# recall-coinbase.com — MALICIOUS

> PhishDestroy flags recall-coinbase.com as an active Coinbase impersonation site. Stay informed and protect your accounts now.

## Summary
PhishDestroy identifies recall-coinbase.com as a high-risk phishing domain impersonating Coinbase, a leading cryptocurrency exchange. This threat is particularly concerning as it aims to deceive users into surrendering login credentials, potentially leading to financial loss and identity theft. Vigilance is critical given the site’s convincing page title 'Sign In' designed to mimic genuine Coinbase interfaces.

The domain was registered recently on November 12, 2025, using OwnRegistrar, Inc., and resolves to the IP address 91.215.85.148. It currently remains active and is recognized on three security blocklists. VirusTotal scans report 17 out of 95 security vendors flagging this domain, reinforcing its malicious intent and confirming ongoing phishing campaigns leveraging this infrastructure.

Users should avoid interacting with recall-coinbase.com and refrain from entering any personal or financial information. It is recommended to verify URLs carefully, enable multi-factor authentication on Coinbase accounts, and report any suspicious activity directly to the official Coinbase support channels. Employing up-to-date security solutions can help detect and block such impersonation attempts effectively.

## Threat Details
- Verdict: MALICIOUS
- Site status: alive (HTTP 530)
- Target brand: Coinbase
- Page title: Sign In

## Domain Intelligence
- Registered: 2025-11-12 16:39:06
- Registrar: OwnRegistrar, Inc.
- Country: US
- IP: 91.215.85.148
- Nameservers: ["a.dnspod.com", "b.dnspod.com", "c.dnspod.com"]
- SSL Issuer: R12

## Detection Status
- VirusTotal: 17 vendors flagged
  Vendors: ["ADMINUSLabs", "ChainPatrol", "alphaMountain.ai", "BitDefender", "CyRadar", "ESET", "Forcepoint ThreatSeeker", "Fortinet", "G-Data", "Google Safebrowsing", "Kaspersky", "Lionic", "Seclookup", "SOCRadar", "Sophos", "VIPRE", "Webroot"]
- Google Safe Browsing: clean
- Blocklists: 3 hits
  Lists: ["PhishDestroy", "MetaMask", "SEAL"]

## Evidence
- Screenshot: https://urlscan.io/screenshots/019a7b6a-0c8f-71aa-a054-83339201f20b.png
- PhishDestroy: https://phishdestroy.io/domain/recall-coinbase.com/
- LLM endpoint: https://phishdestroy.io/domain/recall-coinbase.com/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/recall-coinbase.com/
Last updated: 2026-03-19