kraken-vs-coinbase-fees[.]pages[.]dev

The domain kraken-vs-coinbase-fees.pages.dev is a confirmed phishing site engaged in brand impersonation targeting Coinbase users. It posed as a cryptocurrency fee comparison page to harvest login credentials or sensitive account details, a tactic classified as elevated risk due to its direct targeting of financial services. No drainer kit was identified, and the site is currently taken offline.

Technical indicators confirm the domain's malicious nature: 2 of 95 VirusTotal security vendors flagged kraken-vs-coinbase-fees.pages.dev, including alphaMountain.ai and Fortinet. The domain was registered through Cloudflare, Inc. on February 11, 2025, and resolved to IP address 172.66.46.249, hosted on Cloudflare's US infrastructure (AS13335). It appeared on 3 security blocklists—PhishDestroy, MetaMask, and SEAL—while its SSL certificate was issued by Google Trust Services (WE1). The observed page title was 'Suspected phishing site | Cloudflare', and the site returned an HTTP 403 status. Technologies detected included HSTS, Cloudflare, and HTTP/3, with a Gridinsoft trust score of 0/100.

Users who interacted with kraken-vs-coinbase-fees.pages.dev should immediately change their Coinbase passwords, enable two-factor authentication, and monitor accounts for unauthorized transactions. Revoking active token approvals on blockchain explorers is advised if wallet connections were made. Report the domain to Coinbase's security team via their official abuse channels and submit it to Google Safe Browsing, PhishTank, or local cybersecurity authorities for further action.