domain/coordinacionnacional.org/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-10-25 07:16:53 UTC - Last availability or vendor check: 2026-10-26 00:19:18 UTC - Stored record updated: 2026-10-26 00:19:18 UTC - VirusTotal detections in the stored snapshot: 0/92 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: no stored flag ## Stored infrastructure - Observed IP address: 166.117.246.71 - Registrar in stored WHOIS data: Name.com, Inc. - Last stored HTTP status: 301 - Registration date in stored WHOIS data: 2025-04-04 16:10:41 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a171e9-863a-76dc-a8ba-be71353d33ca/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/coordinacionnacional.org - Certificate Transparency search: https://crt.sh/?q=%25.coordinacionnacional.org - Web Archive lookup: https://web.archive.org/web/*/https://coordinacionnacional.org/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview PhishDestroy’s intake AI assigned a malicious verdict because the recorded page presented itself as a “National Anti‑Fraud Campaign” offering free legal advice, a pattern typical of advance‑fee scams. The recorded page title and excerpt matched this claim. The domain was first seen by PhishDestroy on 2026-10-25 and returned an HTTP 301 redirect to the www subdomain on that date. How the scam works Scammers create sites that mimic official anti‑fraud or government initiatives and promise free legal assistance to victims of digital fraud. The promise of no‑cost help is used to collect personal information or to pressure victims into paying fees, after which the scammers disappear with the data or money. Evidence VirusTotal scanned the domain on 2026-09-09 with 92 engines and reported 0 malicious and 0 suspicious detections. Google Safe Browsing checked on 2026-10-25 and did not flag the site. OTX listed two pulses for the domain as of 2026-10-25. URLScan captured the page on 2026-10-25; its machine‑learning engine marked it malicious with a score of 65, while the overall URLScan verdict was not malicious. PhishDestroy’s internal blocklist contained the domain, whereas external blocklists and Spamhaus reported no listings on 2026-10-25. Infrastructure Registration data retrieved on 2026-10-25 showed the domain was created on 2025-04-04 through Name.com, Inc., giving it an age of 569 days at first sight. DNS records observed on that date listed two A records (166.117.246.71 and 75.2.29.147) and CNAME records for www pointing to a landing‑page service. The site used a Let’s Encrypt TLS certificate valid until 2026-12-19 and was fronted by Cloudflare, which provided a web‑application firewall. What to do Visitors should not provide personal information or pay any fees to the site; if they have already submitted data, they should change passwords on affected accounts and monitor for suspicious activity. Defenders should block coordinacionnacional.org at the network perimeter and monitor for outbound connections to the recorded IP addresses and CNAME hostnames. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a171e9-863a-76dc-a8ba-be71353d33ca/ Cloudflare Radar report: https://radar.cloudflare.com/scan/e6d0c7ec-6bad-4aae-8ca5-041fbdd15a48 Stored capture screenshot: https://i.ibb.co/d0QH3jmp/5307c49ad16d.png Cloudflare Radar screenshot (2026-10-25T07:52:58Z): https://screenshots.phishdestroy.io/cf/e6d0c7ec-6bad-4aae-8ca5-041fbdd15a48.png URLScan screenshot (2026-10-25T07:11:54Z): https://screenshots.phishdestroy.io/us/01a171e6-b1bb-774a-87bc-de23b88226a7.png URLScan capture report: https://urlscan.io/result/01a171e6-b1bb-774a-87bc-de23b88226a7/ VirusTotal report: https://www.virustotal.com/gui/domain/coordinacionnacional.org Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=coordinacionnacional.org Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-25 