coinabse-logi[.]pages[.]dev

PhishDestroy has identified coinabse-logi.pages.dev as a sophisticated crypto drainer phishing domain, currently taken offline. This site was designed to impersonate the legitimate Coinbase brand, tricking users into connecting their cryptocurrency wallets and ultimately draining their funds. The domain is now inactive thanks to security interventions, but its infrastructure and tactics remain a concern for future threats.

The domain was created on October 24, 2025, and registered through Cloudflare, Inc., with an SSL certificate issued by Google Trust Services (WE1). It resolved to IPv6 address 2606:4700:310c::ac42:2fa9. VirusTotal analysis shows that 12 out of 95 security vendors flagged this domain as malicious, and it appears on 1 security blocklist. Despite the low blocklist count, the high vendor detection rate and brand impersonation indicate a targeted and dangerous phishing operation.

As the site is already offline, users who may have visited it should take immediate precautions. If any credentials or wallet connections were entered, change passwords, revoke wallet permissions, and monitor accounts for unauthorized activity. PhishDestroy recommends using a hardware wallet and enabling two-factor authentication to protect against future crypto drainer attacks. Stay vigilant against similar domains that mimic trusted cryptocurrency platforms.