# coinbase-help-c6c.pages.dev — MALICIOUS

> coinbase-help-c6c.pages.dev impersonated Coinbase to steal data. Now offline after being flagged for social engineering and listed on multiple blocklists.

## Summary
PhishDestroy identifies coinbase-help-c6c.pages.dev as a high-risk phishing domain impersonating the Coinbase brand. The site aimed to deceive users into divulging sensitive information by mimicking Coinbase’s official services.

The domain was registered via Cloudflare, Inc. on February 21, 2026, resolving to IP 172.66.47.42. It was detected on three security blocklists and flagged by Google Safe Browsing for social engineering. VirusTotal analysis showed 14 out of 95 vendors flagged this domain, confirming its malicious intent.

Currently, coinbase-help-c6c.pages.dev is offline and inaccessible. Users are advised to avoid any correspondence linked to this domain and verify URLs carefully when accessing Coinbase-related services. Continued vigilance and use of security tools are recommended to prevent exposure to similar phishing threats.

## Threat Details
- Verdict: MALICIOUS
- Site status: dead (HTTP 403)
- Target brand: Coinbase
- Page title: Suspected phishing site | Cloudflare

## Domain Intelligence
- Registered: 2026-02-21 07:01:08
- Registrar: Cloudflare, Inc.
- Country: US
- IP: 172.66.47.42
- IP Country: US
- IP City: San Francisco
- IP Org: AS13335 Cloudflare, Inc.
- Nameservers: ["mckenzie.ns.cloudflare.com", "sterling.ns.cloudflare.com"]
- SSL Issuer: Google Trust Services / WE1

## Detection Status
- VirusTotal: 14 vendors flagged
  Vendors: ["ADMINUSLabs", "ChainPatrol", "alphaMountain.ai", "BitDefender", "CyRadar", "ESET", "Fortinet", "G-Data", "Google Safebrowsing", "Kaspersky", "Lionic", "Sophos", "VIPRE", "Webroot"]
- Google Safe Browsing: FLAGGED
- Blocklists: 3 hits
  Lists: ["PhishDestroy", "MetaMask", "SEAL"]

## Evidence
- Screenshot: https://urlscan.io/screenshots/019cda4c-0b22-71ab-a2e4-648957f4da3e.png
- Cloudflare Radar: https://radar.cloudflare.com/scan/c8239918-8aed-480f-8608-38c10f8f0745
- PhishDestroy: https://phishdestroy.io/domain/coinbase-help-c6c.pages.dev/
- LLM endpoint: https://phishdestroy.io/domain/coinbase-help-c6c.pages.dev/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/coinbase-help-c6c.pages.dev/
Last updated: 2026-03-19