# home-coinbase-io.pages.dev — MALICIOUS

> home-coinbase-io.pages.dev is a high-risk phishing domain impersonating Coinbase. Avoid interaction; the site is currently offline for your safety.

## Summary
PhishDestroy identifies home-coinbase-io.pages.dev as a high-risk brand impersonation threat targeting Coinbase users. This domain was specifically designed to deceive victims by mimicking the trusted cryptocurrency platform, increasing the potential for credential theft and financial fraud.

Supporting evidence of malicious intent includes its recent creation date in February 2026 and registration through Cloudflare, Inc., a common registrar exploited for quick domain setup. The domain was flagged by 14 out of 95 VirusTotal security engines and appears on three security blocklists. The site resolved to IP 172.66.47.30 and displayed a 'Suspected phishing site' warning from Cloudflare, confirming its hostile nature.

Currently, the domain is offline, mitigating immediate risk to users. PhishDestroy recommends avoiding any interaction with this URL and advises users to verify official Coinbase communications through legitimate channels. Continuous monitoring and prompt takedown actions are critical to prevent further exposure to this and similar phishing threats.

## Threat Details
- Verdict: MALICIOUS
- Site status: dead (HTTP 403)
- Target brand: Coinbase
- Page title: Suspected phishing site | Cloudflare

## Domain Intelligence
- Registered: 2026-02-21 07:01:08
- Registrar: Cloudflare, Inc.
- Country: US
- IP: 172.66.47.30
- IP Country: US
- IP City: San Francisco
- IP Org: AS13335 Cloudflare, Inc.
- Nameservers: ["journey.ns.cloudflare.com", "matias.ns.cloudflare.com"]
- SSL Issuer: Google Trust Services / WE1

## Detection Status
- VirusTotal: 14 vendors flagged
  Vendors: ["ADMINUSLabs", "ChainPatrol", "alphaMountain.ai", "BitDefender", "CRDF", "CyRadar", "ESET", "Fortinet", "G-Data", "Kaspersky", "Lionic", "Sophos", "VIPRE", "Webroot"]
- Google Safe Browsing: clean
- Blocklists: 3 hits
  Lists: ["PhishDestroy", "MetaMask", "SEAL"]

## Evidence
- Screenshot: https://urlscan.io/screenshots/019c9b44-920f-7218-812e-334083081bdc.png
- Cloudflare Radar: https://radar.cloudflare.com/scan/42816f22-d1a1-4041-8cf5-2f6ae212dfb3
- PhishDestroy: https://phishdestroy.io/domain/home-coinbase-io.pages.dev/
- LLM endpoint: https://phishdestroy.io/domain/home-coinbase-io.pages.dev/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/home-coinbase-io.pages.dev/
Last updated: 2026-03-19