ChainPatrol
Web-Check 
SOCRadar 
LeakIX 
FBI IC3
Laporkan kejahatan yang dimungkinkan oleh internet di Amerika Serikat
Federal tips line1-800-CALL-FBI
MALICIOUS — CRITICAL
Pemeriksaan phishing dan keamanan 394287coinbase.com
394287coinbase[.]
The domain 394287coinbase.com impersonates the brand Coinbase and has a high threat score of 85/100.
80/100 evidence score · Critical
- VirusTotal
- 0/94
- Blocklists
- 2 · MetaMask, SEAL
- Ketersediaan
- Konten tidak tersedia · HTTP 502
Do not enter credentials, seed phrases, payment details, or personal information on this domain.
Jump to section
Ringkasan laporan
394287coinbase.com — Konten tidak tersedia (HTTP 502). Peniruan identitas merek: Coinbase; Jenis penipuan: Crypto Scam. Ringkasan bukti: VirusTotal 0/94; URLQuery 3 alerts; Spamhaus DBL_PHISH; 2 external blocklist matches (MetaMask, SEAL); PhishDestroy score 80/100. Registrar: NiceNIC.
Analisis terperinci PhishDestroy AI di bawah tetap berbahasa Inggris untuk menjaga catatan forensik asli.
Evidence Analysis
The domain 394287coinbase.com impersonates the brand Coinbase and has a high threat score of 85/100. The site is currently down, indicating it may have been taken down due to its malicious intent. Despite this, no security vendors have flagged the domain as malicious, with a VirusTotal detection count of 0 out of 95. It is listed on three public blocklists, but Google Safe Browsing has not flagged it.
Registered with NiceNIC International Group Co., Limited, the domain was created and first seen on March 14, 2026. The hosting IP is 188.114.97.3. The lack of detections from security vendors suggests it may not have been processed yet, but its high threat score and blocklist presence warrant immediate action. Block the domain at the perimeter and submit a report to the registrar abuse desk.
Stored source results
Recorded verdicts and infrastructure observations for this domain.
VirusTotal
0 det.
URLQuery
3 threat alerts
DNS Security
6/14
URLScan
Sertifikat TLS
Let's Encrypt
Usia
5 mo
Status terpantau
Konten tidak tersedia 502
Daftar Hapus
Terdaftar
Reports Sent
1
Cakupan data12 recorded checks
VirusTotal
checked — no detections recorded
URLQuery
3 threat-system alerts
PhishStats
checked — no match recorded
OTX
no community references
CF Radar
scan completed
URLScan capture
laporan yang disimpan
URLScan verdict
Analisis selesai
Pemblokiran DNS
6/14
TLS
valid certificate, 86d
WHOIS
5 mo old
Tangkapan layar
3 captures · 3 sources
Rantai pengalihan
tidak diselidiki
Intelijen Keamanan Jaringan Registrar context
DNS Provider Blocks
6 / 14
| Detection System | Indicator | Verdict | Alert |
|---|---|---|---|
| Hagezi Threat Feed | 394287coinbase.com |
malicious | Sinkholed |
| DNS4EU | 394287coinbase.com |
malicious | Sinkholed |
| Quad9 DNS | 394287coinbase.com |
malicious | Sinkholed |
Registrar context
NiceNIC
Stored registration data identifies NICENIC INTERNATIONAL GROUP CO., LIMITED (IANA 3765) as the registrar. PhishDestroy maintains separate NiceNIC abuse-report research; registrar association is contextual and is not an independent detection for this domain.
Alur Tanggapan Ancaman Pipeline
Penemuan
Checks
Reports
Ketersediaan
15/15
Ancaman Telah Diterima
394287coinbase.com telah terdeteksi dan dimasukkan ke dalam antrian untuk analisis menyeluruh
URLScan.io Capture
Stored URLScan report with capture artifacts
URLScan Verdict
Analisis URLScan selesai; hasil tangkapan web ini tidak mengubah keputusan ancaman halaman · score 0
Cloudflare Radar Report
A stored Cloudflare Radar report is available. The report link alone is not a malicious verdict and does not prove that every network field was captured.
VirusTotal
94 vendors checked on VirusTotal — no vendor detections recorded at check time
Google Safe Browsing
Checked via Laporan Transparansi Google
Deteksi Daftar Blokir
Ditemukan di 2 blocklists: MetaMask, SEAL
DNS Security Blocks
Blocked by 6 of 14 checked DNS providers: Brand base, Brand coinbase, Controld adblock, Controld family
Registrar Context: NiceNIC
Separate registrar research is available. Registrar association is contextual and is not scored as an independent detection.
