# PhishDestroy domain threat record: web.webmetacoinsksjj.io Content language: English Canonical HTML report: https://phishdestroy.io/domain/web.webmetacoinsksjj.io/ Machine-readable companion: https://phishdestroy.io/domain/web.webmetacoinsksjj.io/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: not observed active - First observed by PhishDestroy: 2026-10-25 16:23:56 UTC - Last availability or vendor check: 2026-10-25 23:00:26 UTC - Stored record updated: 2026-10-25 23:25:14 UTC - VirusTotal detections in the stored snapshot: 0/92 - Independent public blocklist matches in the stored snapshot: 2 - Matching public blocklists: MetaMask, SEAL - Google Safe Browsing stored result: no stored flag ## Stored classification - Targeted brand: hsbc ## Stored infrastructure - Observed IP address: 104.21.72.101 - Registrar in stored WHOIS data: GNAME.COM PTE. LTD. - Last stored HTTP status: 403 - Registration date in stored WHOIS data: 2026-10-22 06:27:35 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a169a3-e7a3-71a9-b610-ef659f6e3461/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/web.webmetacoinsksjj.io - Certificate Transparency search: https://crt.sh/?q=%25.web.webmetacoinsksjj.io - Web Archive lookup: https://web.archive.org/web/*/https://web.webmetacoinsksjj.io/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview PhishDestroy added web.webmetacoinsksjj.io to its blocklist on 2026-10-25 after URLScan classified the site as malicious. The recorded page title is "Consensys". An internal AI assessment performed on the same day could not extract sufficient page content and returned an unknown verdict. A page fetch on 2026-10-25 returned HTTP 200 with no cross‑site redirects. How the scam works The listing falls under a generic phishing risk where attackers create pages that appear to belong to a known brand to lure users into revealing credentials or personal data. No specific credential‑harvesting form or wallet request was observed on the captured page. Evidence URLScan scanned the site on 2026-10-23 and issued an overall malicious verdict with a score of 100, categorising it as phishing and tagging it as a crypto‑scam. VirusTotal checked the domain on 2026-10-25 with 92 engines and reported zero malicious or suspicious detections. Google Safe Browsing on 2026-10-25 did not flag the URL. OTX recorded zero pulses on 2026-10-25, and external blocklists showed no entries as of that date. PhishDestroy’s internal list marked the domain as blocked on 2026-10-25. Infrastructure The domain and its apex were first seen on 2026-10-22, giving them an age of one day at the time of observation. The TLS certificate, issued by Let’s Encrypt on 2026-10-22, is valid for 89 days and covers *.webmetacoinsksjj.io. Recorded IP addresses 104.21.72.101 and 172.67.181.30 belong to the Cloudflare network and were recorded in Canada. What to do Do not enter any credentials or personal information on the site; if you have already done so, change the affected passwords and monitor accounts for suspicious activity. Report the incident to PhishDestroy and consider blocking the exact domain in your security controls. Defenders should add the domain to blocklists and review access logs for connections to the recorded IP addresses. