# PhishDestroy domain threat record: smart-safety.coinbase-route.com Content language: English Canonical HTML report: https://phishdestroy.io/domain/smart-safety.coinbase-route.com/ Machine-readable companion: https://phishdestroy.io/domain/smart-safety.coinbase-route.com/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: not observed active - First observed by PhishDestroy: 2026-10-15 12:02:12 UTC - Last availability or vendor check: 2026-10-21 22:32:53 UTC - Stored record updated: 2026-10-22 14:24:17 UTC - VirusTotal detections in the stored snapshot: 0/92 - Independent public blocklist matches in the stored snapshot: 2 - Matching public blocklists: MetaMask, SEAL - Google Safe Browsing stored result: no stored flag ## Stored classification - Targeted brand: Coinbase ## Stored infrastructure - Observed IP address: 137.59.18.85 - Registrar in stored WHOIS data: eName Technology Co., Ltd. - Registrar country in stored WHOIS data: CN - Registration date (registry RDAP, coinbase-route.com): 2026-10-07 05:13:10 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a13f71-7b2f-739a-b2e5-f7b1e642c8a2/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/smart-safety.coinbase-route.com - Certificate Transparency search: https://crt.sh/?q=%25.smart-safety.coinbase-route.com - Web Archive lookup: https://web.archive.org/web/*/https://smart-safety.coinbase-route.com/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview smart-safety.coinbase-route.com is a phishing page that impersonates Coinbase and targets the exchange's customers. Its name pairs the real brand with security language ("smart-safety", "route") to look like an official account-protection step. PhishDestroy first flagged it on 2026-10-15. The site has been offline since 2026-10-17 and was still unreachable on 2026-10-19. The page title read "Cenyee", which does not match Coinbase branding, but scanning identified Coinbase content and we classify the site as Coinbase impersonation. How the scam works Lures of this kind usually arrive as a fake security alert, telling the victim their Coinbase account needs verification or protection. The victim lands on a page styled like Coinbase that asks for an email, password and two-factor code, and sometimes a wallet recovery phrase. Whatever is typed goes straight to the operators, who can log in, change the withdrawal settings and empty the account before the owner notices. Evidence urlscan.io rated the page malicious and recognised Coinbase branding on it. The domain is listed on the MetaMask and SEAL blocklists as well as PhishDestroy's own. VirusTotal showed 0 detections out of 92 engines on 2026-10-15, so a clean result there would not have protected anyone from this site during its short life. Infrastructure The domain was registered on 2026-10-07 through eName Technology Co., Ltd., eight days before PhishDestroy caught it. It ran from an IP on the Yancy Limited network in the US. That gap between registration and detection, combined with a lifespan of roughly ten days, fits a disposable domain built for one short campaign. What to do If you entered Coinbase credentials here, change your password immediately and reset two-factor authentication, preferably to a hardware key or authenticator app. Then sign out all active sessions and review recent logins, API keys and saved withdrawal addresses. If you typed a recovery phrase, treat that wallet as compromised and move the funds to a newly generated wallet. Report the incident to Coinbase support. Defenders should block the domain and the coinbase-route.com parent, and watch mail and DNS logs for lookalike Coinbase "safety" subdomains. