# PhishDestroy domain threat record: covabeans.co.kr

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/covabeans.co.kr/
Machine-readable companion: https://phishdestroy.io/domain/covabeans.co.kr/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-09-27 19:08:54 UTC
- Last availability or vendor check: 2026-10-22 10:26:52 UTC
- Stored record updated: 2026-10-22 16:07:29 UTC
- VirusTotal detections in the stored snapshot: 3/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: ["gmail"]

## Stored infrastructure

- Observed IP address: 186.2.175.145
- Registrar in stored WHOIS data: Megazone(http://HOSTING.KR)
- Registrar country in stored WHOIS data: Unknown
- Last stored HTTP status: 200
- Registration date (registry RDAP, covabeans.co.kr): 2026-08-25 15:00:00 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a0e446-bd78-731d-8d8e-265cb0546c9b/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/covabeans.co.kr
- Certificate Transparency search: https://crt.sh/?q=%25.covabeans.co.kr
- Web Archive lookup: https://web.archive.org/web/*/https://covabeans.co.kr/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
covabeans.co.kr is an impersonation phishing page dressed up as "코바빈스" (Covabeans), a Korean-language platform that claims coffee beans are now an investable asset. It targets Korean-speaking people looking for alternative investments with steady returns. PhishDestroy first flagged it on 2026-09-27. When last checked on 2026-10-19, the site was still online and serving its content.

How the scam works
The page title translates to "Coffee is now an asset – premium coffee bean investment platform." It sells green or premium beans as a commodity with promised yields. Schemes like this usually invite visitors to register, hand over identity and bank details, and deposit money into a dashboard that shows growing profits. When victims try to cash out, they are typically asked for "fees," "taxes" or extra deposits, and the money never comes back. Victims stand to lose every deposit plus the personal data they submitted. The title presents a standalone investment brand, while we classify the site as impersonation.

Evidence
Independent detection is still thin. On 2026-10-10, 3 of 92 VirusTotal engines flagged the domain: Forcepoint ThreatSeeker, Gridinsoft and SOCRadar. PhishDestroy is the only blocklist carrying it so far, so most browsers and filters will not warn visitors. Four AlienVault OTX threat pulses reference it, which shows other researchers are tracking the same activity.

Infrastructure
The domain was registered on 2026-08-26 through Korean registrar Megazone, roughly a month before we detected it. That short gap fits a site built for a single campaign. Despite the .co.kr name and Korean branding, it is hosted outside Korea on the IQWeb FZ-LLC network at 186.2.175.145, with the server located in Belize. It uses a free Let's Encrypt certificate, so the padlock in the browser proves nothing about whether the platform is legitimate.

