Highscore 44 · flagged Tuesday, November 10, 2026

coinbaseprotect.com

Appeared in the .com zone on Tuesday, November 10, 2026; by the end of that day the census found active website about hosting & domains. Full domain report

Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.

Own one of these names and think the listing is wrong? Tell us and a person will look.

What matched

brand in the name
matched: coinbase
+30
brand name on a rarely-seen nameserver
matched: packetra.com
+6
brand name at a retail registrar
matched: Internet Domain Service BS Corp
+8
Registrar
Internet Domain Service BS Corp
Nameserver provider
Nameservers
dufour.ns.packetra.com, saana.ns.packetra.com
First-day state
active website
HTTP status
200
Page title
Can’t Find the Server
Has a form
no
Brand echoed
coinbase

Model opinions

Second opinionlooks like phishingtarget: Coinbaseconfidence 88%· claude-opus-5-5

Domain coinbaseprotect.com is a brand-squat on Coinbase and serves a near-exact clone of Coinbase's homepage (logo, UI, 'The future of money is here'), with an email-collecting form posting to itself and all offsite links pointing to the real coinbase.com as decoys — the 'protect' framing is classic account-security credential-harvest bait.

First passlooks like phishingtarget: Coinbaseconfidence 95%· claude-haiku-4-5

The domain coinbaseprotect.com impersonates Coinbase by displaying the Coinbase logo, navigation, and app interface (showing crypto balances, trading UI, and branding). The page title 'Can't Find the Server' contradicts the fully-rendered Coinbase UI, indicating a template mismatch. Combined with the brand-in-name domain, suspicious registrar (Internet Domain Service BS Corp), rare nameservers (packetra.com), and an email collection form posting to itself, this exhibits classic phishing infrastr

A model looked at the screenshot and page text and wrote what it thought. It can be wrong, and it is not a finding.

What the page looked like on Tuesday, November 10, 2026

Screenshot of coinbaseprotect.com taken by the zone census on 2026-11-10

Same data as JSON: /api/zone/domain/coinbaseprotect.com. This page is not indexed by search engines and does not link to the site it describes.