{"report_id":"bae5e736-40a8-4260-9b8b-c49f44aac6e1","version":0,"status":"done","tags":["coinbase","crypto","phishing"],"date":"2026-08-13T23:50:04Z","url":{"schema":"http","addr":"coinbase.ct.ws/","fqdn":"coinbase.ct.ws","domain":"ct.ws","tld":"ws"},"ip":{"addr":"185.27.134.98","port":0,"asn":34119,"as":"Wildcard UK Limited","country":"United Kingdom","country_code":"GB"},"final":{"url":{"schema":"https","addr":"coinbase.ct.ws/signin?client_id=6a7e5810bfe4f-6a7e5810bfe51-6a7e5810bfe52-6a7e5810bfe53\u0026oauth_challenge=6a7e5810bfe54-6a7e5810bfe55-6a7e5810bfe56-6a7e5810bfe57","fqdn":"coinbase.ct.ws","domain":"ct.ws","tld":"ws"},"title":"Coinbase - Sign In","dom":{"size":1459671,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text, with very long lines (41230)","md5":"f981e429bbf8950cb902738d9f6da82d","sha1":"5069d4af0d0be20bc3820491ad5a806b27dabb2e","sha256":"0251c2ff38aff538a73ecfb8e9957c96dbdbdc39610c4f096c670752f1cc37cb","sha512":"8f6a5a171361d4e7a6f9afdde6cd015b5fc14f31517b35f0a6d65770a737ad2be6f9ef4020a81192bf395119ea9ea17ce58431b0ef05a9fc6f837c709bad77da","ssdeep":"24576:NgOl9Gex+FKM5/TyQeccGGH+te57+CnBVJmMfk:eOiEFvTBc","tlshash":"f865d0b2492265385c2765fd62eb3f076a24b017c500edd8becd2186cfcbab9d531789","dom_hash":"domhashd0c3ea2bb0a15b4443ff5410ea7d0d87","first_seen":"2026-08-13T23:50:09.782007Z","last_seen":"2026-08-13T23:50:09.782007Z","times_seen":1,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"coinbase.ct.ws/","fqdn":"coinbase.ct.ws","domain":"ct.ws","tld":"ws"},"ip":{"addr":"185.27.134.98","port":0,"asn":34119,"as":"Wildcard UK Limited","country":"United Kingdom","country_code":"GB"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-09-17T23:50:04Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":2,"analyzer":3}},"detection":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-08-13","alert":"Sinkholed","trigger":"coinbase.ct.ws","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-13","alert":"Sinkholed","trigger":"coinbase.ct.ws","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-13","alert":"Sinkholed","trigger":"coinbase.ct.ws","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Coinbase","verdict":"phishing","severity":"medium","comment":"Associated with Coinbase phishing","tags":["coinbase","crypto","phishing"],"meta":null},{"sensor_name":"urlquery","alert":"Phishing - Coinbase","verdict":"phishing","severity":"medium","comment":"Associated with Coinbase phishing","tags":["coinbase","crypto","phishing"],"meta":null}]},"summary":[{"fqdn":"coinbase.ct.ws","ip":{"addr":"185.27.134.98","port":443,"asn":34119,"as":"Wildcard UK Limited","country":"United Kingdom","country_code":"GB"},"domain_registered":"2024-11-01","domain_rank":0,"first_seen":"2026-08-13T23:37:47.602398Z","last_seen":"2026-08-13T23:37:47.602398Z","alert_count":40,"request_count":10,"received_data":1405214,"sent_data":6692,"comment":"","tags":null,"fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]}]},{"fqdn":"ipapi.co","ip":{"addr":"104.26.9.44","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2016-04-19","domain_rank":7936,"first_seen":"2017-01-31T09:07:01Z","last_seen":"2026-08-13T02:30:49.996096Z","alert_count":0,"request_count":4,"received_data":10118,"sent_data":1816,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Coinbase","verdict":"phishing","severity":"medium","comment":"Associated with Coinbase phishing","tags":["coinbase","crypto","phishing"],"meta":null}]},"javascript":{"script":[{"url":{"schema":"https","addr":"coinbase.ct.ws/aes.js","fqdn":"coinbase.ct.ws","domain":"ct.ws","tld":"ws"},"ip":{"addr":"185.27.134.98","port":443,"asn":34119,"as":"Wildcard UK Limited","country":"United Kingdom","country_code":"GB"},"introduction_type":"scriptElement","is_inline":false,"md5":"fc66e046447092c606f2587837f96874","sha1":"fcf354a8044f494ee1f9fe868dde3f570f50e593","sha256":"5069425b121346b36f730910d05402d50920fc2178b01e0c878b71af4ef1eb96","sha512":"51cd149b2876e90621afc579fb172e253548a851d4c202181e1faba812f5beb1ae9ccf9f153137f60c569e05a79dcb272176e0126eceac54316208d2699a689f","ssdeep":"192:4hsoEj776Bn/tnHcgaollys/6+EgH3JLg7oLu0MyMVu:i50/3xoGs/jE839g2FB1","tlshash":"355200c203894a7cf2c92ed68c2f605620f3e54a3d251249efb399dbbc77d895075a36","size":13733,"data":"","first_seen":"2023-10-15T19:29:47Z","last_seen":"2026-08-14T00:24:28.79002Z","times_seen":8477,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"coinbase.ct.ws/","fqdn":"coinbase.ct.ws","domain":"ct.ws","tld":"ws"},"ip":{"addr":"185.27.134.98","port":443,"asn":34119,"as":"Wildcard UK Limited","country":"United Kingdom","country_code":"GB"},"introduction_type":"scriptElement","is_inline":true,"md5":"b6a2999682d0d90817a2608e06aa64b1","sha1":"88c04310182f24782d2cc3e7d1002c2da527a254","sha256":"11254e43ade55cc8b5b4fe29fcda0addc4027ffc7b2e16de4bb2fa7018ee862f","sha512":"181aab306a1f6c5b328877869b1580f67ba9cad2f80e0458cea192b1b41287c6d1de77995176a9d87cbb0c1991bc7dcfd988198e889bc15f3b5f653a4b6a1146","ssdeep":"","tlshash":"e1f04774e031b0d84bc11046083b920f90321aa6f043c1efc04652605581adc0644d5f","size":602,"data":"","first_seen":"2026-08-13T23:37:50.173561Z","last_seen":"2026-08-13T23:50:09.795336Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"coinbase.ct.ws/signin?client_id=6a7e5810bfe4f-6a7e5810bfe51-6a7e5810bfe52-6a7e5810bfe53\u0026oauth_challenge=6a7e5810bfe54-6a7e5810bfe55-6a7e5810bfe56-6a7e5810bfe57","fqdn":"coinbase.ct.ws","domain":"ct.ws","tld":"ws"},"ip":{"addr":"185.27.134.98","port":443,"asn":34119,"as":"Wildcard UK Limited","country":"United Kingdom","country_code":"GB"},"introduction_type":"scriptElement","is_inline":true,"md5":"6704065b3a2d6b72a3a5652af7fe1fe4","sha1":"269764aa6e322b186fba904ab392e8be673881ca","sha256":"929b3a8dbff2f5dbd3da1e5b6dd859b589804770d18a9ddbb308260c08786bb1","sha512":"5958d32e40d4ab9c7200f0bf6e2fa0b63c8083c78c5922c1eb0b8a561417bab0537ae9de39716aadb9f907b0eff8677c5629600745c8c72014ea529822901eb4","ssdeep":"","tlshash":"57313a2616b322a63d4bb0fe5abad84d763b5007d9095450788ed1885f70b3505f77cc","size":1661,"data":"","first_seen":"2026-08-08T12:10:31.081024Z","last_seen":"2026-08-13T23:50:09.796864Z","times_seen":4,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"coinbase.ct.ws/signin?client_id=6a7e5810bfe4f-6a7e5810bfe51-6a7e5810bfe52-6a7e5810bfe53\u0026oauth_challenge=6a7e5810bfe54-6a7e5810bfe55-6a7e5810bfe56-6a7e5810bfe57","fqdn":"coinbase.ct.ws","domain":"ct.ws","tld":"ws"},"ip":{"addr":"185.27.134.98","port":443,"asn":34119,"as":"Wildcard UK Limited","country":"United