invoice-coinbase[.]com

invoice-coinbase.com entered the PhishDestroy evidence set on Feb 26, 2026. The hostname explicitly references Coinbase; stored content metadata identifies the same apparent target. The stored content classification is crypto scam. The assembled evidence scores 68/100 (elevated).

One independent source is positive: VirusTotal. VirusTotal recorded 6 detections among 95 engines: alphaMountain.ai, BitDefender, CyRadar, Fortinet, G-Data, Webroot on Feb 23, 2026 at 07:13 UTC. The evidence is not unanimous. The external blocklist snapshot contained no matches on Aug 7, 2026 at 18:20 UTC. URLQuery recorded no positive detection. Google Safe Browsing returned no flag on Mar 3, 2026 at 04:14 UTC. URLScan completed without a malicious verdict (score 0).

HTTP 502 was recorded on Aug 7, 2026 at 01:18 UTC; content was unavailable. The recorded creation date for the domain is Feb 21, 2026. Registration preceded first observation by 5 days. At collection time, the hostname resolved to 45.89.110.15 on AS44477 (THE-HOSTING PQ HOSTING PLUS S.R.L., MD). The associated network metadata labels the endpoint as AS209847 WorkTitans B.V. in Meppel, NL. The stored server header is nginx/1.24.0 (Ubuntu). Captured page title: “AMLBot - Comprehensive Crypto Compliance Solution | Free AML Crypto Check”. DOM analysis completed on Mar 23, 2026 at 23:11 UTC; stored DOM score 63/100. The evidence archive retains 2 visual captures from PhishDestroy and URLScan. IoC extraction completed on Aug 1, 2026 at 04:26 UTC; stored 0 format-validated wallet addresses and 0 Telegram indicators. TLS metadata lists E6 as the certificate issuer.