# PhishDestroy domain threat record: coralflowdex.com

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/coralflowdex.com/
Machine-readable companion: https://phishdestroy.io/domain/coralflowdex.com/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-24 22:29:40 UTC
- Last availability or vendor check: 2026-10-25 03:26:47 UTC
- Stored record updated: 2026-10-25 09:13:41 UTC
- VirusTotal detections in the stored snapshot: 18/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored infrastructure

- Observed IP address: 158.94.210.119
- Registrar in stored WHOIS data: Dynadot Inc
- Last stored HTTP status: 200
- Registration date in stored WHOIS data: 2026-07-18 20:00:05 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a17007-961b-73eb-bff2-a4e446abdd8f/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/coralflowdex.com
- Certificate Transparency search: https://crt.sh/?q=%25.coralflowdex.com
- Web Archive lookup: https://web.archive.org/web/*/https://coralflowdex.com/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
PhishDestroy’s automated assessment recorded coralflowdex.com as a “Fake Exchange” after observing that the site claimed to be an AI‑powered trading platform. The recorded page title on 2026-10-25 reads “Smarter Growth with AI‑Powered Trading Platform — Coral flowdex” and the HTTP response was 200 on that date. The domain first appeared in PhishDestroy logs on 2026-10-25, 99 days after its registration on 2026-07-18.

How the scam works
Fake crypto exchanges typically advertise high‑return automated trading, lure users to deposit funds or connect wallets, and then disappear or siphon the assets. Victims who provide credentials or private keys can lose control of their holdings.

Evidence
VirusTotal scans on 2026-10-23 reported 18 detections from 92 engines, with 15 classified as malicious and 3 as suspicious, including phishing labels from vendors such as BitDefender, ESET and Forcepoint ThreatSeeker. Google Safe Browsing checked on 2026-10-25 did not flag the URL, while Cloudflare Radar on the same day marked the site malicious under malware and phishing categories. URLScan’s analysis on 2026-10-25 gave a malicious score of 99 from its engines, though its overall verdict was non‑malicious, and OTX listed four pulses referencing the domain. PhishDestroy’s internal blocklist contains coralflowdex.com; external lists such as Spamhaus DBL and DNS‑based blocklists showed no entry on the check date.

Infrastructure
The DNS query recorded on 2026-10-25 returned an A record of 158.94.210.119, which belongs to ASN 202412 (Omegatech LTD, Amsterdam, NL). The domain was registered with Dynadot Inc on 2026-07-18 and was 98 days old at the time of capture. A Let’s Encrypt certificate for coralflowdex.com was observed, valid from 2026-08-28 to 2026-11-26, and the site responded on ports 22, 80 and 443 with no DNSSEC.