Kingdom","country_code":"GB"},"introduction_type":"scriptElement","is_inline":true,"md5":"3022a143a45602434569543c5b871226","sha1":"b47a23091d6bb4105af2a3f51d8c0be00436a86b","sha256":"e8c652faf1f577043f3d5a5c7f4909701d3a192c402764181e2a89fd048ddb13","sha512":"5c492d0dfd8cc69708ed8eea087353bbf3fe4315cd66605344c5609aef2b4a0be337d9113c4c817ee72b179b0374e1057643a9ab19c401ff8fe21120ac380ed9","ssdeep":"","tlshash":"9f216aabb4b221f14afbb03d73eba614353601477c05ec853e1c4e044f54e6daea2798","size":1257,"data":"","first_seen":"2026-08-13T23:37:50.175329Z","last_seen":"2026-08-13T23:50:09.79772Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"coinbase.ct.ws/static/heartbeat.js","fqdn":"coinbase.ct.ws","domain":"ct.ws","tld":"ws"},"ip":{"addr":"185.27.134.98","port":443,"asn":34119,"as":"Wildcard UK Limited","country":"United Kingdom","country_code":"GB"},"introduction_type":"scriptElement","is_inline":false,"md5":"ee79f8610e00fec02bb7aa1ae9203de3","sha1":"29cb371a98420599dd30f2812f57062ff2b3181a","sha256":"966c3a06278444545a7c03198d2ca002406fd502b1fe14f138bc9e4866303874","sha512":"6c04376812ee115624dd7a8925f0999f9bff831c60bb051a497612b5a34f032dd46626c82a797d5406945607f67a82c6ce8a6c330629de97ee0cfb026cc77498","ssdeep":"","tlshash":"0d410d9d1912402d8db7723a9983c609fe2327379a4f9505385d0a802ff1bb98281ffc","size":1893,"data":"","first_seen":"2024-08-26T23:58:00Z","last_seen":"2026-08-13T23:50:09.78872Z","times_seen":35,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"coinbase.ct.ws/static/crawler.js","fqdn":"coinbase.ct.ws","domain":"ct.ws","tld":"ws"},"ip":{"addr":"185.27.134.98","port":443,"asn":34119,"as":"Wildcard UK Limited","country":"United Kingdom","country_code":"GB"},"introduction_type":"scriptElement","is_inline":false,"md5":"8b8a589fb9ac9c727cdf8208f30e9aef","sha1":"910c4d79b6a97b0655cc0657a030f09e3ce6c618","sha256":"9ee806ce0127afd9501c51148cfda24f92afc9ca798a4522c545683a9ddc5f5a","sha512":"7b254d78d688cba6f4318a7e202c863cf634e1fc05c94c64d3313a8764e70aa6336f87185eda62ad29502fbc9c295ade8cfab8b82fac95dbf0e121cd954ffea0","ssdeep":"","tlshash":"ae31ca1c3bb2027006a7c05a4baeeb0530681757e822d868b4fd5848bfe3f5237e3d94","size":1753,"data":"","first_seen":"2024-08-26T23:58:00Z","last_seen":"2026-08-13T23:50:09.791451Z","times_seen":55,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":[{"level":"log","text":"Heartbeat status:map[actor:server1.conn0.watcher17.process7//obj123 class:Object extensible:true frozen:false isError:false ownPropertyLength:2 preview:map[kind:Object ownProperties:map[page:map[configurable:true enumerable:true value:map[type:null] writable:true] status:map[configurable:true enumerable:true value:success writable:true]] ownPropertiesLength:2] sealed:false type:object]","filename":"https://coinbase.ct.ws/static/heartbeat.js","line_number":23,"column_number":25},{"level":"log","text":"Heartbeat status:map[actor:server1.conn0.watcher17.process7//obj124 class:Object extensible:true frozen:false isError:false ownPropertyLength:2 preview:map[kind:Object ownProperties:map[page:map[configurable:true enumerable:true value:map[type:null] writable:true] status:map[configurable:true enumerable:true value:success writable:true]] ownPropertiesLength:2] sealed:false type:object]","filename":"https://coinbase.ct.ws/static/heartbeat.js","line_number":23,"column_number":25},{"level":"log","text":"Heartbeat status:map[actor:server1.conn0.watcher17.process7//obj125 class:Object extensible:true frozen:false isError:false ownPropertyLength:2 preview:map[kind:Object ownProperties:map[page:map[configurable:true enumerable:true value:map[type:null] writable:true] status:map[configurable:true enumerable:true value:success writable:true]] ownPropertiesLength:2] sealed:false type:object]","filename":"https://coinbase.ct.ws/static/heartbeat.js","line_number":23,"column_number":25},{"level":"log","text":"Heartbeat status:map[actor:server1.conn0.watcher17.process7//obj126 class:Object extensible:true frozen:false isError:false ownPropertyLength:2 preview:map[kind:Object ownProperties:map[page:map[configurable:true enumerable:true value:map[type:null] writable:true] status:map[configurable:true enumerable:true value:success writable:true]] ownPropertiesLength:2] sealed:false type:object]","filename":"https://coinbase.ct.ws/static/heartbeat.js","line_number":23,"column_number":25}]},"http":[{"url":{"schema":"https","addr":"coinbase.ct.ws/signin/callback","fqdn":"coinbase.ct.ws","domain":"ct.ws","tld":"ws"},"ip":{"addr":"185.27.134.98","port":443,"asn":34119,"as":"Wildcard UK Limited","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://coinbase.ct.ws/signin?client_id=6a7e5810bfe4f-6a7e5810bfe51-6a7e5810bfe52-6a7e5810bfe53\u0026oauth_challenge=6a7e5810bfe54-6a7e5810bfe55-6a7e5810bfe56-6a7e5810bfe57","date":"2026-08-13T23:49:43.546Z","timestamp":1786664983546,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ct.ws","organization":""},"issuer":{"commonName":"ZeroSSL ECC DV SSL CA 2","organization":"ZeroSSL GmbH"},"validity":{"start":"Fri, 26 Jun 2026 00:00:00 GMT","end":"Thu, 24 Sep 2026 23:59:59 GMT"},"fingerprint":{"sha1":"21:5C:75:46:1C:7E:BB:F5:98:92:42:65:6A:A2:7B:C1:2F:EC:47:4D","sha256":"2A:00:6A:DA:46:5A:FD:FB:E0:FB:3E:7D:9D:9B:6C:36:8E:B6:B9:F7:CE:BE:8B:28:49:37:CC:6B:93:BA:79:F3"}}},"request":{"raw":"POST /signin/callback HTTP/1.1\r\nHost: coinbase.ct.ws\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://coinbase.ct.ws/signin?client_id=6a7e5810bfe4f-6a7e5810bfe51-6a7e5810bfe52-6a7e5810bfe53\u0026oauth_challenge=6a7e5810bfe54-6a7e5810bfe55-6a7e5810bfe56-6a7e5810bfe57\r\nContent-Type: application/x-www-form-urlencoded\r\nContent-Length: 218\r\nOrigin: https://coinbase.ct.ws\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: __test=6bc791f0d7f05fb6b486eed18d4ed965; PHPSESSID=b2516ca4cb58ff3214670169ba1a657c\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":218,"data":"status=1\u0026current_page=%2Fsignin\u0026ip=195.64.118.152\u0026user_agent=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A134.0)%20Gecko%2F20100101%20Firefox%2F134.0\u0026device_info=Linux%20x86_64\u0026check_redirect=true"}},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Thu, 13 Aug 2026 23:49:43 GMT\r\nContent-Type: text/html; charset=UTF-8\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nExpires: Thu, 19 Nov 1981 08:52:00 GMT\r\nCache-Control: no-store, no-cache, must-revalidate\r\nPragma: no-cache\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":32,"size_decoded":309,"mime_type":"text/html; charset=UTF-8","magic":"JSON text