Brand Impersonation
Impersonation of Coinbase
Forensic Evidence Collected
Stored evidence from URLScan.io, URLQuery, stored screenshot
Technical Analysis Recorded
Laporan tersebut berisi teknologi tersimpan atau hasil analisis forensik.
Sent Report Recorded
Stored sent-report record for registrar NiceNIC International Group Co., Limited, hosting provider, 1 abuse contact
abuse@nicenic.net
Daftar yang Dihapus Telah Dipublikasikan
Listed in the public PhishDestroy/DestroyList repository
Content Observed Unavailable
Pemeriksaan terakhir yang disimpan menunjukkan bahwa konten yang dilaporkan tidak tersedia; ini tidak menentukan siapa atau apa yang menyebabkan perubahan tersebut.
Status Daftar Blokir Publik
Tangkapan tersimpan
Intelijen Domain
Domain
URLScan Verdict
Analisis selesai
score 0 report ↗
Server / ASN
cloudflare · AS13335 Cloudflare, Inc.
IP Context
Cloudflare shared edge
origin IP hidden
Reputasi Edge-IP tidak dikaitkan dengan domain ini.
Registrar
NiceNIC
(RU)
PhishDestroy Investigation
(RU)
PhishDestroy Investigation
Alamat IP
188.114.97.3
CDN
Lokasi
San Francisco, US
San Francisco, USJaringanAS13335 · Cloudflare, Inc.
IP asal tersembunyi di balik proksi CDN. Hasil IP terbalik untuk alamat edge berisi penyewa yang tidak terkait; menemukan asal memerlukan DNS pasif atau data transparansi sertifikat.
PendaftaranDibuat 14/03/2026 (148d)
Status HTTP502 Error
Rincian teknisDNS, SAN SSL, cap waktu
Pertama Kali Terdeteksi14/03/2026
DOM Analysisanalyzed 24/03/2026score 55/100
IoC Extractionscanned 01/08/20260 wallet · 0 Telegram IoCs
Submitted URLhttp://394287coinbase.com/
Server namakelly.ns.cloudflare.compedro.ns.cloudflare.com
TLS Observationvalid from 11/03/2026scanned 15/03/2026
Case ID
ICANN OVERSIGHT
Akreditasi dan konteks RAA
Akreditasi dan konteks RAA
Registrar accreditation and DNS abuse obligations
For this gTLD, the registrar above operates under an ICANN accreditation agreement. The links below provide the official fee schedule and current DNS abuse compliance guidance.
Accreditation is a contract, not a safety certification.
RAA §3.18 establishes abuse-contact and handling requirements. This report can document stored outbound notices and later technical observations; it does not by itself establish receipt, investigation, remediation, or contractual non-compliance.
Akreditasi adalah kontrak, bukan cap jaminan keamanan.
Verifikasi biaya ICANN
Baca RAA §3.18
PHISHDESTROY INVESTIGATIONICANN funding, contracts, and DNS abuse oversight
Latest Classified Outcome 2026-08-09 03:45:16 UTC
Primary outcome
Registration hold observed
reason: Registrar clientHold 95% confidence
Attribution
NICENIC INTERNATIONAL GROUP CO., LIMITED mechanism: Registrar clientHold source: Rdap Status Collector
Evidence layers
Availability: DNS inactive
Content: Unreachable
DNS: NXDOMAIN
Registration: Registrar clientHold
Latest HTTP observation
Tidak diketahui Origin unreachable Http 5xx 20% 2026-08-09 01:32:55 UTC
RDAP registration
Registrar clientHold NICENIC INTERNATIONAL GROUP CO., LIMITED · IANA 3765 RDAP HTTP 200 source: Rdap Status Collector clientDeleteProhibitedclientHoldclientTransferProhibited expires 2027-03-11 03:23:06 UTC checked 2026-08-09 03:45:16 UTC
Registrar action marker
verified clientHold marker
NICENIC INTERNATIONAL GROUP CO., LIMITED · IANA 3765 causal link to our report not established
Observed timeline
last reachable: 2026-04-05 23:55:00 UTC current episode first observed: 2026-08-05 01:45:38 UTC observed RIP window: 2026-04-05 23:55:00 UTC → 2026-08-05 01:45:38 UTC · 2,905.84h midpoint estimate ≈ 2026-06-05 12:50:19 UTC · precision very low · basis bounded
Availability, content, DNS and registration are independent evidence layers. NXDOMAIN, an unreachable origin or missing content alone does not prove registrar action. A registrar or provider is credited only when a direct technical marker identifies that actor. Report causality is shown separately.
