couragecoin[.]digital
“couragecoin.digital | 502: Bad gateway”
Analysis of the domain couragecoin.digital shows it is presently offline, returning a 502 Bad Gateway HTTP status. The site is hosted behind Cloudflare, resolving to the IP address 172.67.131.131, which belongs to ASN 13335 operated by Cloudflare, Inc., located in the United States. Registration data indicates the domain was created on 27 February 2026 through PublicDomainRegistry.com (PDR Ltd.), and the authoritative nameservers are audrey.ns.cloudflare.com and rohin.ns.cloudflare.com. No TLS certificate was observed, confirming the absence of HTTPS encryption. Threat intelligence flags the domain as a generic phishing site.
One of ninety‑three VirusTotal scanners flagged the domain, and three independent blocklists (PhishDestroy, MetaMask, and SEAL) have already listed it as malicious. The domain also appears on three additional security blocklists, reinforcing the suspicion of abusive activity. The presence of a page title “couragecoin.digital | 502: Bad gateway” provides the only visible content clue, but no further page content has been captured. Evidence confirms that the infrastructure is typical of fast‑flux or abuse‑friendly hosting, leveraging Cloudflare’s CDN to mask the origin server. While the domain is currently offline, the combination of recent creation, lack of TLS, a flagged VirusTotal result, and inclusion on multiple phishing‑related blocklists constitutes strong indication of phishing intent.
Uncertainty remains regarding the specific payload or credential‑harvesting mechanism, as no page content or phishing kit details have been disclosed. Defenders should immediately block traffic to couragecoin.digital and its resolving IP 172.67.131.131 at network perimeters. Monitoring for any re‑appearance of the domain or related sub‑domains is advised, as the registrar and Cloudflare nameservers can be reused for future campaigns.
Threat Response Pipeline
Public Blocklist Status
Stored Capture
Domain Intelligence
Technical detailsDNS, SSL SANs, timestamps
ICANN OVERSIGHT
Accreditation and RAA context
Accreditation and RAA context
Registrar accreditation and DNS abuse obligations
For this gTLD, the registrar above operates under an ICANN accreditation agreement. The links below provide the official fee schedule and current DNS abuse compliance guidance.
Accreditation is a contract, not a safety certification.
RAA §3.18 establishes abuse-contact and handling requirements. This report can document stored outbound notices and later technical observations; it does not by itself establish receipt, investigation, remediation, or contractual non-compliance.
VirusTotal Analysis
Evidence & External Reports
PD-20260227-D99F8B Recipient: abuse@publicdomainregistry.com Were You Affected by This Site?
If credentials, payment data, or files were exposed, report the incident immediately. Change affected passwords, revoke active sessions, and scan the device.
Report to Your Local Authorities
Select your country to get official cybercrime contacts, or create a complaint draft →.
Check Any Domain
Threat analysis using stored blocklist, WHOIS, DNS, and public scan evidence
Scan NowReport Phishing
Submit suspicious domains to our threat database — protect the community
ReportLive Threat Feed
Recent phishing reports and observed availability changes
MonitorStay Informed, Stay Safe
Monitor live threats or contest this listing if you believe it's a false positive