# get-coinbase-home.pages.dev — MALICIOUS

> get-coinbase-home.pages.dev was a dangerous phishing site impersonating Coinbase. Stay alert and avoid suspicious links to protect your assets.

## Summary
PhishDestroy has identified get-coinbase-home.pages.dev as a high-risk phishing domain masquerading as Coinbase, one of the leading cryptocurrency platforms. This impersonation threat poses significant danger by attempting to deceive users into revealing sensitive credentials or financial information, potentially leading to account takeovers and financial loss. Given Coinbase’s prominence, attackers frequently target its brand to exploit user trust, making vigilance essential.

The domain was registered on February 21, 2026, through Cloudflare, Inc., and resolved to IP address 172.66.44.95, associated with Cloudflare’s infrastructure. Notably, it appeared on three separate security blocklists and was flagged by Google Safe Browsing under the "SOCIAL_ENGINEERING" category. VirusTotal scans revealed that 15 out of 95 security vendors detected malicious activity related to this domain. The site displayed a page title reading "Suspected phishing site | Cloudflare" and has since been taken offline, mitigating immediate risk but reminding users of ongoing threats.

Users should remain cautious of unsolicited messages or links claiming association with Coinbase or other financial services. Always verify URLs carefully and access platforms by directly typing known official addresses rather than clicking links. Employ multi-factor authentication on your accounts and report suspicious domains to relevant authorities and security vendors. PhishDestroy urges internet users to stay informed and proactive in combating brand impersonation threats like get-coinbase-home.pages.dev to safeguard their digital assets.

## Threat Details
- Verdict: MALICIOUS
- Site status: dead (HTTP 403)
- Target brand: Coinbase
- Page title: Suspected phishing site | Cloudflare

## Domain Intelligence
- Registered: 2026-02-21 07:01:08
- Registrar: Cloudflare, Inc.
- Country: US
- IP: 172.66.44.95
- IP Country: US
- IP City: San Francisco
- IP Org: AS13335 Cloudflare, Inc.
- Nameservers: ["sydney.ns.cloudflare.com", "brian.ns.cloudflare.com"]
- SSL Issuer: Google Trust Services / WE1

## Detection Status
- VirusTotal: 15 vendors flagged
  Vendors: ["ADMINUSLabs", "ChainPatrol", "alphaMountain.ai", "BitDefender", "CRDF", "CyRadar", "ESET", "Fortinet", "G-Data", "Google Safebrowsing", "Kaspersky", "Lionic", "Sophos", "VIPRE", "Webroot"]
- Google Safe Browsing: FLAGGED
- Blocklists: 3 hits
  Lists: ["PhishDestroy", "MetaMask", "SEAL"]

## Evidence
- Screenshot: https://urlscan.io/screenshots/019cbd75-e57f-7229-974f-da0711b081cb.png
- Cloudflare Radar: https://radar.cloudflare.com/scan/88e5e9fe-a576-40e1-a605-3664b41e2d07
- PhishDestroy: https://phishdestroy.io/domain/get-coinbase-home.pages.dev/
- LLM endpoint: https://phishdestroy.io/domain/get-coinbase-home.pages.dev/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/get-coinbase-home.pages.dev/
Last updated: 2026-03-19