What to do
Users should avoid entering any login credentials, API keys or seed phrases on this site; if such data were submitted, change associated passwords and revoke any granted wallet permissions. If private keys were exposed, create a new secure wallet and transfer assets away from the compromised one. Defenders should block coralflowdex.com in web filters, monitor outbound connections to the recorded IP, and review logs for any prior interactions with the domain.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a17007-961b-73eb-bff2-a4e446abdd8f/
Cloudflare Radar report: https://radar.cloudflare.com/scan/fb563168-07ba-4ef5-93cd-396f8ababd44
URLQuery report: https://urlquery.net/report/8d1162cb-5bd9-4c4b-9df9-ebea5250f8f7
Stored capture screenshot: https://i.ibb.co/5gtWHvjW/810e601d9efc.png
Cloudflare Radar screenshot (2026-10-24T23:01:59Z): https://screenshots.phishdestroy.io/cf/fb563168-07ba-4ef5-93cd-396f8ababd44.png
URLQuery screenshot: https://screenshots.phishdestroy.io/uq/8d1162cb-5bd9-4c4b-9df9-ebea5250f8f7.png
URLScan screenshot (2026-10-24T21:43:46Z): https://screenshots.phishdestroy.io/us/01a16fde-8fe2-77af-b4b7-1a34801bcf70.png
URLScan capture report: https://urlscan.io/result/01a16fde-8fe2-77af-b4b7-1a34801bcf70/
URLScan screenshot (2026-10-24T21:49:03Z): https://screenshots.phishdestroy.io/us/01a16fe3-6a03-7355-bba4-52139841426c.png
URLScan capture report: https://urlscan.io/result/01a16fe3-6a03-7355-bba4-52139841426c/
URLScan screenshot (2026-10-24T21:59:52Z): https://screenshots.phishdestroy.io/us/01a16fed-4ffe-77ff-b867-074468089fba.png
URLScan capture report: https://urlscan.io/result/01a16fed-4ffe-77ff-b867-074468089fba/
VirusTotal report: https://www.virustotal.com/gui/domain/coralflowdex.com
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=coralflowdex.com
Archived copy: https://web.archive.org/web/20261024223035/https://coralflowdex.com/
Revoke token approvals: https://revoke.cash/
Report crypto fraud (Chainabuse): https://www.chainabuse.com/report
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-24 23:05:14 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/5gtWHvjW/810e601d9efc.png
  Captured: 2026-10-24 22:29:40 UTC
- URLScan capture: https://screenshots.phishdestroy.io/01a17007-961b-73eb-bff2-a4e446abdd8f.png
  Captured: 2026-10-24 22:29:40 UTC
  Source report: https://urlscan.io/result/01a17007-961b-73eb-bff2-a4e446abdd8f/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/fb563168-07ba-4ef5-93cd-396f8ababd44.png
  Captured: 2026-10-24 23:01:59 UTC
  Source report: https://radar.cloudflare.com/scan/fb563168-07ba-4ef5-93cd-396f8ababd44
  SHA-256: 8420a92b531fe2c9fb51c13ec27bd1c316f07e3cfc1ae70bd0b20e4c532693b2
- URLQuery: https://screenshots.phishdestroy.io/uq/8d1162cb-5bd9-4c4b-9df9-ebea5250f8f7.png
  Source report: https://urlquery.net/report/8d1162cb-5bd9-4c4b-9df9-ebea5250f8f7
  SHA-256: 07ffa3168574b2a9345fa59953e61316eb4414896511fe53770374433530f371
- URLScan · 2026-10-24: https://screenshots.phishdestroy.io/us/01a16fde-8fe2-77af-b4b7-1a34801bcf70.png
  Captured: 2026-10-24 21:43:46 UTC
  Source report: https://urlscan.io/result/01a16fde-8fe2-77af-b4b7-1a34801bcf70/
  SHA-256: ff2b0a668ff8bb0b0624ebd6782525ce2bac670c632c0d2bd70446b4d6aa1639
- URLScan · 2026-10-24: https://screenshots.phishdestroy.io/us/01a16fe3-6a03-7355-bba4-52139841426c.png
  Captured: 2026-10-24 21:49:03 UTC
  Source report: https://urlscan.io/result/01a16fe3-6a03-7355-bba4-52139841426c/
  SHA-256: ea6f29a6cc59d9e4f82d7cbe396288208abce51e0f385134bd81ebb1d0dbca61
- URLScan · 2026-10-24: https://screenshots.phishdestroy.io/us/01a16fed-4ffe-77ff-b867-074468089fba.png
  Captured: 2026-10-24 21:59:52 UTC
  Source report: https://urlscan.io/result/01a16fed-4ffe-77ff-b867-074468089fba/
  SHA-256: 1693c71a44137107b23f3e78f2d84ffb810832308918697499e828ab47bb502c

