coinbas-pro-logon[.]pages[.]dev

This report analyzes the domain coinbas-pro-logon.pages.dev, which was flagged as a credential phishing site. The page title displayed "Suspected phishing site | Cloudflare," indicating the site was blocked or flagged by a security service. The domain impersonates the legitimate cryptocurrency platform Coinbase, specifically targeting user login credentials through a fraudulent logon page. The threat posed is credential theft, where victims may unknowingly submit sensitive account information to attackers.

Technical evidence confirms the malicious nature of the site. VirusTotal detected 13 out of 95 vendors flagging the domain as malicious, with specific detections from ADMINUSLabs, ChainPatrol, alphaMountain.ai, BitDefender, and CyRadar. The domain was registered on 2025-11-04 through Cloudflare, Inc., using nameservers simon.ns.cloudflare.com and mallory.ns.cloudflare.com. The IP address 172.66.46.227 is hosted in the United States by AS13335 Cloudflare, Inc. The SSL certificate was issued by Google Trust Services / WE1. The domain is listed on 1 blocklist.

The current status of coinbas-pro-logon.pages.dev is DOWN or OFFLINE, indicating it is no longer accessible. GridinSoft trust rating is 0 out of 100, and the DOM risk score is 100, representing the highest risk level. This domain poses a critical threat to users seeking to access legitimate Coinbase services, and all associated activity should be blocked.