coinbase[.]safedev[.]app

coinbase.safedev.app is a subdomain of safedev.app. PhishDestroy first observed the hostname on Aug 20, 2026. The hostname explicitly references Coinbase; stored content metadata identifies the same apparent target. The captured page title is “Bot Verification”. Stored page analysis classifies the content as impersonation. Current evidence score: 98/100 (critical).

Positive findings are stored from 2 sources: VirusTotal and Google Safe Browsing. VirusTotal recorded 13 detections among 91 engines: ADMINUSLabs, BitDefender, Chong Lua Dao, CRDF, CyRadar, ESET, Fortinet, G-Data, Google Safe Browsing, Kaspersky, Lionic, Sophos, VIPRE on Aug 20, 2026 at 14:50 UTC. Google Safe Browsing flagged the domain: Social Engineering on Aug 20, 2026 at 15:29 UTC. Non-positive and contextual checks: The separate external-blocklist snapshot contained no matches on Aug 20, 2026 at 14:20 UTC. URLScan captured the page on Aug 20, 2026 at 14:48 UTC.

The collector marked the hostname reachable on Aug 20, 2026 at 14:48 UTC, but did not retain the HTTP response code. At collection time, the hostname resolved to 198.251.88.32. The stored server header is LiteSpeed. The evidence archive retains 2 visual captures from PhishDestroy and URLScan. TLS metadata lists Let's Encrypt as the certificate issuer with validity through Oct 29, 2026; checked Aug 20, 2026 at 16:02 UTC.

The content indicators and 2 positive source findings support the current Coinbase-themed impersonation classification.