ashot-coinbase[.]com

PhishDestroy first observed ashot-coinbase.com on Apr 30, 2026. The hostname explicitly references Coinbase; stored content metadata identifies the same apparent target. The captured page title is “ashot-coinbase.com”. Stored page analysis classifies the content as brand impersonation. Current evidence score: 100/100 (critical).

Positive findings are stored from 7 sources: VirusTotal, MetaMask, SEAL, Spamhaus DBL, DNS security resolvers, Cloudflare Radar, and URLQuery. VirusTotal recorded 19 detections among 91 engines: ADMINUSLabs, alphaMountain.ai, BitDefender, Cluster25, CRDF, CyRadar, ESET, Emsisoft, Fortinet, G-Data, Gridinsoft, Kaspersky, Lionic, Netcraft, Seclookup, SOCRadar, Sophos, VIPRE, Webroot on Jul 18, 2026 at 14:45 UTC. MetaMask and SEAL listed the hostname in the external-blocklist snapshot on Aug 7, 2026 at 22:20 UTC. Spamhaus DBL: DBL_PHISH on Jul 13, 2026 at 18:31 UTC. DNS security checks returned 8 blocking results across 14 tested policies: Brand Base, Brand Coinbase, Cloudflare Family, Cloudflare Security, Control D Adblock, Control D Family, Control D Malware, Quad9 Secure; no observation timestamp was retained. Cloudflare Radar classified the hostname as malicious and assigned the categories security threats, phishing, and security risks; its verdict timestamp was not retained. URLQuery recorded 2 detections; no observation timestamp was retained. Non-positive and contextual checks: ScamAdviser assigned a trust score of 1/100 (Very Likely Unsafe); no observation timestamp was retained. On Apr 30, 2026 at 11:47 UTC, Google Safe Browsing returned no flag; PhishStats returned no feed match. URLScan completed without a malicious verdict (score 0) on Jul 29, 2026 at 03:06 UTC.

HTTP 200 was recorded on Aug 7, 2026 at 22:14 UTC. Latest classified outcome: inactive; cause hosting placeholder; mechanism placeholder page on Aug 6, 2026 at 23:47 UTC. Registration records for the domain list NICENIC INTERNATIONAL GROUP CO., LIMITED as the registrar and Apr 30, 2026 as the creation date. Registration and first observation occurred on the same UTC date. At collection time, the hostname resolved to 185.105.33.106 on AS43927 (HOSTERION SRL). The recorded endpoint location is Enfield, GB. The stored server header is nginx. The evidence archive retains 2 visual captures from PhishDestroy and URLScan. TLS metadata lists PhishDestroy / botadmin.destroy.tools as the certificate issuer with validity through Jan 6, 2036; checked May 4, 2026 at 12:21 UTC.

The content indicators and 7 positive source findings support the current Coinbase-themed brand impersonation classification.