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-24T23:04:20Z",
        "uuid": "01a17007-961b-73eb-bff2-a4e446abdd8f",
        "scanned_at": "2026-10-24T22:28:34Z",
        "final_url": "https://coralflowdex.com/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://coralflowdex.com/",
                "from": "http://coralflowdex.com/",
                "status": 307
            }
        ],
        "ip": "158.94.210.119",
        "ips": [
            "158.94.210.119"
        ],
        "asns": [
            "202412"
        ],
        "countries": [
            "NL"
        ],
        "doc_hash": "621e68244c1bcb178b2e2102b37e9f78062ae809ccd7c4ba1a3bc8880e48bb5f",
        "script_hashes": [
            "8aa5f8f647356dcd4fc5dbbe0efd5bc0e8da74026bc61e24636e2e1f5749b0ce"
        ],
        "globals": [
            "__dclq",
            "__dclOrig",
            "__dclFlush",
            "__smsCheckBeforeSubmit",
            "__isSmsEnabled",
            "__isSmsVerified",
            "intlTelInput",
            "navToggle",
            "navWrapper",
            "langToggle",
            "langDropdown"
        ],
        "cookies": [
            "connect.sid"
        ],
        "tls": {
            "san": [
                "coralflowdex.com"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "YE2",
            "subject": "coralflowdex.com",
            "protocol": "TLS 1.3",
            "valid_to": "2026-11-26T13:53:49Z",
            "valid_from": "2026-08-28T13:53:50Z"
        },
        "domain_age_days": 98,
        "apex_age_days": 98,
        "tls_age_days": 57,
        "tls_valid_days": 89,
        "requests": 5,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 99,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "content-type": "text/html; charset=utf-8",
            "x-content-type-options": "nosniff",
            "referrer-policy": "same-origin"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-24T23:04:24Z",
        "uuid": "fb563168-07ba-4ef5-93cd-396f8ababd44",
        "scanned_at": "2026-10-24T23:01:59Z",
        "final_url": "https://coralflowdex.com/",
        "status": 200,
        "history": [
            {
                "url": "https://coralflowdex.com/",
                "status": 200
            }
        ],
        "dom_hash": "0321af4984ff16171e5c4a4522bfe86b229814993fd6a0ce4b775cb5b638c077",
        "doc_hash": "0ee1ceb184bb9a423bd060cf1c08eecfb131e979ca03089b6f89a2683d6f380e",
        "phishing_v2": [
            "phishing"
        ],
        "url_risks": [
            "Scam"
        ],
        "domain_risks": [
            "Scam",
            "Security threats",
            "Malware",
            "CIPA Filter",
            "CIPA"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "coralflowdex.com",
                "type": "A",
                "value": "158.94.210.119"
            }
        ],
        "dnssec_valid": false,
        "ip": "158.94.210.119",
        "verdict": {
            "tags": [
                "malware"
            ],
            "malicious": true,
            "categories": [
                "malware"
            ]
        },
        "whois": {
            "registrar": "Dynadot Inc",
            "created": "2026-07-18T22:00:05Z",
            "updated": "2026-08-13T12:43:52Z",
            "expires": "2027-07-18T22:00:05Z",
            "nameservers": [
                "ns1.dyna-ns.net",
                "ns2.dyna-ns.net"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-24T23:01:03Z",
        "analysis_at": "2026-10-23T12:18:55Z",
        "stats": {
            "timeout": 0,
            "harmless": 42,
            "malicious": 15,
            "suspicious": 3,
            "undetected": 32
        },
        "detections": {
            "CRDF": "malicious",
            "DNS8": "suspicious",
            "ESET": "suspicious",
            "VIPRE": "phishing",
            "G-Data": "phishing",
            "Lionic": "phishing",
            "Sophos": "phishing",
            "CyRadar": "phishing",
            "Fortinet": "phishing",
            "Netcraft": "malicious",
            "SOCRadar": "phishing",
            "Kaspersky": "phishing",
            "Seclookup": "malicious",
            "Gridinsoft": "suspicious",
            "BitDefender": "phishing",
            "Chong Lua Dao": "malicious",
            "alphaMountain.ai": "phishing",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "registrar": "Dynadot Inc",
        "created": "2026-07-18T22:00:05Z",
        "expires": "2027-07-18T22:00:05Z",
        "updated": "2026-08-13T12:43:52Z",
        "first_seen": "2026-07-18T23:03:51Z",
        "dns": [
            {
                "ttl": 300,
                "type": "NS",
                "value": "ns2.dyna-ns.net"
            },
            {
                "ttl": 300,
                "type": "MX",
                "value": "parkmail.dynadot.com",
                "priority": 0
            },
            {
                "ttl": 300,
                "type": "SOA",
                "rname": "hostmaster.coralflowdex.com",
                "value": "ns1.dyna-ns.net"
            },
            {
                "ttl": 300,
                "type": "NS",
                "value": "ns1.dyna-ns.net"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "158.94.210.119"
            }
        ],
        "dns_at": "2026-10-23T12:24:19Z",
        "jarm": "40d40d40d00000000043d43d00043d6aff5ab0f4fc31897186312c9e639319",
        "cert": {
            "san": [
                "coralflowdex.com"
            ],
            "issuer": "Let's Encrypt / YE2",
            "serial": "574f449305323da6dec685cd6a341859faf",
            "sha256": "25f757234b3828ce0c081611438c0fc7af670ab8e39ff8b081b183b08d082b00",
            "subject": "coralflowdex.com",
            "valid_to": "2026-11-26T13:53:49Z",
            "valid_from": "2026-08-28T13:53:50Z"
        },
        "whois": {
            "registrar": "Dynadot Inc",
            "registrar_iana_id": "472",
            "registrar_url": "http://www.dynadot.com",
            "created": "2026-07-18T22:00:05Z",
            "updated": "2026-08-13T12:43:52Z",
            "expires": "2027-07-18T22:00:05Z",
            "status": [
                "clientTransferProhibited"
