ABUSE NOTICE · 7D+ OPEN Outgoing abuse reports are recorded; the latest stored availability evidence still shows the domain reachable.

Notification and current-status evidence

The sent-report ledger records the first outgoing report at 2026-05-12 18:00:49 UTC. The recorded recipient is abuse@transip.nl. The latest stored availability evidence still shows the domain reachable; 3 months has elapsed since the first outgoing report.

ICANN RAA §3.18 describes registrar abuse-contact and handling obligations. This section records outgoing timestamps, listed recipients, case identifiers, and later availability. It does not by itself prove receipt, acknowledgement, investigation, remediation, or contractual non-compliance.

Elapsed since first report

3 months

Reports sent

Latest case ID

PD-20260512-5B7AF0

Current status

Observed active at latest stored check

Sicurezza del dominio e intelligence sulle minacce

coinbaseprol0gin[.]onepage[.]website

“Coinbase Pro Login : Buy and Sell Bitcoin, Ethereum, and more with trust”

Verdetto di minaccia Critico Punteggio delle prove 100/100

Disponibilità Ammantato · raggiungibile Raggiungibilità osservata attraverso controlli di cloaking

Segnali di rischio

Rilevamenti VirusTotal: 10/91 Corrispondenze della blocklist memorizzate: 2 URLQuery threat systems: 6 alerts Simulazione del marchio: Coinbase Ultimo attivo conosciuto

12/05/2026 Coinbase 1 Report Sent

Riepilogo del rapporto

coinbaseprol0gin.onepage.website — Ammantato · raggiungibile. Simulazione del marchio: Coinbase; Tipo di truffa: Credential Phishing. Riepilogo delle prove: VirusTotal 10/91 (ADMINUSLabs, ChainPatrol, Chong Lua Dao, CRDF, CyRadar); URLQuery 6 alerts; URLScan malicious verdict; 2 external blocklist matches (MetaMask, SEAL); CF Radar malicious; cloaking observed; PhishDestroy score 100/100. Registrar: Hosting Concepts.

L’analisi dettagliata di PhishDestroy AI resta in inglese per preservare il rapporto forense originale.

Riepilogo delle prove

CRITICO

This domain, coinbaseprol0gin.onepage.website, is currently active and classified as a high‑risk brand‑impersonation campaign targeting Coinbase users. The site presents the page title “Coinbase Pro Login : Buy and Sell Bitcoin, Ethereum, and more with trust”, indicating a credential‑phishing attempt. Infrastructure analysis shows the domain was registered on 17 September 2014 through Hosting Concepts B.V. d/b/a Registrar.eu and uses the nameservers ns.compra.be, ns.compra.eu, ns.compra.nl, and ns.compra.uk. DNS resolution points to IP 136.144.226.23, a server located in the Netherlands on a TransIP VPS (Pod0 Rtm0). The web server runs Nginx and serves PHP content built with Bootstrap, jQuery, FancyBox and includes Google reCAPTCHA, suggesting a semi‑automated phishing kit. The SSL certificate is issued by Sectigo Limited under the Sectigo Public Server Authentication CA DV R36, which does not provide any brand validation. The domain appears on three security blocklists and is blocked by PhishDestroy, MetaMask, and SEAL. VirusTotal reports 12 of 91 scanners flagging the domain as malicious, reinforcing its malicious reputation. Gridinsoft assigns a trust score of 0 / 100. Defenders should immediately add the domain to DNS and proxy blocklists, enforce URL filtering for the full hostname, and monitor outbound connections to the associated IP address. Continuous threat‑intel feeds should be consulted for any emerging indicators, and users should be warned about unsolicited login prompts referencing Coinbase Pro.

VirusTotal

10 det.