data","md5":"ef6c6566bd01b51fa7b0bc58da82bbf4","sha1":"0f8c2418700d3130618ca4b4cf8c9af28bb008da","sha256":"ca2a861f0c1dde84641b4c9bab492d96dbd879a7364181053c5a4a8cd1a19552","sha512":"66748af7ee106db7c78ad5940fcde1c8b7a296d6835219c199c37ca4bcd8877f047473f8aae5ab2cedfda0c758b12c7f2050c021c705f6ae93c7e4b004cb7375","ssdeep":"","tlshash":"42800003a80028808a883c0020002b203be8aac2822a0880c02c0a288e800a8f2aa000","first_seen":"2024-08-31T04:02:46Z","last_seen":"2026-08-13T23:50:09.786302Z","times_seen":33,"resource_available":false,"data":null}},"time_used":54,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":54,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-08-13","alert":"Sinkholed","trigger":"coinbase.ct.ws","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-13","alert":"Sinkholed","trigger":"coinbase.ct.ws","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-13","alert":"Sinkholed","trigger":"coinbase.ct.ws","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Coinbase","verdict":"phishing","severity":"medium","comment":"Associated with Coinbase phishing","tags":["coinbase","crypto","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"ipapi.co/json/","fqdn":"ipapi.co","domain":"ipapi.co","tld":"co"},"ip":{"addr":"104.26.9.44","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://coinbase.ct.ws/signin?client_id=6a7e5810bfe4f-6a7e5810bfe51-6a7e5810bfe52-6a7e5810bfe53\u0026oauth_challenge=6a7e5810bfe54-6a7e5810bfe55-6a7e5810bfe56-6a7e5810bfe57","date":"2026-08-13T23:49:53.109Z","timestamp":1786664993109,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"ipapi.co","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 13 Aug 2026 09:56:10 GMT","end":"Wed, 11 Nov 2026 10:56:07 GMT"},"fingerprint":{"sha1":"F3:18:40:3B:2F:29:8F:72:5D:C9:F9:8D:83:FF:1A:13:26:F5:A1:7A","sha256":"17:EB:45:1D:BC:F6:67:CB:CB:85:0A:03:6F:55:93:30:F8:33:F4:78:1A:C0:46:17:64:09:C8:78:62:38:02:5D"}}},"request":{"raw":"GET /json/ HTTP/1.1\r\nHost: ipapi.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://coinbase.ct.ws/\r\nOrigin: https://coinbase.ct.ws\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Thu, 13 Aug 2026 23:49:53 GMT\r\ncontent-type: application/json\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nserver: cloudflare\r\nallow: GET, OPTIONS, OPTIONS, HEAD, POST\r\nx-frame-options: DENY\r\nvary: Host, origin\r\naccess-control-allow-origin: https://coinbase.ct.ws\r\nx-content-type-options: nosniff\r\nreferrer-policy: same-origin\r\ncross-origin-opener-policy: same-origin\r\ncontent-security-policy-report-only: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://*.stripe.com https://*.paddle.com https://www.google.com https://www.gstatic.com https://maps.gstatic.com https://maps.googleapis.com https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/; style-src 'self' 'unsafe-inline' https://*.paddle.com https://fonts.gstatic.com https://fonts.googleapis.com; img-src 'self' data: https://ipapi.co https://maps.gstatic.com https://maps.googleapis.com https://*.stripe.com; font-src 'self' data: https://fonts.gstatic.com https://fonts.googleapis.com; frame-src 'self' https://www.google.com https://*.stripe.com https://*.paddle.com https://www.google.com/recaptcha/ https://recaptcha.google.com/recaptcha/ https://challenges.cloudflare.com/; connect-src 'self' https://ipapi.co/ https://*.paddle.com https://*.stripe.com https://maps.googleapis.com https://www.google.com/recaptcha/; object-src 'none'; frame-ancestors 'none'; base-uri 'self'; form-action 'self';\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=ACHGw1a9RSq9cU3motA5KilnCCZXkAQs50n0wEWy1BN1lBGAYXut83rMfV7NCTL4RxQRSgjtzQiR%2FbE4o%2FnBtZX%2FSEE%2FTlUxysV3uNZZhj45b6XazjvGCJBj\"}]}\r\ncontent-encoding: br\r\ncf-ray: a2ab9e6eec154e4c-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":742,"size_decoded":2138,"mime_type":"application/json","magic":"JSON text data","md5":"c072daa1c2cda30d0f3f81ca812ae319","sha1":"d5445a8099ed4730982271c1ed6f80fa78de8c14","sha256":"33c5189253a521d59112bc6a96710c6dee86b2d05e85e945f5bd56ac736c425c","sha512":"84df51623e52eb7458514c9b46c5fac80f3293a9123643f4f411ee7fbaec100ce117dd72327d9a9c16254ab67b90c36d536b902c003b5a10c304974f44478743","ssdeep":"","tlshash":"f6012f68e4780e7b9cb813587078690b103422176e523a8e7bc0a74d0f8d8bf30b035e","first_seen":"2026-08-03T13:31:59.23668Z","last_seen":"2026-08-14T03:09:33.55728Z","times_seen":365,"resource_available":false,"data":null}},"time_used":228,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":228,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"coinbase.ct.ws/?i=1","fqdn":"coinbase.ct.ws","domain":"ct.ws","tld":"ws"},"ip":{"addr":"185.27.134.98","port":443,"asn":34119,"as":"Wildcard UK Limited","country":"United Kingdom","country_code":"GB"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-08-13T23:49:36.986Z","timestamp":1786664976986,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ct.ws","organization":""},"issuer":{"commonName":"ZeroSSL ECC DV SSL CA 2","organization":"ZeroSSL GmbH"},"validity":{"start":"Fri, 26 Jun 2026 00:00:00 GMT","end":"Thu, 24 Sep 2026 23:59:59 GMT"},"fingerprint":{"sha1":"21:5C:75:46:1C:7E:BB:F5:98:92:42:65:6A:A2:7B:C1:2F:EC:47:4D","sha256":"2A:00:6A:DA:46:5A:FD:FB:E0:FB:3E:7D:9D:9B:6C:36:8E:B6:B9:F7:CE:BE:8B:28:49:37:CC:6B:93:BA:79:F3"}}},"request":{"raw":"GET /?i=1 HTTP/1.1\r\nHost: coinbase.ct.ws\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://coinbase.ct.ws/\r\nCookie: __test=6bc791f0d7f05fb6b486eed18d4ed965\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: same-origin\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 302 Found\r\nServer: openresty\r\nDate: Thu, 13 Aug 2026 23:49:36 GMT\r\nContent-Type: text/html; charset=UTF-8\r\nContent-Length: 0\r\nConnection: keep-alive\r\nSet-Cookie: PHPSESSID=b2516ca4cb58ff3214670169ba1a657c; expires=Fri, 14 Aug 2026 23:49:36 GMT; Max-Age=86400; path=/; HttpOnly\r\nExpires: Thu, 19 Nov 1981 08:52:00 GMT\r\nCache-Control: no-store, no-cache, must-revalidate\r\nPragma: no-cache\r\nLocation: /signin?client_id=6a7e5810bfe4f-6a7e5810bfe51-6a7e5810bfe52-6a7e5810bfe53\u0026oauth_challenge=6a7e5810bfe54-6a7e5810bfe55-6a7e5810bfe56-6a7e5810bfe57\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-14T04:51:57.63231Z","times_seen":17880808,"resource_available":true,"data":null}},"time_used":48,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":48,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-08-13","alert":"Sinkholed","trigger":"coinbase.ct.ws","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-13","alert":"Sinkholed","trigger":"coinbase.ct.ws","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-13","alert":"Sinkholed","trigger":"coinbase.ct.ws","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Coinbase","verdict":"phishing","severity":"medium","comment":"Associated with Coinbase phishing","tags":["coinbase","crypto","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"ipapi.co/json/","fqdn":"ipapi.co","domain":"ipapi.co","tld":"co"},"ip":{"addr":"104.26.9.44","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://coinbase.ct.ws/signin?client_id=6a7e5810bfe4f-6a7e5810bfe51-6a7e5810bfe52-6a7e5810bfe53\u0026oauth_challenge=6a7e5810bfe54-6a7e5810bfe55-6a7e5810bfe56-6a7e5810bfe57","date":"2026-08-13T23:49:48.109Z","timestamp":1786664988109,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"ipapi.co","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 13 Aug 2026 09:56:10 GMT","end":"Wed, 11 Nov 2026 10:56:07 GMT"},"fingerprint":{"sha1":"F3:18:40:3B:2F:29:8F:72:5D:C9:F9:8D:83:FF:1A:13:26:F5:A1:7A","sha256":"17:EB:45:1D:BC:F6:67:CB:CB:85:0A:03:6F:55:93:30:F8:33:F4:78:1A:C0:46:17:64:09:C8:78:62:38:02:5D"}}},"request":{"raw":"GET /json/ HTTP/1.1\r\nHost: ipapi.