# Phishing sites impersonating Coinbase PhishDestroy has recorded 4,630 phishing domains impersonating Coinbase since 2024-03-26, 63 of them in the last 30 days. The most used registrars are Cloudflare and NiceNIC; the most common TLDs are .com and .dev. The official Coinbase domain is coinbase.com: any other site asking for your login or wallet is not Coinbase. 4,630Domains, all time 63Last 30 days 1,563Online at last check 1,165Confirmed takedowns ## New domains in the last 90 days Coinbase phishing domains detected per day: 352 from 2026-07-25 to 2026-10-22; peak 33. ## How to tell a fake Coinbase site Official domain: coinbase.com. Words most often added to the brand in reported domains: coin, base, login, created, daftpage, extension, wallet, cdn, secure, help. - Type the address yourself or use a bookmark; phishing links for Coinbase arrive through ads, search results, direct messages and fake support accounts. - Check the full domain before you sign in: look for extra words, hyphens, a different TLD or look-alike letters. - Coinbase will never ask for your seed phrase. Read every wallet signature: approvals, Permit and setApprovalForAll requests can hand over your assets. Paste a suspicious address into the [Homoglyph Checker](https://phishdestroy.io/developer-tools/homoglyph-checker) or check it against the [DestroyList](https://phishdestroy.io/developer-tools/destroylist-check). ## Latest Coinbase phishing domains The 50 most recently detected domains impersonating Coinbase Domain | First detected | Status at last check | Registrar | [wallet-coinbase.com](https://phishdestroy.io/domain/wallet-coinbase.com/) | 2026-10-20 | Online | NICENIC | [app.xstocksfidashboard.live](https://phishdestroy.io/domain/app.xstocksfidashboard.live/) | 2026-10-20 | Offline | NICENIC | [931703coinbase.com](https://phishdestroy.io/domain/931703coinbase.com/) | 2026-10-20 | Unknown | NICENIC | [713423coinbase.com](https://phishdestroy.io/domain/713423coinbase.com/) | 2026-10-20 | Online | NICENIC | [496153coinbase.com](https://phishdestroy.io/domain/496153coinbase.com/) | 2026-10-20 | Online | NICENIC | [237780coinbase.com](https://phishdestroy.io/domain/237780coinbase.com/) | 2026-10-19 | Online | NICENIC | [zetachain.run](https://phishdestroy.io/domain/zetachain.run/) | 2026-10-19 | Offline | PublicDomainRegistry.com | [848472coinbase.com](https://phishdestroy.io/domain/848472coinbase.com/) | 2026-10-19 | Online | PublicDomainRegistry.com | [cryptomarketarena.com](https://phishdestroy.io/domain/cryptomarketarena.com/) | 2026-10-17 | Online | Spaceship | [coinbasefleetagent.fudace.es](https://phishdestroy.io/domain/coinbasefleetagent.fudace.es/) | 2026-10-16 | Online | — | [cryptomarketprime.com](https://phishdestroy.io/domain/cryptomarketprime.com/) | 2026-10-15 | Offline | Spaceship | [coinbase-jit.com](https://phishdestroy.io/domain/coinbase-jit.com/) | 2026-10-15 | Online | DYNADOT | [route-pool-h0i6.coin-base-exchange.com](https://phishdestroy.io/domain/route-pool-h0i6.coin-base-exchange.com/) | 2026-10-15 | Online | eName Technology | [smart-safety.coinbase-gps.com](https://phishdestroy.io/domain/smart-safety.coinbase-gps.com/) | 2026-10-15 | Offline | eName Technology | [smart-safety.coinbase-route.com](https://phishdestroy.io/domain/smart-safety.coinbase-route.com/) | 2026-10-15 | Offline | eName Technology | [coinbasextensions.com.expresscouriers.net](https://phishdestroy.io/domain/coinbasextensions.com.expresscouriers.net/) | 2026-10-15 | Online | Sav.com | [coinbasextensions.com](https://phishdestroy.io/domain/coinbasextensions.com/) | 2026-10-15 | Online | Sav.com | [953771coinbase.com](https://phishdestroy.io/domain/953771coinbase.com/) | 2026-10-13 | Offline | Dominet (HK) | [trust-chain-systems-eth-verify.network](https://phishdestroy.io/domain/trust-chain-systems-eth-verify.network/) | 2026-10-13 | Online | Tucows Domains | [liveness-coinbase.com](https://phishdestroy.io/domain/liveness-coinbase.com/) | 2026-10-13 | Unknown | NICENIC | [coin-web3.click](https://phishdestroy.io/domain/coin-web3.click/) | 2026-10-13 | Online | NameSilo | [coin-web3.sbs](https://phishdestroy.io/domain/coin-web3.sbs/) | 2026-10-13 | Online | NameSilo | [coinbsc.com](https://phishdestroy.io/domain/coinbsc.com/) | 2026-10-13 | Online | NameSilo | [710631coinbase.com](https://phishdestroy.io/domain/710631coinbase.com/) | 2026-10-13 | Online | NICENIC | [participate-papertrade.xyz](https://phishdestroy.io/domain/participate-papertrade.xyz/) | 2026-10-13 | Unknown | NICENIC | [take-papertrade.xyz](https://phishdestroy.io/domain/take-papertrade.xyz/) | 2026-10-13 | Unknown | NICENIC | [proposals-papertrade.com](https://phishdestroy.io/domain/proposals-papertrade.com/) | 