What to do
Do not deposit money, and do not pay any "withdrawal fee" or "tax" to unlock a balance. Those payments only deepen the loss. If you already sent funds, contact your bank or card issuer right away to try to stop or reverse the transfers, and file a report with the police. If you submitted your ID, phone number or bank details, watch for follow-up fraud and "recovery" offers, and change any password you reused on the site. Defenders should block the domain and its hosting IP, and warn Korean-speaking users about coffee and commodity investment pitches.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a0e446-bd78-731d-8d8e-265cb0546c9b/
VirusTotal report: https://www.virustotal.com/gui/domain/covabeans.co.kr
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=covabeans.co.kr
Archived copy: https://web.archive.org/web/20260927191103/https://covabeans.co.kr/
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 09:33:23 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/Yx5BnTg/910cd653c21b.png
  Captured: 2026-09-27 19:12:12 UTC
- URLScan capture: https://screenshots.phishdestroy.io/01a0e446-bd78-731d-8d8e-265cb0546c9b.png
  Captured: 2026-09-27 19:12:12 UTC
  Source report: https://urlscan.io/result/01a0e446-bd78-731d-8d8e-265cb0546c9b/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/6a8cb620-4aa0-4ef6-a613-1460c18bf627.png
  Captured: 2026-09-27 19:11:06 UTC
  Source report: https://radar.cloudflare.com/scan/6a8cb620-4aa0-4ef6-a613-1460c18bf627
  SHA-256: e066e2cc6c3a59e5752809793bcb6d4c1749157e87e944aa2d4e3d47c34b3536
- URLQuery: https://screenshots.phishdestroy.io/uq/47392b15-057e-4230-94de-bd1b1f29fbba.png
  Source report: https://urlquery.net/report/47392b15-057e-4230-94de-bd1b1f29fbba
  SHA-256: fb27e709513e094188c2a5b32bab8e06f69291c569564f224ca3cce8d468c5ef
- URLScan · 2026-09-11: https://screenshots.phishdestroy.io/us/01a08ee8-a1db-741a-8ff5-26a9326d85b1.png
  Captured: 2026-09-11 05:20:17 UTC
  Source report: https://urlscan.io/result/01a08ee8-a1db-741a-8ff5-26a9326d85b1/
  SHA-256: 137d838b00bfffcc05c2e9ef43558380fac3fb44922e5d9874db5a5719046d95
- URLScan · 2026-09-22: https://screenshots.phishdestroy.io/us/01a0c7d6-1244-74ac-93e0-4853291ebee1.png
  Captured: 2026-09-22 06:38:21 UTC
  Source report: https://urlscan.io/result/01a0c7d6-1244-74ac-93e0-4853291ebee1/
  SHA-256: 9a263762da651bf2c55c29dedffb4f8df5b8bc8e74638ef476f84427b1caaa52