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a13f71-7b2f-739a-b2e5-f7b1e642c8a2/ VirusTotal report: https://www.virustotal.com/gui/domain/smart-safety.coinbase-route.com Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=smart-safety.coinbase-route.com Archived copy: https://web.archive.org/web/20261015120305/https://smart-safety.coinbase-route.com/ Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-19 10:13:19 UTC ## Stored page captures - Primary capture: https://i.ibb.co/PzjxRVw6/c579136a8525.png Captured: 2026-10-15 12:03:58 UTC - URLScan capture 1: https://screenshots.phishdestroy.io/01a13f71-7b2f-739a-b2e5-f7b1e642c8a2.png Captured: 2026-10-15 12:03:58 UTC Source report: https://urlscan.io/result/01a13f71-7b2f-739a-b2e5-f7b1e642c8a2/ - URLScan capture 2: https://urlscan.io/screenshots/01a12efa-0f53-710d-bb2c-e57953a003f8.png Captured: 2026-10-15 12:02:12 UTC Source report: https://urlscan.io/result/01a13f71-7b2f-739a-b2e5-f7b1e642c8a2/ - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/61b3fbe0-5bc4-41ee-90fd-7b3601607647.png Captured: 2026-10-15 12:03:16 UTC Source report: https://radar.cloudflare.com/scan/61b3fbe0-5bc4-41ee-90fd-7b3601607647 SHA-256: f85465cc8531b48c6023e05753ecfdf008575f6ac54cd8548a3ab3c518870e3c - URLQuery: https://screenshots.phishdestroy.io/uq/6dfbe573-4591-4c50-ac65-106a2999f893.png Source report: https://urlquery.net/report/6dfbe573-4591-4c50-ac65-106a2999f893 SHA-256: 1f5ee9b6ce0a9cfa4e3919b2cec80458aef863b1cf193b748fde4755b4f9b67a - URLScan · 2026-10-09: https://screenshots.phishdestroy.io/us/01a11fc6-2c78-7649-8faa-53fa5c1ca475.png Captured: 2026-10-09 08:27:37 UTC Source report: https://urlscan.io/result/01a11fc6-2c78-7649-8faa-53fa5c1ca475/ SHA-256: e1d2f2c6be774849691cfdcc4fdc08dd3834a02740bc8e9b8c45373e80f01733 - URLScan · 2026-10-12: https://screenshots.phishdestroy.io/us/01a12efa-0f53-710d-bb2c-e57953a003f8.png Captured: 2026-10-12 07:18:36 UTC Source report: https://urlscan.io/result/01a12efa-0f53-710d-bb2c-e57953a003f8/ SHA-256: 9df0b2a9029ad9000b78a494facf75ba5cc68dd5a5e0c72093a9287237dea324 - URLScan · 2026-10-15: https://screenshots.phishdestroy.io/us/01a13f73-2700-74ba-8ae9-7dbda9148b5f.png Captured: 2026-10-15 12:04:47 UTC Source report: https://urlscan.io/result/01a13f73-2700-74ba-8ae9-7dbda9148b5f/ SHA-256: 9df0b2a9029ad9000b78a494facf75ba5cc68dd5a5e0c72093a9287237dea324 ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-20T17:47:29Z", "uuid": "01a13f71-7b2f-739a-b2e5-f7b1e642c8a2", "scanned_at": "2026-10-15T12:02:53Z", "final_url": "https://smart-safety.coinbase-route.com/", "status": 200, "redirected": "https-only", "redirects": [ { "to": "https://smart-safety.coinbase-route.com/", "from": "http://smart-safety.coinbase-route.com/", "status": 307 } ], "ip": "45.119.255.70", "domains": [ "route-pool-9yp6.coin-base-exchange.com", "route-pool-k09u.coin-base-exchange.com", "route-pool-zvw9.coin-base-exchange.com", "route-pool-wzbv.coin-base-exchange.com" ], "ips": [ "45.119.255.88", "45.119.255.70" ], "asns": [ "136209" ], "countries": [ "US" ], "doc_hash": "f87c1ec944a6085ca3ffadf86d351eee21efaa1726dcfeaa4ba82048f26f2a2e", "script_hashes": [ "15f8830f70f458c12b7f55211021992d3724b27647d403905f75c9b43f3aa971" ], "globals": [ "__VUE_INSTANCE_SETTERS__", "__VUE_SSR_SETTERS__", "__VUE__" ], "tls": { "san": [ "smart-safety.coinbase-route.com" ], "cipher": "AES_128_GCM", "issuer": "YR2", "subject": "smart-safety.coinbase-route.com", "protocol": "TLS 1.3", "valid_to": "2027-01-07T07:27:22Z", "valid_from": "2026-10-09T07:27:23Z" }, "domain_age_days": 6, "apex_age_days": 6, "tls_age_days": 6, "tls_valid_days": 89, "requests": 9, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 95, "malicious": true }, "overall": { "tags": [ "phishing" ], "score": 100, "brands": [ "coinbase" ], "malicious": true, "categories": [ "phishing" ] }, "urlscan": { "tags": [ "phishing" ], "score": 100, "brands": [ "Coinbase" ], "malicious": true, "categories": [ "phishing" ] } }, "headers": { "server": "Nginx", "content-type": "text/html" } }, "cf": { "v": 1, "fetched_at": "2026-10-20T18:00:16Z", "uuid": "61b3fbe0-5bc4-41ee-90fd-7b3601607647", "scanned_at": "2026-10-15T12:03:16Z", "final_url": "https://smart-safety.coinbase-route.com/", "status": 200, "history": [ { "url": "https://smart-safety.coinbase-route.com/", "status": 200 } ], "dom_hash": "aea1aa81cc9c18722b885f444e2273209eec5cb2dd7d8bc356ffa6e38fce75ea", "doc_hash": "f87c1ec944a6085ca3ffadf86d351eee21efaa1726dcfeaa4ba82048f26f2a2e", "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "smart-safety.coinbase-route.com", "type": "CNAME", "value": "n7awogzc.gc2026.11cdn.cc" }, { "name": "smart-safety.coinbase-route.com", "type": "CNAME", "value": "n7awogzc.gc2026.11cdn.cc" } ], "dnssec_valid": false, "ip": "137.59.18.85", "whois": { "registrar": "eName Technology Co., Ltd.", "created": "2026-10-07T05:13:10Z", "updated": "2026-10-07T05:15:06Z", "expires": "2027-10-07T05:13:10Z", "nameservers": [ "ns1.ename.net", "ns2.ename.net" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-20T21:11:25Z", "analysis_at": "2026-10-15T12:35:37Z", "stats": { "timeout": 0, "harmless": 54, "malicious": 1, "suspicious": 1, "undetected": 36 }, "detections": { "URLQuery": "suspicious", "ChainPatrol": "malicious" }, "reputation": 0, "registrar": "eName Technology Co., Ltd.", "created": "2026-10-07T05:13:10Z", "expires": "2027-10-07T05:13:10Z", "updated": "2026-10-07T05:15:07Z", "first_seen": "2026-10-09T09:52:13Z", "dns": [ { "ttl": 600, "type": "CNAME", "value": "n7awogzc.gc2026.11cdn.cc" }, { "ttl": 60, "type": "A", "value": "137.59.18.84" }, { "ttl": 599, "type": "CNAME", "value": "n7awogzc.gc2026.11cdn.cc" } ], "dns_at": "2026-10-15T12:41:22Z", "jarm": "21d14d00021d21d00042d43d00000091f9827a8676a9d9f27d421962a09b5d", "cert": { "san": [ "smart-safety.coinbase-route.com" ], "issuer": "Let's Encrypt / YR2", "serial": "61d05be57d0bc73ca89957bf51d4140c6c4", "sha256": "f086577219650c4d74d13dbdecf9a3f284165d5db0ef9f299c24fe811f4e479e", "subject": "smart-safety.coinbase-route.com", "valid_to": "2027-01-07T07:27:22Z", "valid_from": "2026-10-09T07:27:23Z" }, "whois": { "registrar": "eName Technology Co., Ltd.", "registrar_iana_id": "1331", "registrar_url": "http://www.ename.net", "created": "2026-10-07T05:13:10Z", "updated": "2026-10-07T05:15:06Z", "expires": "2027-10-07T05:13:10Z", "status": [ "clientDeleteProhibited", "clientTransferProhibited" ], "nameservers": [ "ns1.ename.net", "ns2.ename.net" ], "dnssec": "unsigned" } } } ```