07:55:04 UTC ## Stored page captures - Primary capture: https://i.ibb.co/d0QH3jmp/5307c49ad16d.png Captured: 2026-10-25 07:16:53 UTC - URLScan capture: https://screenshots.phishdestroy.io/01a171e9-863a-76dc-a8ba-be71353d33ca.png Captured: 2026-10-25 07:16:53 UTC Source report: https://urlscan.io/result/01a171e9-863a-76dc-a8ba-be71353d33ca/ - URLQuery: https://screenshots.phishdestroy.io/uq/9fd1ebf4-3929-44fd-b0ad-bedc24b746fd.png Captured: 2026-10-25 12:40:08 UTC Source report: https://urlquery.net/report/9fd1ebf4-3929-44fd-b0ad-bedc24b746fd SHA-256: 7d36003fe9aeec1c53df84adeb64ea100bd50f7610505608eafa66ce797391d1 - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/e6d0c7ec-6bad-4aae-8ca5-041fbdd15a48.png Captured: 2026-10-25 07:52:58 UTC Source report: https://radar.cloudflare.com/scan/e6d0c7ec-6bad-4aae-8ca5-041fbdd15a48 SHA-256: eb03939d3e66c62c8ea4384635e32d2781747de75fd4c9b3940312a472d49102 - URLScan · 2026-10-25: https://screenshots.phishdestroy.io/us/01a171e6-b1bb-774a-87bc-de23b88226a7.png Captured: 2026-10-25 07:11:54 UTC Source report: https://urlscan.io/result/01a171e6-b1bb-774a-87bc-de23b88226a7/ SHA-256: f9876587430d72b32b0ae258cad411236aa0c3a74a0993812468567954b90e85 ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-25T07:53:54Z", "uuid": "01a171e9-863a-76dc-a8ba-be71353d33ca", "scanned_at": "2026-10-25T07:15:02Z", "final_url": "https://www.coordinacionnacional.org/", "status": 200, "ip": "104.18.1.118", "domains": [ "ka-p.fontawesome.com", "www.youtube.com", "jnn-pa.googleapis.com", "googleads.g.doubleclick.net", "fonts.gstatic.com", "kit.fontawesome.com", "ssl.gstatic.com", "www.google.com", "static.doubleclick.net", "www.google-analytics.com", "imagedelivery.net", "www.googletagmanager.com", "fonts.googleapis.com" ], "ips": [ "142.251.157.120", "172.217.113.4", "142.251.154.119", "142.250.68.198", "142.251.211.98", "142.251.152.4", "142.251.157.4", "142.251.45.174", "142.251.45.195", "104.18.40.68", "104.18.3.36", "142.250.72.8", "142.251.210.42", "104.18.1.118" ], "asns": [ "15169", "13335" ], "countries": [ "US" ], "link_domains": [ "wa.me" ], "social": [ "https://wa.me/5215581885982" ], "doc_hash": "cd73524108a5f07be9b19f7031b43a5d6c528d590c89940c9161ce06691886fc", "script_hashes": [ "c939a1d0d351cacdbf865b39976bcc6262cbe8d616764b6b0c5259aa674fa6ad", "ea5dc75ec78bca3e901f5e82a9b112722bafa1add3b3f00b258b6d9d309de80b" ], "globals": [ "LANDING_SITE_ID", "LANDING_SITE_CONTACT_US_URL", "gtag", "dataLayer", "google_tag_data", "google_tag_manager", "onYouTubeIframeAPIReady", "gaGlobal", "FontAwesomeKitConfig", "scriptUrl", "ttPolicy", "YT", "YTConfig", "onYTReady" ], "cookies": [ "_ga_5S8YGGYC29", "_ga", "YSC", "VISITOR_INFO1_LIVE", "VISITOR_PRIVACY_METADATA", "__Secure-YNID", "__Secure-ROLLOUT_TOKEN" ], "tls": { "san": [ "www.coordinacionnacional.org" ], "cipher": "AES_128_GCM", "issuer": "WE1", "subject": "www.coordinacionnacional.org", "protocol": "TLS 1.3", "valid_to": "2026-12-19T08:03:20Z", "valid_from": "2026-09-20T07:03:25Z" }, "domain_age_days": 211, "apex_age_days": 568, "tls_age_days": 35, "tls_valid_days": 90, "requests": 48, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 65, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "cloudflare", "content-type": "text/html" } }, "cf": { "v": 1, "fetched_at": "2026-10-25T07:53:56Z", "uuid": "e6d0c7ec-6bad-4aae-8ca5-041fbdd15a48", "scanned_at": "2026-10-25T07:52:58Z", "final_url": "https://www.coordinacionnacional.org/", "status": 200, "redirected": "subdomain", "history": [ { "url": "https://coordinacionnacional.org/", "status": 301 }, { "url": "https://www.coordinacionnacional.org/", "status": 200 } ], "dom_hash": "2f8b30ab9127cc19e43b808317808b19dd473a2753cae152deb491fca7531f3a", "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "coordinacionnacional.org", "type": "A", "value": "166.117.246.71" }, { "name": "coordinacionnacional.org", "type": "A", "value": "75.2.29.147" }, { "name": "www.coordinacionnacional.org", "type": "CNAME", "value": "proxy-ssl.getlandingsite.com" }, { "name": "www.coordinacionnacional.org", "type": "CNAME", "value": "proxy-ssl.getlandingsite.com" } ], "dnssec_valid": false, "ip": "104.18.1.118", "whois": { "registrar": "Name.com, Inc.", "created": "2025-04-04T18:10:41Z", "updated": "2026-08-12T04:07:43Z", "expires": "2027-04-04T18:10:41Z", "nameservers": [ "ns1.landingsite.ai", "ns2.landingsite.ai", "ns3.landingsite.ai", "ns4.landingsite.ai" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-25T07:52:09Z", "analysis_at": "2026-09-09T13:43:58Z", "stats": { "timeout": 0, "harmless": 56, "malicious": 0, "suspicious": 0, "undetected": 36 }, "reputation": 0, "created": "2025-04-04T00:00:00Z", "updated": "2026-03-02T00:00:00Z", "first_seen": "2025-04-04T18:37:51Z", "dns": [ { "ttl": 21600, "type": "NS", "value": "ns1.landingsite.ai" }, { "ttl": 21600, "type": "NS", "value": "ns2.landingsite.ai" }, { "ttl": 21600, "type": "NS", "value": "ns4.landingsite.ai" }, { "ttl": 900, "type": "SOA", "rname": "awsdns-hostmaster.amazon.com", "value": "ns-407.awsdns-50.com" }, { "ttl": 21600, "type": "NS", "value": "ns3.landingsite.ai" }, { "ttl": 300, "type": "A", "value": "75.2.29.147" }, { "ttl": 300, "type": "A", "value": "166.117.246.71" } ], "dns_at": "2026-09-09T13:45:10Z", "jarm": "40d40d40d00000000043d43d00043d6aff5ab0f4fc31897186312c9e639319", "cert": { "san": [ "coordinacionnacional.org" ], "issuer": "Let's Encrypt / YE2", "serial": "5e06aa60eae8bc3404125c6415335ad6d27", "sha256": "34e9139c751ec9c7fcff0ba4c029f495eb0ac9dedebeb5e3d9c42f75a1e9b1ee", "subject": "coordinacionnacional.org", "valid_to": "2026-10-23T04:15:40Z", "valid_from": "2026-07-25T04:15:41Z" }, "whois": [], "rdap": { "status": [ "transfer prohibited" ], "events": { "expiration": "2027-04-04T18:10:41Z", "last changed": "2026-08-12T04:07:43Z", "registration": "2025-04-04T18:10:41Z", "registrar expiration": "2027-04-04T18:10:41Z", "last update of RDAP database": "2026-08-12T04:07:43Z" }, "registrar": "Name.com, Inc", "registrar_iana_id": "625" } }, "webcheck": { "v": 1, "fetched_at": "2026-10-25T07:54:16Z", "mail_config": { "spf_lookups": 0 }, "caa_records": { "domain": "coordinacionnacional.org" }, "block_lists": { "resolvers": 12, "blocked_count": 0 }, "archives": { "last": "2026-10-25T07:19:20Z", "first": "2025-04-08T19:46:53Z", "changes": 3, "days_archived": 5, "scans_per_day": 0.01, "avg_page_bytes": 8699 }, "robots_txt": { "agents": [ "*" ], "present": true, "sitemaps": [ "https://www.coordinacionnacional.org/sitemap.xml" ] }, "sitemap": { "present": true, "url_count": 13 }, "security_txt": { "present": true, "found_in": "/.well-known/security.txt" }, "social_tags": { "ogUrl": "https://coordinacionnacional.org/", "title": "Campaña Nacional Antifraude — Asesoría Legal Gratuita para Víctimas de Fraude Digital", "ogType": "website", "robots": "index, follow", "ogImage": "https://www.coordinacionnacional.org/assets/provider/istock/875123860.jpg", "ogTitle": "Campaña Nacional Antifraude — Asesoría Legal Gratuita para Víctimas de Fraude Digital", "description": "Organización civil independiente que ofrece asesoría legal gratuita a víctimas de fraudes cibernéticos en México. Orientamos y acompañamos tu caso sin costo alguno.", "twitterCard": "summary_large_image", "canonicalUrl": "https://coordinacionnacional.org/", "ogDescription": "Organización civil independiente que ofrece asesoría legal gratuita a víctimas de fraudes cibernéticos en México. Orientamos y acompañamos tu caso sin costo alguno." }, "trackers": { "requests": 13, "trackers": [ { "name": "Google