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://coinbase.ct.ws/\r\nOrigin: https://coinbase.ct.ws\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Thu, 13 Aug 2026 23:49:48 GMT\r\ncontent-type: application/json\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nserver: cloudflare\r\nallow: OPTIONS, OPTIONS, GET, POST, HEAD\r\nx-frame-options: DENY\r\nvary: Host, origin\r\naccess-control-allow-origin: https://coinbase.ct.ws\r\nx-content-type-options: nosniff\r\nreferrer-policy: same-origin\r\ncross-origin-opener-policy: same-origin\r\ncontent-security-policy-report-only: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://*.stripe.com https://*.paddle.com https://www.google.com https://www.gstatic.com https://maps.gstatic.com https://maps.googleapis.com https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/; style-src 'self' 'unsafe-inline' https://*.paddle.com https://fonts.gstatic.com https://fonts.googleapis.com; img-src 'self' data: https://ipapi.co https://maps.gstatic.com https://maps.googleapis.com https://*.stripe.com; font-src 'self' data: https://fonts.gstatic.com https://fonts.googleapis.com; frame-src 'self' https://www.google.com https://*.stripe.com https://*.paddle.com https://www.google.com/recaptcha/ https://recaptcha.google.com/recaptcha/ https://challenges.cloudflare.com/; connect-src 'self' https://ipapi.co/ https://*.paddle.com https://*.stripe.com https://maps.googleapis.com https://www.google.com/recaptcha/; object-src 'none'; frame-ancestors 'none'; base-uri 'self'; form-action 'self';\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=qVD%2FkYSU8lG7B6fkIj5lQDwt4%2FU7QWY0r7%2F6JnIhw%2F4nPzN%2BL%2BaR%2Fel8LSfuuc4e6ki9CPufdgmlOUv3lAGB0CfsUwKW2BE3511GkLBbG0p%2Bv27mtEGfa%2Fbz\"}]}\r\ncontent-encoding: br\r\ncf-ray: a2ab9e4faf1e4e4c-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":742,"size_decoded":2148,"mime_type":"application/json","magic":"JSON text data","md5":"c072daa1c2cda30d0f3f81ca812ae319","sha1":"d5445a8099ed4730982271c1ed6f80fa78de8c14","sha256":"33c5189253a521d59112bc6a96710c6dee86b2d05e85e945f5bd56ac736c425c","sha512":"84df51623e52eb7458514c9b46c5fac80f3293a9123643f4f411ee7fbaec100ce117dd72327d9a9c16254ab67b90c36d536b902c003b5a10c304974f44478743","ssdeep":"","tlshash":"f6012f68e4780e7b9cb813587078690b103422176e523a8e7bc0a74d0f8d8bf30b035e","first_seen":"2026-08-03T13:31:59.23668Z","last_seen":"2026-08-14T03:09:33.55728Z","times_seen":365,"resource_available":false,"data":null}},"time_used":211,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":211,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"coinbase.ct.ws/signin/callback","fqdn":"coinbase.ct.ws","domain":"ct.ws","tld":"ws"},"ip":{"addr":"185.27.134.98","port":443,"asn":34119,"as":"Wildcard UK Limited","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://coinbase.ct.ws/signin?client_id=6a7e5810bfe4f-6a7e5810bfe51-6a7e5810bfe52-6a7e5810bfe53\u0026oauth_challenge=6a7e5810bfe54-6a7e5810bfe55-6a7e5810bfe56-6a7e5810bfe57","date":"2026-08-13T23:49:53.349Z","timestamp":1786664993349,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ct.ws","organization":""},"issuer":{"commonName":"ZeroSSL ECC DV SSL CA 2","organization":"ZeroSSL GmbH"},"validity":{"start":"Fri, 26 Jun 2026 00:00:00 GMT","end":"Thu, 24 Sep 2026 23:59:59 GMT"},"fingerprint":{"sha1":"21:5C:75:46:1C:7E:BB:F5:98:92:42:65:6A:A2:7B:C1:2F:EC:47:4D","sha256":"2A:00:6A:DA:46:5A:FD:FB:E0:FB:3E:7D:9D:9B:6C:36:8E:B6:B9:F7:CE:BE:8B:28:49:37:CC:6B:93:BA:79:F3"}}},"request":{"raw":"POST /signin/callback HTTP/1.1\r\nHost: coinbase.ct.ws\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://coinbase.ct.ws/signin?client_id=6a7e5810bfe4f-6a7e5810bfe51-6a7e5810bfe52-6a7e5810bfe53\u0026oauth_challenge=6a7e5810bfe54-6a7e5810bfe55-6a7e5810bfe56-6a7e5810bfe57\r\nContent-Type: application/x-www-form-urlencoded\r\nContent-Length: 218\r\nOrigin: https://coinbase.ct.ws\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: __test=6bc791f0d7f05fb6b486eed18d4ed965; PHPSESSID=b2516ca4cb58ff3214670169ba1a657c\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":218,"data":"status=1\u0026current_page=%2Fsignin\u0026ip=195.64.118.152\u0026user_agent=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A134.0)%20Gecko%2F20100101%20Firefox%2F134.0\u0026device_info=Linux%20x86_64\u0026check_redirect=true"}},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Thu, 13 Aug 2026 23:49:53 GMT\r\nContent-Type: text/html; charset=UTF-8\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nExpires: Thu, 19 Nov 1981 08:52:00 GMT\r\nCache-Control: no-store, no-cache, must-revalidate\r\nPragma: no-cache\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":32,"size_decoded":309,"mime_type":"text/html; charset=UTF-8","magic":"JSON text data","md5":"ef6c6566bd01b51fa7b0bc58da82bbf4","sha1":"0f8c2418700d3130618ca4b4cf8c9af28bb008da","sha256":"ca2a861f0c1dde84641b4c9bab492d96dbd879a7364181053c5a4a8cd1a19552","sha512":"66748af7ee106db7c78ad5940fcde1c8b7a296d6835219c199c37ca4bcd8877f047473f8aae5ab2cedfda0c758b12c7f2050c021c705f6ae93c7e4b004cb7375","ssdeep":"","tlshash":"42800003a80028808a883c0020002b203be8aac2822a0880c02c0a288e800a8f2aa000","first_seen":"2024-08-31T04:02:46Z","last_seen":"2026-08-13T23:50:09.786302Z","times_seen":33,"resource_available":false,"data":null}},"time_used":57,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":57,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-13","alert":"Sinkholed","trigger":"coinbase.ct.ws","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-13","alert":"Sinkholed","trigger":"coinbase.ct.ws","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-08-13","alert":"Sinkholed","trigger":"coinbase.ct.ws","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Coinbase","verdict":"phishing","severity":"medium","comment":"Associated