rss[.]readles[.]at

rss.readles.at is a subdomain of readles.at. PhishDestroy first recorded this hostname on Jun 25, 2026. Stored content metadata identifies Coinbase as the apparent target. The stored content classification is generic phishing. The assembled evidence scores 95/100 (critical).

Four independent sources are positive: VirusTotal, Spamhaus DBL, URLQuery, and URLScan. VirusTotal recorded 18 detections among 91 engines: ADMINUSLabs, alphaMountain.ai, BitDefender, Chong Lua Dao, Cluster25, CRDF, CyRadar, ESET, Forcepoint ThreatSeeker, G-Data, Gridinsoft, Kaspersky, Lionic, MalwareURL, SOCRadar, Sophos, VIPRE, Webroot on Jul 18, 2026 at 20:45 UTC. Spamhaus DBL: DBL_PHISH on Jul 25, 2026 at 18:31 UTC. URLQuery recorded 3 threat-system alerts on Jun 25, 2026 at 12:21 UTC. URLScan returned a malicious verdict with score 100 on Jun 27, 2026 at 08:14 UTC. The evidence is not unanimous. The external blocklist snapshot contained no matches on Aug 7, 2026 at 14:20 UTC. Google Safe Browsing returned no flag on Jun 25, 2026 at 12:20 UTC.

HTTP 502 was recorded on Aug 7, 2026 at 02:10 UTC; content was unavailable. The recorded creation date for the registrable domain readles.at is Apr 7, 2026. At collection time, the hostname resolved to 31.59.121.53 on AS56971 (AS56971 CGI GLOBAL LIMITED, HK). The associated network metadata labels the endpoint as AS56971 AS56971 Cloud in Riga, LV. The stored server header is nginx. Captured page title: “Coinbase Card”. DOM analysis completed on Jun 25, 2026 at 14:20 UTC; stored DOM score 0/100. The evidence archive retains 3 visual captures from PhishDestroy, URLScan, and URLQuery. IoC extraction completed on Jul 29, 2026 at 02:51 UTC; stored 0 format-validated wallet addresses and 0 Telegram indicators. TLS metadata lists Let's Encrypt / YR2 as the certificate issuer with validity through Sep 4, 2026; checked Jun 25, 2026 at 13:00 UTC.

The 0/100 DOM score means that the DOM pass stored no scored indicators; it does not negate the independent source findings. Taken together, the page content and independent findings support classifying this hostname as Coinbase-themed generic phishing.