cbase-dsfdsf[.]bawi00[.]workers[.]dev

Analysis indicates that cbase-dsfdsf.bawi00.workers.dev is an active brand impersonation operation targeting Coinbase. The observed page title is "Sign In", consistent with infrastructure designed to mimic a legitimate authentication workflow and collect user credentials. Available intelligence identifies the threat category as brand impersonation and assigns a high risk level. At the time of review, the site remained active and accessible, increasing the likelihood of continued exposure to potential victims.

Technical indicators show that the domain was created on March 03, 2026 and is registered through Cloudflare, Inc. The hostname resolves to IP address 172.67.157.157 within AS13335 Cloudflare, Inc., with geolocation data indicating the United States. The infrastructure presents an SSL certificate issued by Let's Encrypt / E8. Detection telemetry shows a VirusTotal score of 4/95 security vendors flagging the domain. Intelligence sources further indicate that the domain appears on 3 security blocklists and has been blocked by PhishDestroy, MetaMask, and SEAL. Current intelligence confirms that the domain remains active.

Risk assessment remains high due to the combination of active status, impersonation of a recognized cryptocurrency-related brand, credential-harvesting indicators, and existing security vendor detections. Defensive actions should include immediate blocking of the domain, monitoring for related infrastructure, reviewing authentication logs for potential exposure, and warning users against entering credentials on the site. Organizations should collect and preserve relevant indicators, update detection content, and continue monitoring for infrastructure changes or replacement domains. Although only 4 of 95 VirusTotal vendors currently flag the domain, the active status and confirmed blocklist presence indicate ongoing risk and justify preventive controls.