            ],
            "nameservers": [
                "ns1.dyna-ns.net",
                "ns2.dyna-ns.net"
            ],
            "dnssec": "unsigned"
        },
        "rdap": {
            "status": [
                "transfer prohibited"
            ],
            "events": {
                "expiration": "2027-07-18T22:00:05Z",
                "last changed": "2026-08-28T09:57:02Z",
                "registration": "2026-07-18T22:00:05Z",
                "registrar expiration": "2027-07-18T22:00:05Z",
                "last update of RDAP database": "2026-10-22T08:45:17Z"
            }
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-24T22:58:04Z",
        "mail_config": {
            "mx": [
                "parkmail.dynadot.com"
            ],
            "spf_lookups": 0
        },
        "caa_records": {
            "domain": "coralflowdex.com"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_by": [
                "CloudFlare Family"
            ],
            "blocked_count": 1
        },
        "robots_txt": {
            "agents": [
                "*"
            ],
            "present": true,
            "sitemaps": [
                "https://coralflowdex.com/sitemap.xml"
            ]
        },
        "sitemap": {
            "present": true,
            "url_count": 5
        },
        "social_tags": {
            "title": "Smarter Growth with AI-Powered Trading Platform — Coral flowdex",
            "robots": "index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1",
            "description": "Adaptive Intelligence & Precision Execution — Coral flowdex helps ambitious investors scale operations and automate high-performance market strategies globally.",
            "canonicalUrl": "https://coralflowdex.com/"
        },
        "trackers": {
            "requests": 54,
            "trackers": [
                {
                    "name": "Cloudflare",
                    "company": "Cloudflare",
                    "country": "US",
                    "category": "Hosting",
                    "requests": 1
                },
                {
                    "name": "jsDelivr",
                    "company": "jsDelivr",
                    "category": "Hosting",
                    "requests": 4
                }
            ]
        },
        "mixed_content": {
            "third_party_scripts": 0
        },
        "status": {
            "up": true,
            "code": 200,
            "timings": {
                "dns": 664,
                "tls": 76,
                "wait": 160,
                "connect": 68,
                "download": 135
            },
            "response_ms": 1103
        },
        "tls_connection": {
            "alpn": "h2",
            "cipher": "TLS_AES_128_GCM_SHA256",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                22,
                80,
                443
            ]
        },
        "carbon": {
            "bytes": 94209,
            "co2_grams": 0.0034,
            "cleaner_than": 23
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "162.159.25.5",
                    "host": "ns2.dyna-ns.net"
                },
                {
                    "ip": "162.159.26.92",
                    "host": "ns1.dyna-ns.net"
                }
            ],
            "zone": "coralflowdex.com"
        },
        "cookies": {
            "cookies": [
                {
                    "name": "cf-c",
                    "http_only": true,
                    "same_site": "Lax"
                },
                {
                    "name": "__cf_clicked"
                },
                {
                    "name": "ph_phc_t6w4wzJE2sbz4ro8LmZZTssm5go3KD6mP7QsqcDQRSp6_posthog",
                    "secure": true,
                    "same_site": "Lax"
                }
            ]
        },
        "location": {
            "ip": "158.94.210.119",
            "asn": "202412",
            "org": "Omegatech LTD",
            "city": "Amsterdam",
            "country": "NL"
        },
        "ssl": {
            "issuer": "Let's Encrypt / YE2",
            "subject": "coralflowdex.com"
        },
        "dns": {
            "A": [
                "158.94.210.119"
            ],
            "MX": [
                "{\"exchange\": \"parkmail.dynadot.com\", \"priority\": 0}"
            ],
            "NS": [
                "ns2.dyna-ns.net",
                "ns1.dyna-ns.net"
            ],
            "SOA": "{\"nsname\": \"ns1.dyna-ns.net\", \"hostmaster\": \"hostmaster.coralflowdex.com\", \"serial\": 2026092801, \"refresh\": 16384, \"retry\": 2048, \"expire\": 1209600, \"minttl\": 300}"
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "hsts": {
            "message": "Site does not serve any HSTS headers."
        },
        "http_security": {
            "xFrameOptions": false,
            "referrerPolicy": "same-origin",
            "xXSSProtection": false,
            "permissionsPolicy": false,
            "xContentTypeOptions": "nosniff",
            "contentSecurityPolicy": false,
            "strictTransportPolicy": false,
            "crossOriginOpenerPolicy": false,
            "crossOriginEmbedderPolicy": false,
            "crossOriginResourcePolicy": false
        },
        "get_ip": {
            "ip": "158.94.210.119",
            "family": 4
        },
        "redirects": {
            "chain": [
                "https://coralflowdex.com"
            ]
        },
        "linked_pages": {
            "internal_count": 28
        },
        "whois": {
            "registrar": "Dynadot Inc",
            "created": "2026-07-18T22:00:05Z",
            "updated": "2026-08-13T12:43:52Z",
            "expires": "2027-07-18T22:00:05Z",
            "status": [
                "clientTransferProhibited https://icann.org/epp"
            ],
            "nameservers": [
                "ns1.dyna-ns.net",
                "ns2.dyna-ns.net"
            ]
        },
        "headers": {
            "headers": {
                "content-type": "text/html; charset=utf-8",
                "x-content-type-options": "nosniff",
                "referrer-policy": "same-origin"
            }
        }
    }
}
```