supportcoinbase[.]es

PhishDestroy first observed supportcoinbase.es on Oct 23, 2025. The hostname explicitly references Coinbase; stored content metadata identifies the same apparent target. The captured page title is “Página por defecto”. Page analysis recorded additional brand references to Wordpress. Stored page analysis classifies the content as crypto scam. Current evidence score: 77/100 (critical).

Positive findings are stored from 2 sources: VirusTotal and Spamhaus DBL. VirusTotal recorded 9 detections among 91 engines: ChainPatrol, alphaMountain.ai, BitDefender, Chong Lua Dao, CRDF, CyRadar, Fortinet, G-Data, Gridinsoft on Aug 1, 2026 at 02:48 UTC. Spamhaus DBL: DBL_PHISH on Jul 14, 2026 at 18:36 UTC. Non-positive and contextual checks: The external blocklist snapshot contained no matches on Aug 7, 2026 at 22:20 UTC. URLQuery recorded no positive detection; no observation timestamp was retained. Google Safe Browsing returned no flag on Mar 3, 2026 at 04:14 UTC. URLScan completed without a malicious verdict (score 0) on Jul 29, 2026 at 03:37 UTC.

HTTP 502 server error was recorded on Aug 7, 2026 at 22:15 UTC. Registration records for the domain list HOSTINGER operations, UAB as the registrar. At collection time, the hostname resolved to 82.25.113.245 on AS47583 (AS-HOSTINGER Hostinger International Limited, CY). The recorded endpoint location is Paris, FR. The stored server header is LiteSpeed. DOM analysis on Apr 23, 2026 at 15:22 UTC returned 10/100. The evidence archive retains 2 visual captures from PhishDestroy and URLScan.

The content indicators and 2 positive source findings support the current Coinbase-themed crypto scam classification.