# wcow.pages.dev — SUSPICIOUS

> wcow.pages.dev mimicked Coinbase to deceive users. The domain is offline now. Stay alert and avoid suspicious links for wallet security.

## Summary
PhishDestroy identifies wcow.pages.dev as a medium-risk brand impersonation domain targeting Coinbase. The site falsely presented itself as the official Coinbase Wallet download page, aiming to mislead users into trusting fraudulent content. This impersonation is intended to exploit Coinbase's brand reputation to facilitate potential phishing or credential theft.

The domain was registered through Cloudflare, Inc. and created on March 6, 2026. It resolved to the IP address 188.114.96.3. Despite appearing on two security blocklists and being flagged by three out of 95 security vendors on VirusTotal, the domain currently remains offline. These technical indicators suggest that wcow.pages.dev had some malicious indicators, but was eventually taken down to mitigate further risk.

Given its offline status, wcow.pages.dev no longer poses an active threat. However, users and organizations should remain vigilant against similar impersonation attempts leveraging trusted brands like Coinbase. It is recommended to verify domain authenticity carefully before downloading wallets or entering sensitive information. Incorporating domain blocklisting and continuous monitoring can help protect against recurring threats with similar tactics.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: dead (HTTP ?)
- Target brand: Coinbase
- Page title: Download Coinbase Wallet - Official Website

## Domain Intelligence
- Registered: 2026-03-06 13:07:01
- Registrar: Cloudflare, Inc.
- Country: US
- IP: 188.114.96.3
- IP Country: US
- IP City: San Francisco
- IP Org: AS13335 Cloudflare, Inc.
- Nameservers: aarav.ns.cloudflare.com princess.ns.cloudflare.com
- SSL Issuer: none

## Detection Status
- VirusTotal: 3 vendors flagged
  Vendors: ["ADMINUSLabs", "Google Safebrowsing", "Phishing Database"]
- Google Safe Browsing: clean
- Blocklists: 2 hits
  Lists: ["PhishDestroy", "MetaMask"]

## Evidence
- Screenshot: https://urlscan.io/screenshots/019cc2e5-8a29-723a-af71-7dde4ce41008.png
- Cloudflare Radar: https://radar.cloudflare.com/domains/wcow.pages.dev
- Wayback Machine: https://web.archive.org/web/https://wcow.pages.dev
- PhishDestroy: https://phishdestroy.io/domain/wcow.pages.dev/
- LLM endpoint: https://phishdestroy.io/domain/wcow.pages.dev/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/wcow.pages.dev/
Last updated: 2026-03-19