URLQuery

6 threat alerts

DNS Security

7/14

CF Radar

Malevolo

URLScan

Segnala ↗

Certificato TLS

Sectigo Limited

Età

11.9 yr

Stato osservato

Ammantato · raggiungibile

Elenco da eliminare

In elenco

Reports Sent

Copertura dei dati VirusTotal 10 / 91 URLQuery 6 threat-system alerts PhishStats checked — no match recorded OTX no community references CF Radar provider verdict: malicious URLScan capture rapporto memorizzato URLScan verdict malicious Blocchi DNS 7/14 TLS valid certificate, 54d WHOIS 145 mo old Screenshot 3 captures · 3 sources Catena di reindirizzamenti non sondato

Informazioni sulla sicurezza di rete

DNS Provider Blocks 7 / 14

Brand Base Brand Coinbase Cloudflare Family Cloudflare Security Controld Adblock Controld Family Controld Malware

Threat Detection Systems 6 alerts

Detection System	Indicator	Verdict	Alert
Cloudflare DNS	`onepage.website`	malicious	Sinkholed
Hagezi Threat Feed	`onepage.website`	malicious	Sinkholed
DNS4EU	`onepage.website`	malicious	Sinkholed
DNS4EU	`coinbaseprol0gin.onepage.website`	malicious	Sinkholed
Cloudflare DNS	`coinbaseprol0gin.onepage.website`	malicious	Sinkholed
Hagezi Threat Feed	`coinbaseprol0gin.onepage.website`	malicious	Sinkholed

Cloudflare Radar Verdict Malevolo

Dns tunneling Phishing

Pipeline di risposta alle minacce

Scoperta

Checks

Reports

Disponibilità

14/15

URLScan.io Capture

Stored URLScan report with capture artifacts

URLScan Verdict

URLScan returned a malicious verdict · score 100

29/07/2026

Cloudflare Radar Report

A stored Cloudflare Radar report is available. The report link alone is not a malicious verdict and does not prove that every network field was captured.

VirusTotal

10/91 recorded on VirusTotal

09/08/2026

Google Safe Browsing

Checked via Rapporto sulla trasparenza di Google

12/05/2026

Rilevamento delle liste di blocco

Si trova in 2 blocklists: MetaMask, SEAL

14/08/2026

DNS Security Blocks

Blocked by 7 of 14 checked DNS providers: Brand base, Brand coinbase, Cloudflare family, Cloudflare security

CF Radar: Malicious

Cloudflare Radar classified this domain as dns tunneling, phishing

Brand Impersonation

Impersonation of Coinbase

Forensic Evidence Collected

Stored evidence from URLScan.io, URLQuery, stored screenshot

Technical Analysis Recorded

Il report contiene tecnologia archiviata o risultati di analisi forensi.

14/08/2026

Sent Report Recorded

Stored sent-report record for registrar Hosting Concepts B.V. d/b/a Registrar.eu, hosting provider, 3 abuse contacts

abuse@transip.nlabuse@signet.nlabuse@registrar.eu

12/05/2026

Stato della lista di blocco pubblica

Acquisizione salvata

Screenshot of coinbaseprol0gin.onepage.website — **URLScan capture**Capture time unavailable 2 / 3

Vedi a grandezza naturale Rapporto sorgente Wayback Scarica

Titolo della pagina

Coinbase Pro Login : Buy and Sell Bitcoin, Ethereum, and more with trust

Certificato TLS

Valid transport encryption · Emesso da Sectigo Limited · valid for 54 days

Analisi dei domini

Dominio

URLScan Verdict Malevolo score 100 Phishing brand: Coinbase report ↗

Server / ASN nginx · AS20857 Signet B.V.