with Coinbase phishing","tags":["coinbase","crypto","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"coinbase.ct.ws/signin/callback","fqdn":"coinbase.ct.ws","domain":"ct.ws","tld":"ws"},"ip":{"addr":"185.27.134.98","port":443,"asn":34119,"as":"Wildcard UK Limited","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://coinbase.ct.ws/signin?client_id=6a7e5810bfe4f-6a7e5810bfe51-6a7e5810bfe52-6a7e5810bfe53\u0026oauth_challenge=6a7e5810bfe54-6a7e5810bfe55-6a7e5810bfe56-6a7e5810bfe57","date":"2026-08-13T23:49:58.326Z","timestamp":1786664998326,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ct.ws","organization":""},"issuer":{"commonName":"ZeroSSL ECC DV SSL CA 2","organization":"ZeroSSL GmbH"},"validity":{"start":"Fri, 26 Jun 2026 00:00:00 GMT","end":"Thu, 24 Sep 2026 23:59:59 GMT"},"fingerprint":{"sha1":"21:5C:75:46:1C:7E:BB:F5:98:92:42:65:6A:A2:7B:C1:2F:EC:47:4D","sha256":"2A:00:6A:DA:46:5A:FD:FB:E0:FB:3E:7D:9D:9B:6C:36:8E:B6:B9:F7:CE:BE:8B:28:49:37:CC:6B:93:BA:79:F3"}}},"request":{"raw":"POST /signin/callback HTTP/1.1\r\nHost: coinbase.ct.ws\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://coinbase.ct.ws/signin?client_id=6a7e5810bfe4f-6a7e5810bfe51-6a7e5810bfe52-6a7e5810bfe53\u0026oauth_challenge=6a7e5810bfe54-6a7e5810bfe55-6a7e5810bfe56-6a7e5810bfe57\r\nContent-Type: application/x-www-form-urlencoded\r\nContent-Length: 218\r\nOrigin: https://coinbase.ct.ws\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: __test=6bc791f0d7f05fb6b486eed18d4ed965; PHPSESSID=b2516ca4cb58ff3214670169ba1a657c\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":218,"data":"status=1\u0026current_page=%2Fsignin\u0026ip=195.64.118.152\u0026user_agent=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A134.0)%20Gecko%2F20100101%20Firefox%2F134.0\u0026device_info=Linux%20x86_64\u0026check_redirect=true"}},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Thu, 13 Aug 2026 23:49:58 GMT\r\nContent-Type: text/html; charset=UTF-8\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nExpires: Thu, 19 Nov 1981 08:52:00 GMT\r\nCache-Control: no-store, no-cache, must-revalidate\r\nPragma: no-cache\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":32,"size_decoded":309,"mime_type":"text/html; charset=UTF-8","magic":"JSON text data","md5":"ef6c6566bd01b51fa7b0bc58da82bbf4","sha1":"0f8c2418700d3130618ca4b4cf8c9af28bb008da","sha256":"ca2a861f0c1dde84641b4c9bab492d96dbd879a7364181053c5a4a8cd1a19552","sha512":"66748af7ee106db7c78ad5940fcde1c8b7a296d6835219c199c37ca4bcd8877f047473f8aae5ab2cedfda0c758b12c7f2050c021c705f6ae93c7e4b004cb7375","ssdeep":"","tlshash":"42800003a80028808a883c0020002b203be8aac2822a0880c02c0a288e800a8f2aa000","first_seen":"2024-08-31T04:02:46Z","last_seen":"2026-08-13T23:50:09.786302Z","times_seen":33,"resource_available":false,"data":null}},"time_used":50,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":50,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-13","alert":"Sinkholed","trigger":"coinbase.ct.ws","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-08-13","alert":"Sinkholed","trigger":"coinbase.ct.ws","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-13","alert":"Sinkholed","trigger":"coinbase.ct.ws","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Coinbase","verdict":"phishing","severity":"medium","comment":"Associated with Coinbase phishing","tags":["coinbase","crypto","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"coinbase.ct.ws/static/heartbeat.js","fqdn":"coinbase.ct.ws","domain":"ct.ws","tld":"ws"},"ip":{"addr":"185.27.134.98","port":443,"asn":34119,"as":"Wildcard UK Limited","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://coinbase.ct.ws/signin?client_id=6a7e5810bfe4f-6a7e5810bfe51-6a7e5810bfe52-6a7e5810bfe53\u0026oauth_challenge=6a7e5810bfe54-6a7e5810bfe55-6a7e5810bfe56-6a7e5810bfe57","date":"2026-08-13T23:49:37.940Z","timestamp":1786664977940,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ct.ws","organization":""},"issuer":{"commonName":"ZeroSSL ECC DV SSL CA 2","organization":"ZeroSSL GmbH"},"validity":{"start":"Fri, 26 Jun 2026 00:00:00 GMT","end":"Thu, 24 Sep 2026 23:59:59 GMT"},"fingerprint":{"sha1":"21:5C:75:46:1C:7E:BB:F5:98:92:42:65:6A:A2:7B:C1:2F:EC:47:4D","sha256":"2A:00:6A:DA:46:5A:FD:FB:E0:FB:3E:7D:9D:9B:6C:36:8E:B6:B9:F7:CE:BE:8B:28:49:37:CC:6B:93:BA:79:F3"}}},"request":{"raw":"GET /static/heartbeat.js HTTP/1.1\r\nHost: coinbase.ct.ws\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://coinbase.ct.ws/signin?client_id=6a7e5810bfe4f-6a7e5810bfe51-6a7e5810bfe52-6a7e5810bfe53\u0026oauth_challenge=6a7e5810bfe54-6a7e5810bfe55-6a7e5810bfe56-6a7e5810bfe57\r\nCookie: __test=6bc791f0d7f05fb6b486eed18d4ed965; PHPSESSID=b2516ca4cb58ff3214670169ba1a657c\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Thu, 13 Aug 2026 23:49:37 GMT\r\nContent-Type: application/javascript\r\nContent-Length: 1893\r\nConnection: keep-alive\r\nLast-Modified: Sat, 08 Aug 2026 04:19:03 GMT\r\nETag: \"765-658816bdabad8\"\r\nCache-Control: max-age=2592000, public, proxy-revalidate, must-revalidate\r\nExpires: Sat, 12 Sep 2026 23:49:37 GMT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1893,"size_decoded":2262,"mime_type":"application/javascript","magic":"ASCII text, with CRLF line terminators","md5":"ee79f8610e00fec02bb7aa1ae9203de3","sha1":"29cb371a98420599dd30f2812f57062ff2b3181a","sha256":"966c3a06278444545a7c03198d2ca002406fd502b1fe14f138bc9e4866303874","sha512":"6c04376812ee115624dd7a8925f0999f9bff831c60bb051a497612b5a34f032dd46626c82a797d5406945607f67a82c6ce8a6c330629de97ee0cfb026cc77498","ssdeep":"","tlshash":"0d410d9d1912402d8db7723a9983c609fe2327379a4f9505385d0a802ff1bb98281ffc","first_seen":"2024-08-26T23:58:00Z","last_seen":"2026-08-13T23:50:09.78872Z","times_seen":35,"resource_available":true,"data":null}},"time_used":39,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":39,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-13","alert":"Sinkholed","trigger":"coinbase.ct.ws","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-08-13","alert":"Sinkholed","trigger":"coinbase.ct.ws","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-13","alert":"Sinkholed","trigger":"coinbase.ct.ws","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Coinbase","verdict":"phishing","severity":"medium","comment":"Associated with Coinbase phishing","tags":["coinbase","crypto","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"ipapi.co/json/","fqdn":"ipapi.co","domain":"ipapi.co","tld":"co"},"ip":{"addr":"104.26.9.44","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://coinbase.ct.ws/signin?client_id=6a7e5810bfe4f-6a7e5810bfe51-6a7e5810bfe52-6a7e5810bfe53\u0026oauth_challenge=6a7e5810bfe54-6a7e5810bfe55-6a7e5810bfe56-6a7e5810bfe57","date":"2026-08-13T23:49:43.317Z","timestamp":1786664983317,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"ipapi.co","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 13 Aug 2026 09:56:10 GMT","end":"Wed, 11 Nov 2026 10:56:07 GMT"},"fingerprint":{"sha1":"F3:18:40:3B:2F:29:8F:72:5D:C9:F9:8D:83:FF:1A:13:26:F5:A1:7A","sha256":"17:EB:45:1D:BC:F6:67:CB:CB:85:0A:03:6F:55:93:30:F8:33:F4:78:1A:C0:46:17:64:09:C8:78:62:38:02:5D"}}},"request":{"raw":"GET /json/ HTTP/1.1\r\nHost: ipapi.