disconnect-coinbase.support
Appeared in the .support zone on Saturday, October 10, 2026; by the end of that day the census found server error. Full domain report
Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.
Own one of these names and think the listing is wrong? Tell us and a person will look.
What matched
Model opinions
The name 'disconnect-coinbase.support' pairs the Coinbase brand with 'disconnect' and a .support TLD, the usual shape of a fake-support or wallet-drainer lure, on a retail registrar behind Cloudflare. The page itself is only a Cloudflare 521 error with no content or form, so this is a brand-squat set up for deception rather than live phishing.
The domain disconnect-coinbase.support combines 'coinbase' with a support TLD and uses Cloudflare nameservers, consistent with phishing infrastructure setup. However, the page currently shows only a Cloudflare 521 error with no actual phishing content (no login form, no credential capture mechanism). The domain is registered via a retail registrar and was recently created, suggesting active preparation for a phishing attack, but the attack page is not yet deployed or is temporarily down.
A model looked at the screenshot and page text and wrote what it thought. It can be wrong, and it is not a finding.
What the page looked like on Saturday, October 10, 2026
Same data as JSON: /api/zone/domain/disconnect-coinbase.support. This page is not indexed by search engines and does not link to the site it describes.