coinbase-account-login[.]pages[.]dev

This domain, coinbase-account-login.pages.dev, operates as a credential harvesting site targeting users of the cryptocurrency exchange Coinbase. Analysis indicates the site was designed to mimic the legitimate Coinbase login interface, tricking victims into entering their account credentials, which are then captured by threat actors. The domain specifically impersonates the Coinbase brand to exploit user trust in the platform, likely for financial theft or unauthorized account access. Infrastructure analysis reveals the domain was registered on October 8, 2025, through Cloudflare, Inc., and resolves to the IP address 188.114.97.3, hosted on Cloudflare's network (AS13335). The site is flagged by 14 out of 95 security vendors on VirusTotal, with Google Safe Browsing explicitly classifying it as phishing. Additionally, the domain appears on one security blocklist and was proactively blocked by at least one threat intelligence feed. The SSL certificate, issued by Google Trust Services (WE1), does not mitigate the malicious intent of the site. Users who visited coinbase-account-login.pages.dev or entered credentials on the site should immediately take corrective action. Reset passwords for Coinbase and any other accounts where the same credentials were reused. Enable multi-factor authentication (MFA) on all financial and cryptocurrency-related accounts to prevent unauthorized access. Monitor Coinbase account activity for suspicious transactions and report any unauthorized access to the platform's support team. If personal or financial data was entered, consider placing a fraud alert on credit reports and reviewing bank statements for irregularities.