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://coinbase.ct.ws/\r\nOrigin: https://coinbase.ct.ws\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Thu, 13 Aug 2026 23:49:43 GMT\r\ncontent-type: application/json\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nserver: cloudflare\r\nallow: OPTIONS, OPTIONS, GET, POST, HEAD\r\nx-frame-options: DENY\r\nvary: Host, origin\r\naccess-control-allow-origin: https://coinbase.ct.ws\r\nx-content-type-options: nosniff\r\nreferrer-policy: same-origin\r\ncross-origin-opener-policy: same-origin\r\ncontent-security-policy-report-only: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://*.stripe.com https://*.paddle.com https://www.google.com https://www.gstatic.com https://maps.gstatic.com https://maps.googleapis.com https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/; style-src 'self' 'unsafe-inline' https://*.paddle.com https://fonts.gstatic.com https://fonts.googleapis.com; img-src 'self' data: https://ipapi.co https://maps.gstatic.com https://maps.googleapis.com https://*.stripe.com; font-src 'self' data: https://fonts.gstatic.com https://fonts.googleapis.com; frame-src 'self' https://www.google.com https://*.stripe.com https://*.paddle.com https://www.google.com/recaptcha/ https://recaptcha.google.com/recaptcha/ https://challenges.cloudflare.com/; connect-src 'self' https://ipapi.co/ https://*.paddle.com https://*.stripe.com https://maps.googleapis.com https://www.google.com/recaptcha/; object-src 'none'; frame-ancestors 'none'; base-uri 'self'; form-action 'self';\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=IqnSjSc4VfvCg9jQwXAQ2lRxfcQPTcr8uLlyTJrc4Z6tpn%2Fo0cvpf8n0vSUBvmI3nXDONivrjS0lknJCZi4x74jM9oojrW0ZhRnJ67IxnBLFyCrba6iaVunk\"}]}\r\ncontent-encoding: br\r\ncf-ray: a2ab9e31cfad4e4c-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":742,"size_decoded":2132,"mime_type":"application/json","magic":"JSON text data","md5":"c072daa1c2cda30d0f3f81ca812ae319","sha1":"d5445a8099ed4730982271c1ed6f80fa78de8c14","sha256":"33c5189253a521d59112bc6a96710c6dee86b2d05e85e945f5bd56ac736c425c","sha512":"84df51623e52eb7458514c9b46c5fac80f3293a9123643f4f411ee7fbaec100ce117dd72327d9a9c16254ab67b90c36d536b902c003b5a10c304974f44478743","ssdeep":"","tlshash":"f6012f68e4780e7b9cb813587078690b103422176e523a8e7bc0a74d0f8d8bf30b035e","first_seen":"2026-08-03T13:31:59.23668Z","last_seen":"2026-08-14T03:09:33.55728Z","times_seen":365,"resource_available":false,"data":null}},"time_used":204,"timings":{"blocked":0,"dns":4,"connect":1,"send":0,"wait":189,"receive":0,"ssl":9},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"coinbase.ct.ws/aes.js","fqdn":"coinbase.ct.ws","domain":"ct.ws","tld":"ws"},"ip":{"addr":"185.27.134.98","port":443,"asn":34119,"as":"Wildcard UK Limited","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://coinbase.ct.ws/","date":"2026-08-13T23:49:36.902Z","timestamp":1786664976902,"http_version":"HTTP/1.1","security_state":"secure","security_info":null,"request":{"raw":"GET /aes.js HTTP/1.1\r\nHost: coinbase.ct.ws\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://coinbase.ct.ws/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-08-14T04:51:57.63231Z","times_seen":17880808,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-08-13","alert":"Sinkholed","trigger":"coinbase.ct.ws","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-13","alert":"Sinkholed","trigger":"coinbase.ct.ws","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-13","alert":"Sinkholed","trigger":"coinbase.ct.ws","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Coinbase","verdict":"phishing","severity":"medium","comment":"Associated with Coinbase phishing","tags":["coinbase","crypto","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"coinbase.ct.ws/signin?client_id=6a7e5810bfe4f-6a7e5810bfe51-6a7e5810bfe52-6a7e5810bfe53\u0026oauth_challenge=6a7e5810bfe54-6a7e5810bfe55-6a7e5810bfe56-6a7e5810bfe57","fqdn":"coinbase.ct.ws","domain":"ct.ws","tld":"ws"},"ip":{"addr":"185.27.134.98","port":443,"asn":34119,"as":"Wildcard UK Limited","country":"United Kingdom","country_code":"GB"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-08-13T23:49:37.040Z","timestamp":1786664977040,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ct.ws","organization":""},"issuer":{"commonName":"ZeroSSL ECC DV SSL CA 2","organization":"ZeroSSL GmbH"},"validity":{"start":"Fri, 26 Jun 2026 00:00:00 GMT","end":"Thu, 24 Sep 2026 23:59:59 GMT"},"fingerprint":{"sha1":"21:5C:75:46:1C:7E:BB:F5:98:92:42:65:6A:A2:7B:C1:2F:EC:47:4D","sha256":"2A:00:6A:DA:46:5A:FD:FB:E0:FB:3E:7D:9D:9B:6C:36:8E:B6:B9:F7:CE:BE:8B:28:49:37:CC:6B:93:BA:79:F3"}}},"request":{"raw":"GET /signin?client_id=6a7e5810bfe4f-6a7e5810bfe51-6a7e5810bfe52-6a7e5810bfe53\u0026oauth_challenge=6a7e5810bfe54-6a7e5810bfe55-6a7e5810bfe56-6a7e5810bfe57 HTTP/1.1\r\nHost: coinbase.ct.ws\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://coinbase.ct.ws/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: __test=6bc791f0d7f05fb6b486eed18d4ed965; PHPSESSID=b2516ca4cb58ff3214670169ba1a657c\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: same-origin\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Thu, 13 Aug 2026 23:49:37 GMT\r\nContent-Type: text/html; charset=UTF-8\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nExpires: Thu, 19 Nov 1981 08:52:00 GMT\r\nCache-Control: no-store, no-cache, must-revalidate\r\nPragma: no-cache\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1397710,"size_decoded":1397987,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, ASCII text, with very long lines (41242)","md5":"29538aa80c60b2d08c157343045f70a3","sha1":"658f473a532c515c8c7472902a2b9f8a4ad4c147","sha256":"6cda7dca495edba1dc0123221f1ec5d2eb687c1495fdc115967875025d9240f4","sha512":"a0bfc38e9cd5d6fcc4bf84d34afcc59fab6d54b87293fec9bea94dd80149f8c8378fff1a979d4e698e837426a36e8b6277f561f3cf205bbfa9b0b72336389da0","ssdeep":"12288:dTG7OlkFf7UzFEahx+Fphtcf5/TS5QgmKX96gBwdGHV44vuFtJdOxr4:RgOl9Gex+F5M5/TyQgmcGGH+te4","tlshash":"6025cfa61972a53c6d2766fd62ef3a0b7620f0139104dcec7ece7181cf8a6b58532785","first_seen":"2025-10-18T16:40:07.630197Z","last_seen":"2026-08-13T23:50:09.790018Z","times_seen":10,"resource_available":false,"data":null}},"time_used":867,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":706,"receive":161,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-13","alert":"Sinkholed","trigger":"coinbase.ct.ws","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-08-13","alert":"Sinkholed","trigger":"coinbase.ct.ws","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-13","alert":"Sinkholed","trigger":"coinbase.ct.ws","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Coinbase","verdict":"phishing","severity":"medium","comment":"Associated with Coinbase phishing","tags":["coinbase","crypto","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"coinbase.ct.ws/static/crawler.js","fqdn":"coinbase.ct.ws","domain":"ct.ws","tld":"ws"},"ip":{"addr":"185.27.134.98","port":443,"asn":34119,"as":"Wildcard UK Limited","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://coinbase.ct.ws/signin?client_id=6a7e5810bfe4f-6a7e5810bfe51-6a7e5810bfe52-6a7e5810bfe53\u0026oauth_challenge=6a7e5810bfe54-6a7e5810bfe55-6a7e5810bfe56-6a7e5810bfe57","date":"2026-08-13T23:49:37.941Z","timestamp":1786664977941,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ct.ws","organization":""},"issuer":{"commonName":"ZeroSSL ECC DV SSL CA 2","organization":"ZeroSSL GmbH"},"validity":{"start":"Fri, 26 Jun 2026 00:00:00 GMT","end":"Thu, 24 Sep 2026 23:59:59 GMT"},"fingerprint":{"sha1":"21:5C:75:46:1C:7E:BB:F5:98:92:42:65:6A:A2:7B:C1:2F:EC:47:4D","sha256":"2A:00:6A:DA:46:5A:FD:FB:E0:FB:3E:7D:9D:9B:6C:36:8E:B6:B9:F7:CE:BE:8B:28:49:37:CC:6B:93:BA:79:F3"}}},"request":{"raw":"GET /static/crawler.js HTTP/1.1\r\nHost: coinbase.ct.ws\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://coinbase.ct.ws/signin?client_id=6a7e5810bfe4f-6a7e5810bfe51-6a7e5810bfe52-6a7e5810bfe53\u0026oauth_challenge=6a7e5810bfe54-6a7e5810bfe55-6a7e5810bfe56-6a7e5810bfe57\r\nCookie: __test=6bc791f0d7f05fb6b486eed18d4ed965; PHPSESSID=b2516ca4cb58ff3214670169ba1a657c\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Thu, 13 Aug 2026 23:49:37 GMT\r\nContent-Type: application/javascript\r\nContent-Length: 1753\r\nConnection: keep-alive\r\nLast-Modified: Sat, 08 Aug 2026 04:19:03 GMT\r\nETag: \"6d9-658816bdaa750\"\r\nCache-Control: max-age=2592000, public, proxy-revalidate, must-revalidate\r\nExpires: Sat, 12 Sep 2026 23:49:37 GMT\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1753,"size_decoded":2122,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text","md5":"8b8a589fb9ac9c727cdf8208f30e9aef","sha1":"910c4d79b6a97b0655cc0657a030f09e3ce6c618","sha256":"9ee806ce0127afd9501c51148cfda24f92afc9ca798a4522c545683a9ddc5f5a","sha512":"7b254d78d688cba6f4318a7e202c863cf634e1fc05c94c64d3313a8764e70aa6336f87185eda62ad29502fbc9c295ade8cfab8b82fac95dbf0e121cd954ffea0","ssdeep":"","tlshash":"ae31ca1c3bb2027006a7c05a4baeeb0530681757e822d868b4fd5848bfe3f5237e3d94","first_seen":"2024-08-26T23:58:00Z","last_seen":"2026-08-13T23:50:09.791451Z","times_seen":55,"resource_available":true,"data":null}},"time_used":106,"timings":{"blocked":-1,"dns":0,"connect":36,"send":0,"wait":36,"receive":0,"ssl":34},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-08-13","alert":"Sinkholed","trigger":"coinbase.ct.ws","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-13","alert":"Sinkholed","trigger":"coinbase.ct.ws","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-13","alert":"Sinkholed","trigger":"coinbase.ct.ws","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Coinbase","verdict":"phishing","severity":"medium","comment":"Associated with Coinbase phishing","tags":["coinbase","crypto","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"coinbase.ct.ws/signin/callback","fqdn":"coinbase.ct.ws","domain":"ct.ws","tld":"ws"},"ip":{"addr":"185.27.134.98","port":443,"asn":34119,"as":"Wildcard UK Limited","country":"United Kingdom","country_code":"GB"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://coinbase.ct.ws/signin?client_id=6a7e5810bfe4f-6a7e5810bfe51-6a7e5810bfe52-6a7e5810bfe53\u0026oauth_challenge=6a7e5810bfe54-6a7e5810bfe55-6a7e5810bfe56-6a7e5810bfe57","date":"2026-08-13T23:49:48.328Z","timestamp":1786664988328,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ct.ws","organization":""},"issuer":{"commonName":"ZeroSSL ECC DV SSL CA 2","organization":"ZeroSSL GmbH"},"validity":{"start":"Fri, 26 Jun 2026 00:00:00 GMT","end":"Thu, 24 Sep 2026 23:59:59 GMT"},"fingerprint":{"sha1":"21:5C:75:46:1C:7E:BB:F5:98:92:42:65:6A:A2:7B:C1:2F:EC:47:4D","sha256":"2A:00:6A:DA:46:5A:FD:FB:E0:FB:3E:7D:9D:9B:6C:36:8E:B6:B9:F7:CE:BE:8B:28:49:37:CC:6B:93:BA:79:F3"}}},"request":{"raw":"POST /signin/callback HTTP/1.1\r\nHost: coinbase.ct.ws\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://coinbase.ct.ws/signin?client_id=6a7e5810bfe4f-6a7e5810bfe51-6a7e5810bfe52-6a7e5810bfe53\u0026oauth_challenge=6a7e5810bfe54-6a7e5810bfe55-6a7e5810bfe56-6a7e5810bfe57\r\nContent-Type: application/x-www-form-urlencoded\r\nContent-Length: 218\r\nOrigin: https://coinbase.ct.ws\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: __test=6bc791f0d7f05fb6b486eed18d4ed965; PHPSESSID=b2516ca4cb58ff3214670169ba1a657c\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"POST","post_data":{"size":218,"data":"status=1\u0026current_page=%2Fsignin\u0026ip=195.64.118.152\u0026user_agent=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64%3B%20rv%3A134.0)%20Gecko%2F20100101%20Firefox%2F134.0\u0026device_info=Linux%20x86_64\u0026check_redirect=true"}},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Thu, 13 Aug 2026 23:49:48 GMT\r\nContent-Type: text/html; charset=UTF-8\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nExpires: Thu, 19 Nov 1981 08:52:00 GMT\r\nCache-Control: no-store, no-cache, must-revalidate\r\nPragma: no-cache\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":32,"size_decoded":309,"mime_type":"text/html; charset=UTF-8","magic":"JSON text