support-coinbase[.]de

PhishDestroy first observed support-coinbase.de on Aug 17, 2026. The hostname explicitly references Coinbase and uses “support,” a pattern consistent with a support lure; stored content metadata identifies the same apparent target. The captured page title is “404 Not Found”. Stored page analysis classifies the content as impersonation. Current evidence score: 100/100 (critical).

Positive findings are stored from 6 sources: VirusTotal, MetaMask, SEAL, Google Safe Browsing, Spamhaus DBL, and Cloudflare Radar. VirusTotal recorded 12 detections among 91 engines: alphaMountain.ai, BitDefender, CRDF, ESET, Forcepoint ThreatSeeker, Fortinet, G-Data, Google Safe Browsing, Gridinsoft, Kaspersky, SOCRadar, Sophos on Aug 21, 2026 at 04:47 UTC. MetaMask and SEAL listed the hostname in the separate external-blocklist snapshot on Aug 23, 2026 at 06:20 UTC. Google Safe Browsing flagged the domain: Social Engineering on Aug 21, 2026 at 17:09 UTC. Spamhaus DBL: DBL_PHISH on Aug 19, 2026 at 22:30 UTC. Cloudflare Radar classified the hostname as malicious and placed it in the phishing category; its verdict timestamp was not retained. Non-positive and contextual checks: AlienVault OTX listed 3 community pulse references (not vendor detections) on Aug 21, 2026 at 17:10 UTC.

The collector marked the hostname reachable on Aug 22, 2026 at 22:15 UTC, but did not retain the HTTP response code. At collection time, the hostname resolved to 46.30.211.38 on AS51468 (One.com A/S). The recorded endpoint location is Copenhagen, DK. The stored server header is nginx/1.18.0 (Ubuntu). TLS metadata lists Let's Encrypt as the certificate issuer with validity through Oct 18, 2026; checked Aug 20, 2026 at 01:02 UTC.

The content indicators and 6 positive source findings support the current Coinbase-themed support phishing classification.