Suspicious

Phishings targeting Coinbase

Suspicious and active websites

Phishings targeting Coinbase

Suspicious and active websites

Active
15
New (7d)
6
Trend (7d)
↑200%
Website
coinbase.com
About
AICrypto exchange phishing - same login / 2FA-bypass pattern as Binance.
Hosts
Cloudflare, Inc. (6) · Amazon.com, Inc. (4) · Trellian Pty. Limited (1)
Countries
United StatesUnited States (13) · LuxembourgLuxembourg (1) · CyprusCyprus (1)
TLS certs
YE2 (3) · WE1 (3) · WR1 (2)

Suspicious sites — confidence is not always 100%. Use for Threat Hunting or watchlists.

Last check (UTC) First seen (UTC) ▾ URL Screenshot Flags Details
2026-10-02 23:25 2026-10-02 23:25
https://9232995-coinbase.com
Screenshot of 9232995-coinbase.com GSB Details
2026-10-02 21:30 2026-10-01 01:02
https://secure-coinbase-com-sign-in.typedream.app/en-us
Screenshot of secure-coinbase-com-sign-in.typedream.app OpenPhish Details
2026-10-02 21:30 2026-09-30 05:25
https://smtp6-coinbase.com
Screenshot of smtp6-coinbase.com GSB Details
2026-10-02 21:30 2026-09-28 05:26
https://524675-coinbase.com
Screenshot of 524675-coinbase.com GSB Details
2026-10-02 21:30 2026-09-27 17:26
https://holdings-coinbase.com
Screenshot of holdings-coinbase.com GSB Details
2026-10-02 21:30 2026-09-27 01:02
https://coinbaseprologinv.gitbook.io
Screenshot of coinbaseprologinv.gitbook.io GSB OpenPhish Details
2026-10-02 21:30 2026-09-23 10:01
http://coinbaseverify.vercel.app
Screenshot of coinbaseverify.vercel.app OpenPhish TweetFeed Details
2026-10-02 21:30 2026-09-19 23:25
https://thomas-coinbase.com
Screenshot of thomas-coinbase.com Details
2026-10-02 21:30 2026-09-13 17:25
https://autoconfig.190842-coinbase.com
Screenshot of autoconfig.190842-coinbase.com GSB Details
2026-10-02 21:30 2026-09-10 13:08
https://coinbase-event.vercel.app
Screenshot of coinbase-event.vercel.app OpenPhish Details
2026-10-02 21:30 2026-09-10 05:25
https://coinbase.com.lc
Screenshot of coinbase.com.lc GSB Details
2026-10-02 21:30 2026-09-05 17:24
https://286364-coinbase.com
Screenshot of 286364-coinbase.com GSB Details
2026-10-02 21:30 2026-09-04 17:24
https://283674-coinbase.com
Screenshot of 283674-coinbase.com GSB Details
2026-10-02 21:30 2026-08-17 01:03
http://coinbaseinvestors.ai
Screenshot of coinbaseinvestors.ai GSB OpenPhish urlscan Details
2026-10-02 21:30 2026-07-07 01:45
https://securedsupport-coinbase.com
Screenshot of securedsupport-coinbase.com urlscan Details

Suspicious sites — confidence is not always 100%. Use for Threat Hunting or watchlists.

URL Screenshot Details
https://9232995-coinbase.com
GSB 		Screenshot of 9232995-coinbase.com Details
https://secure-coinbase-com-s…
OpenPhish 		Screenshot of secure-coinbase-com-sign-in.typedream.app Details
https://smtp6-coinbase.com
GSB 		Screenshot of smtp6-coinbase.com Details
https://524675-coinbase.com
GSB 		Screenshot of 524675-coinbase.com Details
https://holdings-coinbase.com
GSB 		Screenshot of holdings-coinbase.com Details
https://coinbaseprologinv.git…
GSB OpenPhish 		Screenshot of coinbaseprologinv.gitbook.io Details
http://coinbaseverify.vercel.…
OpenPhish TweetFeed 		Screenshot of coinbaseverify.vercel.app Details
https://thomas-coinbase.com
Screenshot of thomas-coinbase.com Details
https://autoconfig.190842-coi…
GSB 		Screenshot of autoconfig.190842-coinbase.com Details
https://coinbase-event.vercel…
OpenPhish 		Screenshot of coinbase-event.vercel.app Details
https://coinbase.com.lc
GSB 		Screenshot of coinbase.com.lc Details
https://286364-coinbase.com
GSB 		Screenshot of 286364-coinbase.com Details
https://283674-coinbase.com
GSB 		Screenshot of 283674-coinbase.com Details
http://coinbaseinvestors.ai
GSB OpenPhish urlscan 		Screenshot of coinbaseinvestors.ai Details
https://securedsupport-coinba…
urlscan 		Screenshot of securedsupport-coinbase.com Details

AIHow to verify a real Coinbase URL

  • Legitimate Coinbase URLs always end in coinbase.com (e.g. www.coinbase.com, account.coinbase.com). Anything else — including look-alike typosquats, hyphenated variations, or unfamiliar TLDs like .xyz / .top / .vip — is not Coinbase.
  • The padlock icon proves TLS is active, not that the site is safe. Free DV certificates are issued to attackers in minutes; every active site listed above has a valid TLS certificate.
  • If you got the link from email, SMS, or social media, do not click it. Open coinbase.com from your browser bookmark or type the domain manually.
  • Real Coinbase pages almost never ask for credentials immediately after clicking from a message — treat any such redirect as a phishing attempt until the domain is verified.