# learn-coinbase-pro-en.pages.dev — MALICIOUS

> The domain learn-coinbase-pro-en.pages.dev is flagged as high-risk phishing. Avoid sharing personal info and never enter credentials here.

## Summary
PhishDestroy identifies learn-coinbase-pro-en.pages.dev as a high-risk phishing domain impersonating the Coinbase brand. This site poses a serious threat by attempting to deceive users into providing sensitive information under the guise of a trusted cryptocurrency platform. Such attacks can lead to financial loss or identity theft.

This phishing campaign operates by mimicking Coinbase’s official interface to trick visitors into entering login credentials or other private data. The domain was registered recently and is flagged by Google Safe Browsing for social engineering. Multiple security blocklists and 14 security vendors on VirusTotal also mark it as malicious. The site has since been taken offline, but users should remain vigilant.

If you have visited this domain, immediately change any passwords linked to your Coinbase account and monitor your financial activity closely. Avoid clicking on suspicious links or entering personal information on similar URLs. Reporting such phishing attempts helps protect others and contributes to ongoing threat intelligence efforts.

## Threat Details
- Verdict: MALICIOUS
- Site status: dead (HTTP 403)
- Target brand: Coinbase
- Page title: Suspected phishing site | Cloudflare

## Domain Intelligence
- Registered: 2026-02-21 07:01:08
- Registrar: Cloudflare, Inc.
- Country: US
- IP: 172.66.44.217
- IP Country: US
- IP City: San Francisco
- IP Org: AS13335 Cloudflare, Inc.
- Nameservers: ["jessica.ns.cloudflare.com", "anuj.ns.cloudflare.com"]
- SSL Issuer: Google Trust Services / WE1

## Detection Status
- VirusTotal: 14 vendors flagged
  Vendors: ["ADMINUSLabs", "ChainPatrol", "alphaMountain.ai", "BitDefender", "CRDF", "CyRadar", "ESET", "Fortinet", "G-Data", "Google Safebrowsing", "Lionic", "Sophos", "VIPRE", "Webroot"]
- Google Safe Browsing: FLAGGED
- Blocklists: 3 hits
  Lists: ["PhishDestroy", "MetaMask", "SEAL"]

## Evidence
- Screenshot: https://urlscan.io/screenshots/019cd200-dd4e-774b-92f6-b0160a532f45.png
- Cloudflare Radar: https://radar.cloudflare.com/scan/9b4e1b6d-689e-418e-ba89-cf7b3a974f01
- PhishDestroy: https://phishdestroy.io/domain/learn-coinbase-pro-en.pages.dev/
- LLM endpoint: https://phishdestroy.io/domain/learn-coinbase-pro-en.pages.dev/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/learn-coinbase-pro-en.pages.dev/
Last updated: 2026-03-19