Reputazione IP abuse score 0/100 0 reports checked 12/08/2026

Registrar (base domain) Hosting Concepts

(NL)

Contatto abusiabuse@transip.nl, abuse@signet.nl, abuse@registrar.eu

Registro ICANNRegistrar ufficiali accreditati dall'ICANN →

Ricerca WHOISICANN RDAP per onepage.website →

Indirizzo IP 136.144.226.23

Posizione

Amsterdam, NL

ReteAS20857 · Transip NL VPS Pod0 Rtm0

IP inversoviewdns.info → rapiddns.io →

Registration (base domain)onepage.website · Creato 17/09/2014

Cloaking Cloaking Detected Content divergence · score 1/6

unavailable: raw=proxy_error; http=0; via=http_proxy; error=HTTPConnectionPool(host='64.137.8.210', port=6892): Max retries exceeded with url: http://coinbaseprol0gin.onepage.websi

checked 14/08/2026

Elapsed Since First Report 33h

Cosa conteggiamo Raw elapsed time since the first stored abuse report. It is not a registrar response-time measurement. Latest observed status: Ammantato · raggiungibile.

Cosa contiene ogni rapporto I record archiviati dei report in uscita possono fare riferimento a prove disponibili in quel momento, come verdetti dei fornitori, dati di registrazione, dettagli di hosting, classificazioni o screenshot. Questa pagina non deduce l'esatto carico utile consegnato, la ricevuta, la conferma o l'azione da parte di un destinatario.

Dettagli tecniciDNS, SAN SSL, timestamp

Rilevato per la prima volta12/05/2026

IoC Extractionscanned 29/07/20260 wallet · 0 Telegram IoCs

Submitted URLhttp://coinbaseprol0gin.onepage.website/

Nameserverns.compra.bens.compra.euns.compra.nlns.compra.uk

TLS Fingerprint

TLS Observationvalid from 05/06/2025scanned 12/05/2026

TLS SAN Domainsonepage.website

Favicon Hash

Case ID

ICANN OVERSIGHT Registration: onepage.website

Accreditamento e contesto RAA

Registrar accreditation and DNS abuse obligations

For the registrable domain onepage.website behind this subdomain, the registrar above operates under an ICANN accreditation agreement. The links below provide the official fee schedule and current DNS abuse compliance guidance.

Accreditation is a contract, not a safety certification.

RAA §3.18 establishes abuse-contact and handling requirements. This report can document stored outbound notices and later technical observations; it does not by itself establish receipt, investigation, remediation, or contractual non-compliance.

L’accreditamento è un contratto, non un sigillo di sicurezza. Verifica le tariffe ICANN Leggi il RAA §3.18 PHISHDESTROY INVESTIGATIONICANN funding, contracts, and DNS abuse oversight

Accountability draft Nulla viene inviato automaticamente.

Tecnologie · 6 identified

PHP

Programming languages

PHP is a general-purpose scripting language used for web development.

php.net Confidenza al 100%

Bootstrap

UI frameworks

Bootstrap is a free and open-source CSS framework directed at responsive, mobile-first front-end web development. It contains CSS and JavaScript-based design templates for typography, forms, buttons, navigation, and other interface components.

getbootstrap.com Confidenza al 100%

Nginx

Web servers Reverse proxies

Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.

nginx.org Confidenza al 100%

reCAPTCHA

Sicurezza

reCAPTCHA is a free service from Google that helps protect websites from spam and abuse.

www.google.com Confidenza al 100%

jQuery

JavaScript libraries

jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.

jquery.com Confidenza al 100%

FancyBox

JavaScript libraries

FancyBox is a tool for displaying images, html content and multi-media in a Mac-style 'lightbox' that floats overtop of web page.

fancyapps.com Confidenza al 100%

Detected via Cloudflare Radar · Wappalyzer engine

Segnala questo dominio Invia le prove e contribuisci a proteggere gli altri

Analisi di VirusTotal

10 / I fornitori di sicurezza 91 hanno contrassegnato questo dominio

View on VT

Last analyzed 2026-08-09 04:17:09 UTC Previous stored snapshot: 12 detections

ADMINUSLabs

ChainPatrol

Chong Lua Dao

CRDF

CyRadar

Fortinet

Gridinsoft

Kaspersky

Lionic

Sophos

Analisi delle prestazioni del sito

Google PageSpeed Insights — mobile performance audit of coinbaseprol0gin.onepage.website · checked May 12, 2026

