coinbase-pro-logi[.]pages[.]dev

This domain, coinbase-pro-logi.pages.dev, is flagged as a credential harvesting infrastructure targeting Coinbase users. Analysis indicates the site operates under the guise of a legitimate cryptocurrency exchange platform, likely designed to capture login credentials, two-factor authentication codes, or other sensitive account details. No specific drainer kit signatures have been confirmed at this stage, but the domain’s structure and naming convention align with known impersonation tactics used in financial phishing campaigns. Infrastructure analysis reveals the domain was registered on October 8, 2025, through Cloudflare, Inc. and resolves to the IPv6 address 2606:4700:310c::ac42:2c6f, hosted on AS13335. The SSL certificate is issued by Google Trust Services (WE1), a common characteristic of phishing sites leveraging free certificates to appear legitimate. Detection metrics show 18 out of 95 security vendors on VirusTotal flagged the domain as malicious, while it appears on one additional security blocklist. Google Safe Browsing does not currently list the domain, though this may reflect a lag in propagation rather than a clean status. The domain is currently offline, with its page title displaying 'Suspected phishing site | Cloudflare,' suggesting takedown or suspension by the hosting provider. Despite its inactive status, residual risk remains due to potential reuse of the infrastructure or re-registration under a similar naming scheme. Organizations are advised to monitor for related domains, particularly those using 'coinbase-pro' or 'logi' variations, and to implement proactive blocking of the resolved IP address and associated certificate thumbprints. End users should verify domain authenticity before entering credentials, even on seemingly legitimate pages.