# cloud-coinbase-en.pages.dev — MALICIOUS

> cloud-coinbase-en.pages.dev is a dangerous impersonation of Coinbase. Avoid interaction and never share personal data. Stay safe and verify official sources.

## Summary
PhishDestroy identifies cloud-coinbase-en.pages.dev as a high-risk phishing domain impersonating Coinbase to deceive users. It aims to steal sensitive information by mimicking the legitimate brand.

The domain was created on February 21, 2026, and is registered through Cloudflare, Inc. It resolves to IP address 172.66.44.120 and appears on multiple security blocklists. VirusTotal flags this domain by 15 out of 95 security vendors, confirming its malicious nature.

Currently, the domain status is offline, indicating takedown actions have been successful. Users are advised to avoid this domain entirely and rely only on verified Coinbase platforms to protect their data and assets.

## Threat Details
- Verdict: MALICIOUS
- Site status: dead (HTTP 403)
- Target brand: Coinbase
- Page title: Suspected phishing site | Cloudflare

## Domain Intelligence
- Registered: 2026-02-21 07:01:08
- Registrar: Cloudflare, Inc.
- Country: US
- IP: 172.66.44.120
- IP Country: US
- IP City: San Francisco
- IP Org: AS13335 Cloudflare, Inc.
- Nameservers: ["lou.ns.cloudflare.com", "laila.ns.cloudflare.com"]
- SSL Issuer: Google Trust Services / WE1

## Detection Status
- VirusTotal: 15 vendors flagged
  Vendors: ["ChainPatrol", "alphaMountain.ai", "BitDefender", "Chong Lua Dao", "CyRadar", "ESET", "Emsisoft", "Fortinet", "G-Data", "Kaspersky", "Lionic", "Netcraft", "Sophos", "VIPRE", "Webroot"]
- Google Safe Browsing: clean
- Blocklists: 2 hits
  Lists: ["PhishDestroy", "MetaMask"]

## Evidence
- Screenshot: https://urlscan.io/screenshots/019c5654-9cd0-72e5-bad7-81a312e03e2a.png
- Cloudflare Radar: https://radar.cloudflare.com/scan/07ae8543-7135-4281-83b7-e2a21124e219
- PhishDestroy: https://phishdestroy.io/domain/cloud-coinbase-en.pages.dev/
- LLM endpoint: https://phishdestroy.io/domain/cloud-coinbase-en.pages.dev/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/cloud-coinbase-en.pages.dev/
Last updated: 2026-03-19