Suspicious

Phishings targeting Coinbase

Suspicious and active websites

Phishings targeting Coinbase

Suspicious and active websites

Active
11
New (7d)
1
Trend (7d)
↓67%
Website
coinbase.com
About
AICrypto exchange phishing - same login / 2FA-bypass pattern as Binance.
Hosts
Amazon.com, Inc. (4) · Cloudflare, Inc. (3) · Trellian Pty. Limited (1)
Countries
United StatesUnited States (10) · LuxembourgLuxembourg (1)
TLS certs
WR1 (3) · WE1 (3) · YR2 (1)

Suspicious sites — confidence is not always 100%. Use for Threat Hunting or watchlists.

Last check (UTC) First seen (UTC) ▾ URL Screenshot Flags Details
2026-10-22 23:30 2026-10-19 17:22
https://coinbase-passive-income.com
Screenshot of coinbase-passive-income.com GSB Details
2026-10-22 23:30 2026-10-15 23:24
https://coinbase.am.in
Screenshot of coinbase.am.in GSB Details
2026-10-22 23:30 2026-10-14 13:03
http://coinbase-connetct.vercel.app
Screenshot of coinbase-connetct.vercel.app OpenPhish Details
2026-10-22 23:30 2026-10-12 05:24
https://srv6-coinbase.com
Screenshot of srv6-coinbase.com GSB Details
2026-10-22 23:30 2026-10-08 17:24
https://1789503-coinbase.com
Screenshot of 1789503-coinbase.com GSB Details
2026-10-22 23:30 2026-10-01 01:02
https://secure-coinbase-com-sign-in.typedream.app/en-us
Screenshot of secure-coinbase-com-sign-in.typedream.app OpenPhish Details
2026-10-22 23:30 2026-09-27 01:02
https://coinbaseprologinv.gitbook.io
Screenshot of coinbaseprologinv.gitbook.io GSB OpenPhish Details
2026-10-22 23:30 2026-09-23 10:01
http://coinbaseverify.vercel.app
Screenshot of coinbaseverify.vercel.app OpenPhish TweetFeed Details
2026-10-22 23:30 2026-09-19 23:25
https://thomas-coinbase.com
Screenshot of thomas-coinbase.com Details
2026-10-22 23:30 2026-09-10 13:08
https://coinbase-event.vercel.app
Screenshot of coinbase-event.vercel.app OpenPhish Details
2026-10-22 23:30 2026-07-07 01:45
https://securedsupport-coinbase.com
Screenshot of securedsupport-coinbase.com urlscan Details

Suspicious sites — confidence is not always 100%. Use for Threat Hunting or watchlists.

URL Screenshot Details
https://coinbase-passive-inco…
GSB 		Screenshot of coinbase-passive-income.com Details
https://coinbase.am.in
GSB 		Screenshot of coinbase.am.in Details
http://coinbase-connetct.verc…
OpenPhish 		Screenshot of coinbase-connetct.vercel.app Details
https://srv6-coinbase.com
GSB 		Screenshot of srv6-coinbase.com Details
https://1789503-coinbase.com
GSB 		Screenshot of 1789503-coinbase.com Details
https://secure-coinbase-com-s…
OpenPhish 		Screenshot of secure-coinbase-com-sign-in.typedream.app Details
https://coinbaseprologinv.git…
GSB OpenPhish 		Screenshot of coinbaseprologinv.gitbook.io Details
http://coinbaseverify.vercel.…
OpenPhish TweetFeed 		Screenshot of coinbaseverify.vercel.app Details
https://thomas-coinbase.com
Screenshot of thomas-coinbase.com Details
https://coinbase-event.vercel…
OpenPhish 		Screenshot of coinbase-event.vercel.app Details
https://securedsupport-coinba…
urlscan 		Screenshot of securedsupport-coinbase.com Details

AIHow to verify a real Coinbase URL

  • Legitimate Coinbase URLs always end in coinbase.com (e.g. www.coinbase.com, account.coinbase.com). Anything else — including look-alike typosquats, hyphenated variations, or unfamiliar TLDs like .xyz / .top / .vip — is not Coinbase.
  • The padlock icon proves TLS is active, not that the site is safe. Free DV certificates are issued to attackers in minutes; every active site listed above has a valid TLS certificate.
  • If you got the link from email, SMS, or social media, do not click it. Open coinbase.com from your browser bookmark or type the domain manually.
  • Real Coinbase pages almost never ask for credentials immediately after clicking from a message — treat any such redirect as a phishing attempt until the domain is verified.