# coinbase-pro-help-en.pages.dev — MALICIOUS

> coinbase-pro-help-en.pages.dev is a high-risk phishing site impersonating Coinbase. Stay alert and verify URLs before sharing credentials.

## Summary
PhishDestroy identifies coinbase-pro-help-en.pages.dev as a high-risk phishing domain impersonating the cryptocurrency platform Coinbase. This brand impersonation threat aims to deceive users into divulging sensitive information by mimicking legitimate Coinbase services, posing significant risks including credential theft and financial loss.

The domain was registered on February 21, 2026, through Cloudflare, Inc. and resolves to IP address 172.66.45.17. It appeared on two security blocklists and was flagged by 13 out of 95 VirusTotal security vendors. Currently, the domain is offline and displays a warning page titled "Suspected phishing site | Cloudflare."

Users are advised to remain vigilant and avoid interacting with coinbase-pro-help-en.pages.dev or any suspicious URLs claiming to represent Coinbase. Always verify domain authenticity by accessing official websites directly and use multi-factor authentication where possible to protect accounts from unauthorized access.

## Threat Details
- Verdict: MALICIOUS
- Site status: dead (HTTP 403)
- Target brand: Coinbase
- Page title: Suspected phishing site | Cloudflare

## Domain Intelligence
- Registered: 2026-02-21 07:01:08
- Registrar: Cloudflare, Inc.
- Country: US
- IP: 172.66.45.17
- IP Country: US
- IP City: San Francisco
- IP Org: AS13335 Cloudflare, Inc.
- Nameservers: ["odin.ns.cloudflare.com", "luciane.ns.cloudflare.com"]
- SSL Issuer: Google Trust Services / WE1

## Detection Status
- VirusTotal: 13 vendors flagged
  Vendors: ["ADMINUSLabs", "ChainPatrol", "alphaMountain.ai", "BitDefender", "CyRadar", "Emsisoft", "Fortinet", "G-Data", "Kaspersky", "Lionic", "Netcraft", "Sophos", "Webroot"]
- Google Safe Browsing: clean
- Blocklists: 2 hits
  Lists: ["PhishDestroy", "MetaMask"]

## Evidence
- Screenshot: https://urlscan.io/screenshots/019cb830-71e6-7147-a53e-44077cc88ed5.png
- Cloudflare Radar: https://radar.cloudflare.com/scan/24de0389-e85f-4dec-ad7a-427a501b9524
- PhishDestroy: https://phishdestroy.io/domain/coinbase-pro-help-en.pages.dev/
- LLM endpoint: https://phishdestroy.io/domain/coinbase-pro-help-en.pages.dev/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/coinbase-pro-help-en.pages.dev/
Last updated: 2026-03-19