Teknologi · 7 identified
N
Node.js
Programming languages
JavaScript runtime built on Chrome V8 engine for server-side development.
R
React
JavaScript frameworks
JavaScript library for building user interfaces with component-based architecture.
N
Next.js
JavaScript frameworks
SSR
React framework for production with hybrid static and server rendering.
Cloudflare Browser Insights
Analytics
RUM
Performance monitoring tool that measures website speed from real users.
www.cloudflare.com
Cloudflare
CDN
Web infrastructure and security company providing CDN, DDoS mitigation, and DNS services.
www.cloudflare.com
W
Webpack
Build tools
Module bundler for modern JavaScript applications.
H
HTTP/3
Miscellaneous
Third major version of HTTP protocol, built on QUIC for faster, more reliable connections.
Detected via Cloudflare Radar · Wappalyzer engine
Laporkan Domain Ini
Kirimkan bukti & bantu lindungi orang lain
Analisis VirusTotal
0 / Vendor keamanan 94 menandai domain ini
View on VT
Last analyzed
No VirusTotal engine marked the domain malicious in the stored analysis.
Analisis Performa Situs
Google PageSpeed Insights — mobile performance audit of 394287coinbase.com · checked Mar 14, 2026
52
Needs Work
Performance
FCP
0.76s
First Contentful Paint
LCP
10.81s
Largest Contentful Paint
CLS
0
Cumulative Layout Shift
TBT
968ms
Total Blocking Time
SI
3.76s
Speed Index
Powered by Google PageSpeed Insights · Mobile strategy · Scores: 90-100 Good 50-89 Needs Work 0-49 Poor
Bukti & Laporan EksternalIndependent lookups and source reports
Analisis Keamanan
Submitted Evidence Snapshot
Sent: Ledger records: 1
Case ID:
PD-20260314-C0202D Recipient: abuse@nicenic.net, abuse@verisign-grs.com, compliance@icann.org Page title stored with report: 394287coinbase.com/
OSINT & Intelijen
DNS & Jaringan
SEO & Domain
Victim safety and official reportingImmediate actions and verified reporting channels
If credentials were compromised, report immediately. Do not engage with recovery scammers.
Jika Anda memasukkan kredensial akun, informasi pribadi atau pembayaran, atau mengunduh file dari domain ini, segera ambil tindakan. Di bawah ini adalah sumber daya untuk membantu Anda melaporkan insiden tersebut dan melindungi diri Anda sendiri.
Action Fraud
Laporkan penipuan dan kejahatan dunia maya di Inggris, Wales, dan Irlandia Utara
Contact centre0300 123 2040
PhishDestroy listing review Bukan laporan penegakan hukum
Banding atas Nama Domain
Minta peninjauan jika Anda pemilik domain ini dan yakin cantumannya salah
Waspadalah terhadap penipu yang mengatasnamakan pemulihan! Penjahat dapat menghubungi korban lagi sambil berpura-pura menjadi penyelidik, pengacara, atau agen pemulihan. Jangan membayar biaya di muka atau membagikan kredensial. Pelajari lebih lanjut tentang penipuan dalam proses pemulihan →
Laporkan kepada Pihak Berwenang di Daerah Anda
Pilih negara Anda untuk mendapatkan kontak resmi kejahatan dunia maya, atau membuat draf pengaduan →.
Direktori 97 negara
Draf yang dibantu AI — detail insiden diproses oleh penyedia AI
Tinjau dan kirimkan sendiri
Infrastruktur dan Laporan TerkaitStored relationships and adjacent records
Laporan lain tentang edge Cloudflare bersama 6
Laporan-laporan ini diselesaikan dengan IP edge bersama yang sama. Mereka membantu penemuan laporan tetapi tidak menyiratkan kepemilikan bersama atau server asal bersama.
Registrar yang sama: NiceNIC 6
drughubdark.net 
contra.tokens-drop.fun 
spendpartner.app 
app-theindexfi.xyz 
rise.memepage.io Coinbase impersonation 8
These domains also target Coinbase users. View all Coinbase threats →
Laporan ancaman terkini 6
Laporan baru-baru ini ditambahkan dari database PhishDestroy. Tautan penemuan ini tidak berarti infrastruktur atau kepemilikan bersama.
lizsbs.shop 