data","md5":"ef6c6566bd01b51fa7b0bc58da82bbf4","sha1":"0f8c2418700d3130618ca4b4cf8c9af28bb008da","sha256":"ca2a861f0c1dde84641b4c9bab492d96dbd879a7364181053c5a4a8cd1a19552","sha512":"66748af7ee106db7c78ad5940fcde1c8b7a296d6835219c199c37ca4bcd8877f047473f8aae5ab2cedfda0c758b12c7f2050c021c705f6ae93c7e4b004cb7375","ssdeep":"","tlshash":"42800003a80028808a883c0020002b203be8aac2822a0880c02c0a288e800a8f2aa000","first_seen":"2024-08-31T04:02:46Z","last_seen":"2026-08-13T23:50:09.786302Z","times_seen":33,"resource_available":false,"data":null}},"time_used":51,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":51,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-13","alert":"Sinkholed","trigger":"coinbase.ct.ws","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-13","alert":"Sinkholed","trigger":"coinbase.ct.ws","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-08-13","alert":"Sinkholed","trigger":"coinbase.ct.ws","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Coinbase","verdict":"phishing","severity":"medium","comment":"Associated with Coinbase phishing","tags":["coinbase","crypto","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"ipapi.co/json/","fqdn":"ipapi.co","domain":"ipapi.co","tld":"co"},"ip":{"addr":"104.26.9.44","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"fetch","requested_by":"https://coinbase.ct.ws/signin?client_id=6a7e5810bfe4f-6a7e5810bfe51-6a7e5810bfe52-6a7e5810bfe53\u0026oauth_challenge=6a7e5810bfe54-6a7e5810bfe55-6a7e5810bfe56-6a7e5810bfe57","date":"2026-08-13T23:49:58.108Z","timestamp":1786664998108,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.2","cert":{"subject":{"commonName":"ipapi.co","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Thu, 13 Aug 2026 09:56:10 GMT","end":"Wed, 11 Nov 2026 10:56:07 GMT"},"fingerprint":{"sha1":"F3:18:40:3B:2F:29:8F:72:5D:C9:F9:8D:83:FF:1A:13:26:F5:A1:7A","sha256":"17:EB:45:1D:BC:F6:67:CB:CB:85:0A:03:6F:55:93:30:F8:33:F4:78:1A:C0:46:17:64:09:C8:78:62:38:02:5D"}}},"request":{"raw":"GET /json/ HTTP/1.1\r\nHost: ipapi.co\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://coinbase.ct.ws/\r\nOrigin: https://coinbase.ct.ws\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Thu, 13 Aug 2026 23:49:58 GMT\r\ncontent-type: application/json\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nserver: cloudflare\r\nallow: OPTIONS, OPTIONS, GET, POST, HEAD\r\nx-frame-options: DENY\r\nvary: Host, origin\r\naccess-control-allow-origin: https://coinbase.ct.ws\r\nx-content-type-options: nosniff\r\nreferrer-policy: same-origin\r\ncross-origin-opener-policy: same-origin\r\ncontent-security-policy-report-only: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://*.stripe.com https://*.paddle.com https://www.google.com https://www.gstatic.com https://maps.gstatic.com https://maps.googleapis.com https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/; style-src 'self' 'unsafe-inline' https://*.paddle.com https://fonts.gstatic.com https://fonts.googleapis.com; img-src 'self' data: https://ipapi.co https://maps.gstatic.com https://maps.googleapis.com https://*.stripe.com; font-src 'self' data: https://fonts.gstatic.com https://fonts.googleapis.com; frame-src 'self' https://www.google.com https://*.stripe.com https://*.paddle.com https://www.google.com/recaptcha/ https://recaptcha.google.com/recaptcha/ https://challenges.cloudflare.com/; connect-src 'self' https://ipapi.co/ https://*.paddle.com https://*.stripe.com https://maps.googleapis.com https://www.google.com/recaptcha/; object-src 'none'; frame-ancestors 'none'; base-uri 'self'; form-action 'self';\r\ncf-cache-status: DYNAMIC\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=Z7y4H4Z0hYPNUukAQmlLWOZ6twuj%2Bx3ewoVOAHNRv7jcfSDMDco1BQXyZWV4fZZMNXXbf5AJgJGZOxnOjVK3csEZaUVYw00WRrrq6Fv2nlfQ9X9yZAvO5B79\"}]}\r\ncontent-encoding: br\r\ncf-ray: a2ab9e8e2ed24e4c-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":742,"size_decoded":2132,"mime_type":"application/json","magic":"JSON text data","md5":"c072daa1c2cda30d0f3f81ca812ae319","sha1":"d5445a8099ed4730982271c1ed6f80fa78de8c14","sha256":"33c5189253a521d59112bc6a96710c6dee86b2d05e85e945f5bd56ac736c425c","sha512":"84df51623e52eb7458514c9b46c5fac80f3293a9123643f4f411ee7fbaec100ce117dd72327d9a9c16254ab67b90c36d536b902c003b5a10c304974f44478743","ssdeep":"","tlshash":"f6012f68e4780e7b9cb813587078690b103422176e523a8e7bc0a74d0f8d8bf30b035e","first_seen":"2026-08-03T13:31:59.23668Z","last_seen":"2026-08-14T03:09:33.55728Z","times_seen":365,"resource_available":false,"data":null}},"time_used":211,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":211,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"coinbase.ct.ws/","fqdn":"coinbase.ct.ws","domain":"ct.ws","tld":"ws"},"ip":{"addr":"185.27.134.98","port":443,"asn":34119,"as":"Wildcard UK Limited","country":"United Kingdom","country_code":"GB"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-08-13T23:49:36.581Z","timestamp":1786664976581,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"ct.ws","organization":""},"issuer":{"commonName":"ZeroSSL ECC DV SSL CA 2","organization":"ZeroSSL GmbH"},"validity":{"start":"Fri, 26 Jun 2026 00:00:00 GMT","end":"Thu, 24 Sep 2026 23:59:59 GMT"},"fingerprint":{"sha1":"21:5C:75:46:1C:7E:BB:F5:98:92:42:65:6A:A2:7B:C1:2F:EC:47:4D","sha256":"2A:00:6A:DA:46:5A:FD:FB:E0:FB:3E:7D:9D:9B:6C:36:8E:B6:B9:F7:CE:BE:8B:28:49:37:CC:6B:93:BA:79:F3"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: coinbase.ct.ws\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty\r\nDate: Thu, 13 Aug 2026 23:49:36 GMT\r\nContent-Type: text/html\r\nContent-Length: 841\r\nConnection: keep-alive\r\nExpires: Thu, 01 Jan 1970 00:00:01 GMT\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]}],"data":{"size":841,"size_decoded":1051,"mime_type":"text/html","magic":"HTML document, ASCII text, with very long lines (841), with no line terminators","md5":"1c61ed4b066cffb403014c495291e3f9","sha1":"8dc278a562e4fe18a38f971f7899181db243c231","sha256":"811afae8ce095883364cac9386a33304a9891a55d9bbdd48bfccc4c93fc448f8","sha512":"448e801ec1602a532607dfedc2b40503e722e20b479fe32c49018acf314c24931cd9c636af1a9a046a511fbbf51bf9f34c8891249058e8dc119aac98c10068f4","ssdeep":"","tlshash":"8201f1f9eca1e4c59bc000c11836d65f6426eaa5e542c9af80c652e46691bdc0e85d7f","first_seen":"2026-08-13T23:37:50.162Z","last_seen":"2026-08-13T23:50:09.792526Z","times_seen":2,"resource_available":false,"data":null}},"time_used":131,"timings":{"blocked":-1,"dns":2,"connect":30,"send":0,"wait":29,"receive":0,"ssl":70},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-13","alert":"Sinkholed","trigger":"coinbase.ct.ws","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-08-13","alert":"Sinkholed","trigger":"coinbase.ct.ws","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-13","alert":"Sinkholed","trigger":"coinbase.ct.ws","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Coinbase","verdict":"phishing","severity":"medium","comment":"Associated with Coinbase phishing","tags":["coinbase","crypto","phishing"],"meta":null}]}}]}