2026-10-13 | Online | NICENIC | [allocation-netnet.icu](https://phishdestroy.io/domain/allocation-netnet.icu/) | 2026-10-11 | Online | Eranet | [allocations-netnet.top](https://phishdestroy.io/domain/allocations-netnet.top/) | 2026-10-11 | Online | Eranet | [248211coinbase.com](https://phishdestroy.io/domain/248211coinbase.com/) | 2026-10-11 | Online | NICENIC | [428749coinbase.com](https://phishdestroy.io/domain/428749coinbase.com/) | 2026-10-11 | Online | NICENIC | [266385coinbase.com](https://phishdestroy.io/domain/266385coinbase.com/) | 2026-10-11 | Online | NICENIC | [xrplatform-es.online](https://phishdestroy.io/domain/xrplatform-es.online/) | 2026-10-11 | Online | Dynadot | [coninbase-wallet.com](https://phishdestroy.io/domain/coninbase-wallet.com/) | 2026-10-11 | Offline | NICENIC | [userhub-coinbase.com](https://phishdestroy.io/domain/userhub-coinbase.com/) | 2026-10-11 | Offline | Onamae.com | [953441coinbase.com](https://phishdestroy.io/domain/953441coinbase.com/) | 2026-10-09 | Online | PublicDomainRegistry.com | [whiteway-coinbase.com](https://phishdestroy.io/domain/whiteway-coinbase.com/) | 2026-10-09 | Online | NICENIC | [jason-coinbase.com](https://phishdestroy.io/domain/jason-coinbase.com/) | 2026-10-09 | Online | NICENIC | [372121coinbase.com](https://phishdestroy.io/domain/372121coinbase.com/) | 2026-10-09 | Online | NICENIC | [stratdelta.com](https://phishdestroy.io/domain/stratdelta.com/) | 2026-10-07 | Online | NICENIC | [ryan-coinbase.com](https://phishdestroy.io/domain/ryan-coinbase.com/) | 2026-10-07 | Online | NICENIC | [robert-coinbase.com](https://phishdestroy.io/domain/robert-coinbase.com/) | 2026-10-07 | Online | NICENIC | [basixion.com](https://phishdestroy.io/domain/basixion.com/) | 2026-10-07 | Online | NICENIC | [franco-creditan.online](https://phishdestroy.io/domain/franco-creditan.online/) | 2026-10-07 | Online | Dynadot | [secure-coinbase-com-sign-in.typedream.app](https://phishdestroy.io/domain/secure-coinbase-com-sign-in.typedream.app/) | 2026-10-07 | Online | Squarespace Domains II | [smtp6-coinbase.com](https://phishdestroy.io/domain/smtp6-coinbase.com/) | 2026-10-07 | Online | HOSTINGER operations | [holdings-coinbase.com](https://phishdestroy.io/domain/holdings-coinbase.com/) | 2026-10-07 | Online | NICENIC | [autoconfig.190842-coinbase.com](https://phishdestroy.io/domain/autoconfig.190842-coinbase.com/) | 2026-10-06 | Online | OwnRegistrar | [9827841coinbase.com](https://phishdestroy.io/domain/9827841coinbase.com/) | 2026-10-04 | Online | NICENIC | [517291coinbase.com](https://phishdestroy.io/domain/517291coinbase.com/) | 2026-10-04 | Online | NICENIC | [All 4,630 Coinbase reports](https://phishdestroy.io/domain/?brand=Coinbase) ## Where they are registered and hosted ### Registrars - Cloudflare758 - [NiceNIC](https://phishdestroy.io/registrar/nicenic/)320 - [Tucows Domains](https://phishdestroy.io/registrar/tucows/)241 - CSC Corporate Domains229 - [MarkMonitor](https://phishdestroy.io/registrar/markmonitor/)203 - [Gname.com](https://phishdestroy.io/registrar/name-com/)181 - [NICENIC](https://phishdestroy.io/registrar/nicenic/)172 - [Dynadot](https://phishdestroy.io/registrar/dynadot/)136 ### Top-level domains - [.com](https://phishdestroy.io/tld/com/)1,660 - [.dev](https://phishdestroy.io/tld/dev/)663 - [.app](https://phishdestroy.io/tld/app/)416 - [.io](https://phishdestroy.io/tld/io/)213 - [.xyz](https://phishdestroy.io/tld/xyz/)188 - [.ai](https://phishdestroy.io/tld/ai/)150 - [.top](https://phishdestroy.io/tld/top/)98 - [.net](https://phishdestroy.io/tld/net/)73 ### Hosting networks - CLOUDFLARENET, US890 - AMAZON-02, US821 - CLOUDFLARENET - Cloudflare, Inc., US559 - Cloudflare, Inc.499 - Amazon.com, Inc.177 - Google LLC134 - AS-HOSTINGER Hostinger International Limited, CY129 - GOOGLE, US97 ## Related - [Typosquatting](https://phishdestroy.io/glossary/typosquatting/) - [Homoglyph](https://phishdestroy.io/glossary/homoglyph/) - [Phishing kit](https://phishdestroy.io/glossary/phishing-kit/) - [Wallet drainer](https://phishdestroy.io/glossary/wallet-drainer/) - [Seed phrase phishing](https://phishdestroy.io/glossary/seed-phrase-phishing/) - [Homoglyph Checker](https://phishdestroy.io/developer-tools/homoglyph-checker) - [Abuse Report Generator](https://phishdestroy.io/developer-tools/abuse-report-generator) - [If you already used a fake site: emergency guide](https://phishdestroy.io/critical-action) - [All impersonated brands](https://phishdestroy.io/brand/) Data: PhishDestroy domain-report database, built 2026-10-22. Counts cover every reported domain whose stored target brand is Coinbase; share of all PhishDestroy reports: 2.06%. Canonical: https://phishdestroy.io/brand/coinbase/