The full anatomy of a phishing site,
one URL at a time.
ZeroPhish renders the page, runs twelve detection signals against the DOM, certificate chain, brand fingerprint and threat feeds, and returns a typed verdict. Built for security teams and product engineers.
Phishing detected
| URL | hxxps://download[.]c0inbase-vn[.]com | |
| Brand | Coinbase | |
| Screenshot | https://cdn.zerophish.ai/52c9456f-b801-4893-96f4-d98a05989fb5.jpg | |
| Scan ID | f2511232-a42e-45f3-bd35-34bcef01df35 |
No detection signals on this scan — it predates the signal pipeline. Re-analyze to capture them.
No brand impersonation signals available.
No technical metadata captured for this scan.
The URL registered at ‘https://download.c0inbase-vn.com’ does not appear to be associated with the ‘Coinbase’ brand, and uses a common phishing technique of replacing letters with number or other characters (‘0’ in place of ‘o’). The HTML and OCR-extracted text do not display any direct signature social engineering techniques, but the mismatch between the brand and the URL suggests this may be a phishing site attempting to impersonate ‘Coinbase’.