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a169a3-e7a3-71a9-b610-ef659f6e3461/ Cloudflare Radar report: https://radar.cloudflare.com/scan/2431c46c-30e6-499f-b2bb-8da65a223c54 Stored capture screenshot: https://urlscan.io/screenshots/01a169a3-e7a3-71a9-b610-ef659f6e3461.png Cloudflare Radar screenshot (2026-10-25T16:26:57Z): https://screenshots.phishdestroy.io/cf/2431c46c-30e6-499f-b2bb-8da65a223c54.png URLScan screenshot (2026-10-23T16:21:34Z): https://screenshots.phishdestroy.io/us/01a16991-1d0a-72df-bba8-830bef7a26f5.png URLScan capture report: https://urlscan.io/result/01a16991-1d0a-72df-bba8-830bef7a26f5/ VirusTotal report: https://www.virustotal.com/gui/domain/web.webmetacoinsksjj.io Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=web.webmetacoinsksjj.io Archived copy: https://web.archive.org/web/20261025162523/https://web.webmetacoinsksjj.io/ Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-25 17:05:51 UTC ## Stored page captures - Primary capture: https://urlscan.io/screenshots/01a169a3-e7a3-71a9-b610-ef659f6e3461.png Captured: 2026-10-25 16:23:56 UTC - URLScan capture: https://screenshots.phishdestroy.io/01a169a3-e7a3-71a9-b610-ef659f6e3461.png Source report: https://urlscan.io/result/01a169a3-e7a3-71a9-b610-ef659f6e3461/ - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/2431c46c-30e6-499f-b2bb-8da65a223c54.png Captured: 2026-10-25 16:26:57 UTC Source report: https://radar.cloudflare.com/scan/2431c46c-30e6-499f-b2bb-8da65a223c54 SHA-256: 3a770c63dd9e4c49f44d93ebb92aa24b15f89e728a2486457a0db85889bc572c - URLScan · 2026-10-23: https://screenshots.phishdestroy.io/us/01a16991-1d0a-72df-bba8-830bef7a26f5.png Captured: 2026-10-23 16:21:34 UTC Source report: https://urlscan.io/result/01a16991-1d0a-72df-bba8-830bef7a26f5/ SHA-256: b3006af9a03b011dfa5581edf32d0e7f44406ec4b811d1ef7ab95a8ab8396a35 ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-25T16:29:17Z", "uuid": "01a169a3-e7a3-71a9-b610-ef659f6e3461", "scanned_at": "2026-10-23T16:42:06Z", "final_url": "https://web.webmetacoinsksjj.io/", "status": 200, "ip": "172.67.181.30", "domains": [ "webapi.webmetacoinsksjj.io", "e001-img.oss-cn-hongkong.aliyuncs.com", "storage.googleapis.com", "static.cloudflareinsights.com" ], "ips": [ "173.194.114.207", "47.79.64.187", "104.16.80.73", "172.67.181.30" ], "asns": [ "15169", "45102", "13335" ], "countries": [ "US", "HK" ], "doc_hash": "b63d766552424c5b3af872c4af02e902cc27e726c7ae03d541e210159e0620a1", "script_hashes": [ "bcee984fd52b4a82bd6b23543bb33f6472e076c125edbdd8756d29ca230628cb", "bf5b098dea87dc0860a060ab4f59359c974d9b752cbfbeb35cbd44193621fae8", "f49f5a0ed02f7c3dbb9a0bf55e82a499556784d2c99355dbdd7a29ae4bc1c17f", "157a8d0cbcd779fe0b080d27cf0520de5401f1877bb50deb9259677e6f2985a3", "d6c72810f29c141da02fbed8774de155f96a3ab546503aa65e45f9c6bbdd24be", "08256c0fee53294dea0b914d88ee051bf28994310d74862973724ac7409630ac", "4cc6f329284c55719268ca267c3fd3634cc3ffb1ae6e8d92834b01bc7e036678", "ef27a6ffd486ce80c0e21284cd0e59cc0d914d20504ea5551c455fa017ebee01", "79b030211d34aaa1940016f70c33fd75499d9a1f3b7b4c7c7095cb63cd1bfd32", "02e7dff76939803c4338c66ca52553e7c5f6921fd4d52dcc7399a3c13bb0e287" ], "globals": [ "TradingView", "addLink", "addMeta", "lib", "rem", "dpr", "__INTLIFY_PROD_DEVTOOLS__", "__INTLIFY_JIT_COMPILATION__", "__INTLIFY_DROP_MESSAGE_COMPILER__", "PubSub", "__VUE_INSTANCE_SETTERS__", "__VUE_I18N_FULL_INSTALL__", "__VUE_I18N_LEGACY_API__", "__config", "__theme", "__VUE__", "__vite_is_modern_browser", "__cfBeacon" ], "storage_keys": [ "lastRefreshTime", "dev_THEME", "main", "dev_LANGUAGE", "user" ], "tls": { "san": [ "*.webmetacoinsksjj.io", "webmetacoinsksjj.io" ], "cipher": "AES_128_GCM", "issuer": "YE2", "subject": "webmetacoinsksjj.io", "protocol": "QUIC", "valid_to": "2027-01-20T07:51:12Z", "valid_from": "2026-10-22T07:51:13Z" }, "domain_age_days": 1, "apex_age_days": 1, "tls_age_days": 1, "tls_valid_days": 89, "requests": 102, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 93, "malicious": true }, "overall": { "tags": [ "phishing" ], "score": 100, "brands": [ "cryptoscam" ], "malicious": true, "categories": [ "phishing" ] }, "urlscan": { "tags": [ "phishing" ], "score": 100, "brands": [ "Crypto Scam" ], "malicious": true, "categories": [ "phishing" ] } }, "headers": { "server": "cloudflare", "content-type": "text/html", "strict-transport-security": "max-age=31536000" } }, "cf": { "v": 1, "fetched_at": "2026-10-25T16:29:18Z", "uuid": "2431c46c-30e6-499f-b2bb-8da65a223c54", "scanned_at": "2026-10-25T16:26:57Z", "final_url": "https://web.webmetacoinsksjj.io/", "status": 200, "history": [ { "url": "https://web.webmetacoinsksjj.io/", "status": 200 } ], "dom_hash": "b54ba9e8436f74f2aea599beece139e18646944ad4e28e79169511af5a0c34a2", "doc_hash": "b63d766552424c5b3af872c4af02e902cc27e726c7ae03d541e210159e0620a1", "phishing_v2": [ "phishing" ], "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "web.webmetacoinsksjj.io", "type": "A", "value": "172.67.181.30" }, { "name": "web.webmetacoinsksjj.io", "type": "A", "value": "104.21.72.101" }, { "name": "web.webmetacoinsksjj.io", "type": "AAAA", "value": "2606:4700:3036::ac43:b51e" }, { "name": "web.webmetacoinsksjj.io", "type": "AAAA", "value": "2606:4700:3031::6815:4865" }, { "name": "webapi.webmetacoinsksjj.io", "type": "A", "value": "104.21.72.101" }, { "name": "webapi.webmetacoinsksjj.io", "type": "A", "value": "172.67.181.30" }, { "name": "webapi.webmetacoinsksjj.io", "type": "AAAA", "value": "2606:4700:3031::6815:4865" }, { "name": "webapi.webmetacoinsksjj.io", "type": "AAAA", "value": "2606:4700:3036::ac43:b51e" } ], "dnssec_valid": false, "ip": "172.67.181.30", "whois": { "registrar": "GNAME.COM PTE. LTD.", "created": "2026-10-22T08:27:35Z", "updated": "2026-10-22T08:33:43Z", "expires": "2027-10-22T08:27:35Z", "nameservers": [ "alex.ns.cloudflare.com", "marjory.ns.cloudflare.com" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-25T17:02:15Z", "analysis_at": "2026-10-25T15:23:40Z", "stats": { "timeout": 0, "harmless": 56, "malicious": 0, "suspicious": 0, "undetected": 36 }, "reputation": 0, "registrar": "GNAME.COM PTE. LTD.", "created": "2026-10-22T08:27:35Z", "expires": "2027-10-22T08:27:35Z", "updated": "2026-10-22T08:33:43Z", "first_seen": "2026-10-22T08:59:18Z", "dns": [ { "ttl": 300, "type": "AAAA", "value": "2606:4700:3036::ac43:b51e" }, { "ttl": 300, "type": "A", "value": "104.21.72.101" }, { "ttl": 300, "type": "AAAA", "value": "2606:4700:3031::6815:4865" }, { "ttl": 300, "type": "A", "value": "172.67.181.30" } ], "dns_at": "2026-10-25T15:23:56Z", "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c", "cert": { "san": [ "*.webmetacoinsksjj.io", "webmetacoinsksjj.io" ], "issuer": "Let's Encrypt / YE2", "serial": "62562d8aead6cd9f9e90487722c17891a59", "sha256": "6caea3ed81281376cba38f43c43000be02dc8c56517923b3a371d85a5c9297dc", "subject": "webmetacoinsksjj.io", "valid_to": "2027-01-20T07:51:12Z", "valid_from": "2026-10-22T07:51:13Z" }, "whois": { "registrar": "GNAME.COM PTE. LTD.", "registrar_iana_id": "1923", "registrar_url": "www.gname.com", "created": "2026-10-22T08:27:35Z", "updated": "2026-10-22T08:33:43Z", "expires": "2027-10-22T08:27:35Z", "status": [ "addPeriod", "clientTransferProhibited" ], "nameservers": [ "alex.ns.cloudflare.com", "marjory.ns.cloudflare.com" ], "dnssec": "unsigned" } }, "webcheck": { "v": 1, "fetched_at": "2026-10-25T16:29:41Z", "caa_records": { "domain": "web.webmetacoinsksjj.io" }, "block_lists": { "resolvers": 12, "blocked_count": 0 }, "archives": { "last": "2026-10-25T16:25:23Z", "first": "2026-10-25T16:25:23Z", "changes": 0, "days_archived": 1, "avg_page_bytes": 4485 }, "social_tags": { "title": "Consensys", "robots": "all", "ogImage": "/platform/dev/logo_144.png?2.0.1789493428206", "ogTitle": "Consensys", "keywords": "DEV_KEYWORDS", "themeColor": "#ffffff", "description": "DEV_DESCRIPTION", "ogDescription": "DEV_DESCRIPTION" }, "trackers": { "requests": 26 }, "mixed_content": { "third_party_scripts": 0 }, "status": { "up": true, "code": 200, "timings": { "dns": 15, "tls": 54, "wait": 1061, "connect": 54, "download": 0 }, "response_ms": 1184 }, "tls_connection": { "alpn": "h2", "cipher": "TLS_AES_256_GCM_SHA384", "protocol": "TLSv1.3", "versions": [ "TLSv1", "TLSv1.1", "TLSv1.2", "TLSv1.3" ], "authorized": true, "forward_secrecy": true }, "ports": { "open": [ 80, 443, 8080 ] }, "carbon": { "bytes": 9413, "co2_grams": 0.0003, "cleaner_than": 73 }, "dns_server": { "ns": [ { "ip": "108.162.193.100", "host": "alex.ns.cloudflare.com" }, { "ip": "172.64.32.193", "host": "marjory.ns.cloudflare.com" } ], "zone": "webmetacoinsksjj.io" }, "location": { "ip": "2606:4700:3036::ac43:b51e", "asn": "13335", "org": "Cloudflare, Inc.", "city": "Toronto", "country": "CA" }, "ssl": { "issuer": "Let's Encrypt / YE2", "subject": "webmetacoinsksjj.io" }, "dns": { "A": [ "172.67.181.30", "104.21.72.101" ], "AAAA": [ "2606:4700:3036::ac43:b51e", "2606:4700:3031::6815:4865" ] }, "dnssec": { "ds": false, "rrsig": false, "dnskey": false }, "hsts": { "header": "max-age=31536000", "message": "HSTS header does not include all subdomains." }, "http_security": { "xFrameOptions": false, "referrerPolicy": false, "xXSSProtection": false, "permissionsPolicy": false, "xContentTypeOptions": false, "contentSecurityPolicy": false, "strictTransportPolicy": "max-age=31536000", "crossOriginOpenerPolicy": false, "crossOriginEmbedderPolicy": false, "crossOriginResourcePolicy": false }, "firewall": { "waf": "Cloudflare", "has_waf": true }, "get_ip": { "ip": "2606:4700:3036::ac43:b51e", "family": 6 }, "redirects": { "chain": [ "https://web.webmetacoinsksjj.io" ] }, "subdomains": { "count": 1, "subdomains": [ "web.webmetacoinsksjj.io" ] }, "whois": { "registrar": "GNAME.COM PTE. LTD.", "created": "2026-10-22T08:27:35Z", "updated": "2026-10-22T08:33:43Z", "expires": "2027-10-22T08:27:35Z", "status": [ "clientTransferProhibited https://icann.org/epp", "addPeriod https://icann.org/epp" ], "nameservers": [ "alex.ns.cloudflare.com", "marjory.ns.cloudflare.com" ] }, "headers": { "headers": { "server": "cloudflare", "content-type": "text/html", "strict-transport-security": "max-age=31536000" } } } } ```