# coinbase-com-auth.pages.dev — MALICIOUS

> coinbase-com-auth.pages.dev is a high-risk phishing site. Avoid entering personal info; the domain is offline but was flagged on multiple security lists.

## Summary
PhishDestroy identifies coinbase-com-auth.pages.dev as a high-risk phishing domain designed to mimic Coinbase authentication pages. Such phishing attacks are critical threats because they aim to steal sensitive credentials, potentially leading to financial loss or identity theft. Users encountering this domain should be aware that it was created to deceive Coinbase users by impersonating legitimate login interfaces.

Infrastructure analysis reveals that this domain was registered through Cloudflare, Inc. and appeared on three separate security blocklists. Additionally, 14 out of 95 security vendors on VirusTotal flagged this domain as malicious, confirming its suspicious nature. Despite being taken offline, the domain's creation date in February 2026 suggests it was a recent attempt to exploit users with fraudulent activity.

Users are strongly advised to avoid interacting with coinbase-com-auth.pages.dev or any similar URLs that imitate Coinbase or other financial services. If users have entered any credentials on this site, they should immediately change their passwords and enable two-factor authentication on their Coinbase accounts. Staying vigilant and verifying URLs before entering sensitive information is essential to protect against phishing scams.

## Threat Details
- Verdict: MALICIOUS
- Site status: dead (HTTP 403)
- Target brand: Coinbase
- Page title: Suspected phishing site | Cloudflare

## Domain Intelligence
- Registered: 2026-02-21 07:01:08
- Registrar: Cloudflare, Inc.
- Country: US
- Nameservers: ["vivienne.ns.cloudflare.com", "jonah.ns.cloudflare.com"]

## Detection Status
- VirusTotal: 14 vendors flagged
  Vendors: ["ADMINUSLabs", "ChainPatrol", "alphaMountain.ai", "BitDefender", "Chong Lua Dao", "CRDF", "CyRadar", "ESET", "Fortinet", "G-Data", "Lionic", "Sophos", "VIPRE", "Webroot"]
- Google Safe Browsing: clean
- Blocklists: 2 hits
  Lists: ["PhishDestroy", "MetaMask"]

## Evidence
- Screenshot: https://urlscan.io/screenshots/019cd14b-e73c-7528-89f8-53648245b80d.png
- Cloudflare Radar: https://radar.cloudflare.com/scan/735e065e-3649-46af-9e02-29d4af763ec7
- PhishDestroy: https://phishdestroy.io/domain/coinbase-com-auth.pages.dev/
- LLM endpoint: https://phishdestroy.io/domain/coinbase-com-auth.pages.dev/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/coinbase-com-auth.pages.dev/
Last updated: 2026-03-19