Poor

Performance

FCP

7.69s

First Contentful Paint

LCP

7.99s

Largest Contentful Paint

CLS

Cumulative Layout Shift

TBT

747ms

Total Blocking Time

7.69s

Speed Index

Dati e relazioni esterne

Analisi della sicurezza

URLScan Malevolo VirusTotal 10 det. ChainPatrol URLQuery 6 threat alerts Gridinsoft SSL Laboratori Stored TLS valid CF Radar Malevolo DNS Security 7/14 WOT ScamAdviser Verifica lista nera URLVoid Sucuri SiteCheck Osservatorio MDN

Submitted Evidence Snapshot

Sent: 2026-05-12 18:00:49 UTC Ledger records: 1 Case ID: PD-20260512-5B7AF0 Recipient: abuse@transip.nl

Page title stored with report: Coinbase Pro Login : Buy and Sell Bitcoin, Ethereum, and more with trust

URLScan evidence VirusTotal evidence URLQuery evidence Screenshot 192.8 KB

OSINT e intelligence

Web-Check Full scan SOCRadar Dark web report LeakIX Leak search Shodan Censys ThreatFox Hudson Rock Sign-in search IntelX crt.sh Certificati WHOIS Wayback

DNS e rete

nslookup.io DNS bgp.tools ASN /Percorso

SEO e dominio

SpyFu Moz DA/PA Ahrefs Backlink Analisi approfondita

Questo sito ti ha influenzato in qualche modo?

If credentials were compromised, report immediately. Do not engage with recovery scammers.

Se hai inserito credenziali dell'account, informazioni personali o di pagamento oppure hai scaricato un file da questo dominio, agisci immediatamente. Di seguito sono riportate le risorse per aiutarti a segnalare l'incidente e proteggerti.

FBI IC3

Segnala i crimini legati a Internet negli Stati Uniti

Federal tips line1-800-CALL-FBI

Europol

Trova il canale di segnalazione ufficiale per il tuo paese dell'UE

National police directory

Action Fraud

Segnala frodi e crimini informatici in Inghilterra, Galles e Irlanda del Nord

Contact centre0300 123 2040

PhishDestroy listing review Non un rapporto delle forze dell'ordine

Ricorso in materia di domini

Richiedi una revisione se possiedi questo dominio e ritieni che l'elenco non sia corretto

Attenzione ai truffatori che promettono il recupero dei fondi! I criminali possono contattare nuovamente le vittime fingendo di essere investigatori, avvocati o agenti di recupero. Non pagare commissioni anticipate né condividere credenziali. Scopri di più sulle frodi relative ai sussidi di recupero →

Segnalalo alle autorità locali

Seleziona il tuo Paese per ottenere contatti ufficiali del crimine informatico o creare una bozza di reclamo →.

Elenco di 97 paesi

Bozza assistita dall'intelligenza artificiale: i dettagli dell'incidente vengono elaborati dal fornitore di intelligenza artificiale Controllalo e invialo tu stesso

Rimani informato, rimani al sicuro

Controlla le minacce in tempo reale oppure contesta questa segnalazione se ritieni che si tratti di un falso positivo

Feed in tempo reale sulle minacce Contesta questo annuncio

HTML · IFRAME

Incorpora questo rapporto

Condividi queste informazioni sulle minacce sul tuo sito web o sul tuo blog

embed.html

<iframe
  src="https://phishdestroy.io/it/embed/domain/coinbaseprol0gin.onepage.website"
  title="PhishDestroy threat report for coinbaseprol0gin.onepage.website"
  width="100%" height="320"
  loading="lazy"
  referrerpolicy="no-referrer"
  sandbox="allow-same-origin allow-popups allow-popups-to-escape-sandbox"
  style="border:0;border-radius:12px;max-width:100%"
></iframe>

coinbaseprol0gin[.]onepage[.]website

Pipeline di risposta alle minacce

Stato della lista di blocco pubblica

Acquisizione salvata