Tag", "company": "Google", "country": "US", "category": "Advertising", "requests": 1 }, { "name": "YouTube", "company": "Google", "country": "US", "category": "Audio/Video Player", "requests": 4 }, { "name": "fontawesome.com", "company": "fontawesome.com", "category": "Hosting", "requests": 1 }, { "name": "Google Fonts", "company": "Google", "country": "US", "category": "Hosting", "requests": 1 }, { "name": "Google Static", "company": "Google", "country": "US", "category": "Hosting", "requests": 1 }, { "name": "Google Analytics", "company": "Google", "country": "US", "category": "Site Analytics", "requests": 1 } ] }, "mixed_content": { "no_sri": [ "https://www.googletagmanager.com/gtag/js", "https://kit.fontawesome.com/8e98006f77.js" ], "third_party_scripts": 2 }, "status": { "up": true, "code": 301, "timings": { "dns": 257, "tls": 196, "wait": 98, "connect": 6, "download": 0 }, "response_ms": 557 }, "tls_connection": { "alpn": "h2", "cipher": "TLS_AES_128_GCM_SHA256", "protocol": "TLSv1.3", "versions": [ "TLSv1.2", "TLSv1.3" ], "authorized": true, "forward_secrecy": true }, "ports": { "open": [ 80, 443, 8080 ] }, "carbon": { "bytes": 90643, "co2_grams": 0.0033, "cleaner_than": 24 }, "dns_server": { "ns": [ { "ip": "205.251.194.107", "host": "ns3.landingsite.ai" }, { "ip": "205.251.197.142", "host": "ns4.landingsite.ai" }, { "ip": "205.251.193.151", "host": "ns1.landingsite.ai" }, { "ip": "205.251.199.103", "host": "ns2.landingsite.ai" } ], "zone": "coordinacionnacional.org" }, "cookies": { "cookies": [ { "name": "_ga_5S8YGGYC29" }, { "name": "_ga" }, { "name": "YSC", "secure": true, "session": true, "http_only": true, "same_site": "None" }, { "name": "VISITOR_INFO1_LIVE", "secure": true, "http_only": true, "same_site": "None" }, { "name": "VISITOR_PRIVACY_METADATA", "secure": true, "http_only": true, "same_site": "None" }, { "name": "__Secure-YNID", "secure": true, "http_only": true, "same_site": "None" }, { "name": "__Secure-ROLLOUT_TOKEN", "secure": true, "http_only": true, "same_site": "None" } ] }, "location": { "ip": "166.117.246.71", "asn": "16509", "org": "Amazon.com, Inc.", "city": "Seattle", "country": "US" }, "ssl": { "issuer": "Let's Encrypt / YE2", "subject": "coordinacionnacional.org" }, "dns": { "A": [ "166.117.246.71", "75.2.29.147" ], "NS": [ "ns1.landingsite.ai", "ns2.landingsite.ai", "ns4.landingsite.ai", "ns3.landingsite.ai" ], "SOA": "{\"nsname\": \"ns-407.awsdns-50.com\", \"hostmaster\": \"awsdns-hostmaster.amazon.com\", \"serial\": 1, \"refresh\": 7200, \"retry\": 900, \"expire\": 1209600, \"minttl\": 86400}" }, "dnssec": { "ds": false, "rrsig": false, "dnskey": false }, "hsts": { "message": "Site does not serve any HSTS headers." }, "http_security": { "xFrameOptions": false, "referrerPolicy": false, "xXSSProtection": false, "permissionsPolicy": false, "xContentTypeOptions": false, "contentSecurityPolicy": false, "strictTransportPolicy": false, "crossOriginOpenerPolicy": false, "crossOriginEmbedderPolicy": false, "crossOriginResourcePolicy": false }, "firewall": { "waf": "Cloudflare", "has_waf": true }, "get_ip": { "ip": "75.2.29.147", "family": 4 }, "redirects": { "chain": [ "https://coordinacionnacional.org", "https://www.coordinacionnacional.org/" ], "count": 1 }, "subdomains": { "count": 1, "subdomains": [ "www.coordinacionnacional.org" ] }, "linked_pages": { "external": [ "https://wa.me/5215581885982" ], "external_count": 1, "internal_count": 12 }, "whois": { "registrar": "Name.com, Inc.", "created": "2025-04-04T18:10:41Z", "updated": "2026-08-12T04:07:43Z", "expires": "2027-04-04T18:10:41Z", "status": [ "clientTransferProhibited https://icann.org/epp" ], "nameservers": [ "ns1.landingsite.ai", "ns2.landingsite.ai", "ns3.landingsite.ai", "ns4.landingsite.ai" ] }, "headers": { "headers": { "server": "cloudflare", "content-type": "text/html" } } } } ```