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-20T20:55:53Z",
        "uuid": "01a0e446-bd78-731d-8d8e-265cb0546c9b",
        "scanned_at": "2026-09-27T19:10:50Z",
        "final_url": "https://covabeans.co.kr/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://covabeans.co.kr/",
                "from": "http://covabeans.co.kr/",
                "status": 307
            },
            {
                "to": "http://covabeans.co.kr/",
                "from": "https://covabeans.co.kr/",
                "status": 307
            },
            {
                "to": "https://covabeans.co.kr/",
                "from": "http://covabeans.co.kr/",
                "status": 301
            }
        ],
        "ip": "186.2.175.145",
        "ptr": "ddos-guard.net",
        "domains": [
            "cdn.jsdelivr.net"
        ],
        "ips": [
            "151.101.193.229",
            "186.2.175.145"
        ],
        "asns": [
            "54113",
            "59692"
        ],
        "countries": [
            "US",
            "AE"
        ],
        "doc_hash": "c39c48c80baebc3410895707660372beb72685a0c44c3fa4cb4d17aca549d3fb",
        "script_hashes": [
            "9b422073246a4c528a2dc585b320ccf164f7405ac6ca10cad104aa8da7827b1a",
            "6f8c4911131bbeafaafafec7bc781e4beb7eda6de02d9b08c3293206be981854",
            "e9f765c5c0f5e2a28894227989ec3e079c4c1db7a40ee936f9dfe662db4f2d0c",
            "be9185d18685b530bb2ed18b822362c5e27cb199e6cb94eeb85b4261600d9719",
            "7bdff7987f8d8c586d62113954ef4240f7e2d8211dbca978916e4a614df9bcdb",
            "a3abc941e792f71aa3e9bd147a4a7ce65006d54bfa417a8604adf05dd9cee308",
            "63d8f373b6dad78cbec670a958606582535abd6aa149ac824eac80a821f75898",
            "bfc63e2276a3200ee8eac9e1c02e276f2a32461225feb0fea84560e6fe48c313",
            "e9786b1305894e4119bb9811a816dac9cf576755596dd989ee15b455749fc35e",
            "a6248517cd3ee53a8186b51c59e1e764e3dc0c512f4acbd50e818f9884663e21"
        ],
        "globals": [
            "requestResize",
            "__next_f",
            "TURBOPACK",
            "next",
            "__webpack_hash__",
            "_N_E_STYLE_LOAD"
        ],
        "cookies": [
            "__ddg9_",
            "__ddg1_",
            "__ddg10_",
            "__ddg8_"
        ],
        "tls": {
            "san": [
                "covabeans.co.kr"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "YR2",
            "subject": "covabeans.co.kr",
            "protocol": "TLS 1.3",
            "valid_to": "2026-11-24T07:27:45Z",
            "valid_from": "2026-08-26T07:27:46Z"
        },
        "domain_age_days": 32,
        "apex_age_days": 32,
        "tls_age_days": 32,
        "tls_valid_days": 89,
        "requests": 33,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 88,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "ddos-guard",
            "content-type": "text/html; charset=utf-8",
            "x-powered-by": "Next.js",
            "content-security-policy": "upgrade-insecure-requests;",
            "x-frame-options": "SAMEORIGIN",
            "x-content-type-options": "nosniff",
            "referrer-policy": "strict-origin-when-cross-origin"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-20T21:04:28Z",
        "uuid": "6a8cb620-4aa0-4ef6-a613-1460c18bf627",
        "scanned_at": "2026-09-27T19:11:06Z",
        "final_url": "https://covabeans.co.kr/",
        "status": 200,
        "history": [
            {
                "url": "https://covabeans.co.kr/",
                "status": 200
            }
        ],
        "dom_hash": "b4736b1f4cbe10922d44bf08e6183511532d288892bafeaa057bcf157aa8cfc6",
        "doc_hash": "c39c48c80baebc3410895707660372beb72685a0c44c3fa4cb4d17aca549d3fb",
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "covabeans.co.kr",
                "type": "A",
                "value": "186.2.175.145"
            }
        ],
        "dnssec_valid": false,
        "ip": "186.2.175.145",
        "whois": {
            "registrar": "Megazone(http://HOSTING.KR)",
            "created": "2026-08-26T00:00:00Z",
            "updated": "2026-08-26T00:00:00Z",
            "expires": "2027-08-26T00:00:00Z",
            "nameservers": [
                "ns1.ddos-guard.net",
                "ns2.ddos-guard.net"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-21T16:45:03Z",
        "analysis_at": "2026-10-13T09:03:48Z",
        "stats": {
            "timeout": 0,
            "harmless": 54,
            "malicious": 3,
            "suspicious": 1,
            "undetected": 34
        },
        "detections": {
            "SOCRadar": "phishing",
            "Gridinsoft": "suspicious",
            "alphaMountain.ai": "phishing",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "categories": {
            "alphaMountain.ai": "Phishing (alphaMountain.ai)"
        },
        "first_seen": "2026-08-28T01:48:37Z",
        "dns": [
            {
                "ttl": 3600,
                "type": "A",
                "value": "186.2.175.145"
            },
            {
                "ttl": 3600,
                "type": "SOA",
                "rname": "support.ddos-guard.net",
                "value": "ns1.ddos-guard.net"
            },
            {
                "ttl": 3600,
                "type": "NS",
                "value": "ns2.ddos-guard.net"
            },
            {
                "ttl": 3600,
                "type": "NS",
                "value": "ns1.ddos-guard.net"
            }
        ],
        "dns_at": "2026-10-13T09:09:33Z",
        "jarm": "2ad2ad16d2ad2ad22c41d41d000000d740f47fc623495ea334f7291b19b353",
        "cert": {
            "san": [
                "covabeans.co.kr"
            ],
            "issuer": "Let's Encrypt / YR2",
            "serial": "552fd8594171ac93b1cf911d055d14d74a5",
            "sha256": "5a101fee5736d1158a7e22189be7378e631e96cccba5fa5304faec218b1cb2ed",
            "subject": "covabeans.co.kr",
            "valid_to": "2026-11-24T07:27:45Z",
            "valid_from": "2026-08-26T07:27:46Z"
        }
    }
}
```