# laern-coinbase-sin.pages.dev — MALICIOUS

> Warning: laern-coinbase-sin.pages.dev is a high-risk phishing domain. Avoid interaction and verify official Coinbase sources.

## Summary
PhishDestroy identifies laern-coinbase-sin.pages.dev as a high-risk generic phishing domain designed to deceive users by mimicking Coinbase-related services. The site aims to harvest sensitive information through social engineering tactics, posing a significant threat to unsuspecting visitors.

The domain was registered through Cloudflare, Inc. on February 21, 2026, and is associated with multiple security warnings. It appears on three prominent security blocklists and is flagged by 14 security vendors on VirusTotal. Google Safe Browsing classifies it under "SOCIAL_ENGINEERING," indicating its use in scams targeting user trust.

Currently, laern-coinbase-sin.pages.dev has been taken offline, reducing immediate risk. However, users are advised to remain vigilant, avoid clicking suspicious links, and always verify URLs directly through official Coinbase channels to prevent credential theft or fraud.

## Threat Details
- Verdict: MALICIOUS
- Site status: dead (HTTP 403)
- Target brand: Coinbase
- Page title: Suspected phishing site | Cloudflare

## Domain Intelligence
- Registered: 2026-02-21 07:01:08
- Registrar: Cloudflare, Inc.
- Country: US
- IP: 172.66.47.79
- IP Country: US
- IP City: San Francisco
- IP Org: AS13335 Cloudflare, Inc.
- Nameservers: ["anita.ns.cloudflare.com", "merlin.ns.cloudflare.com"]
- SSL Issuer: Google Trust Services / WE1

## Detection Status
- VirusTotal: 14 vendors flagged
  Vendors: ["ADMINUSLabs", "ChainPatrol", "alphaMountain.ai", "BitDefender", "CyRadar", "ESET", "Fortinet", "G-Data", "Google Safebrowsing", "Kaspersky", "Lionic", "Sophos", "VIPRE", "Webroot"]
- Google Safe Browsing: FLAGGED
- Blocklists: 3 hits
  Lists: ["PhishDestroy", "MetaMask", "SEAL"]

## Evidence
- Screenshot: https://urlscan.io/screenshots/019ce390-2276-727b-8965-ebfe0635778a.png
- Cloudflare Radar: https://radar.cloudflare.com/scan/056a42f6-d936-4cbf-8cc3-5add0deebb79
- PhishDestroy: https://phishdestroy.io/domain/laern-coinbase-sin.pages.dev/
- LLM endpoint: https://phishdestroy.io/domain/laern-coinbase-sin.pages.dev/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/laern-coinbase-sin.pages.dev/
Last updated: 2026-03-19