user-coinbsepro[.]pages[.]dev

This domain, user-coinbsepro.pages.dev, is flagged as a crypto-focused phishing site designed to impersonate legitimate cryptocurrency exchange platforms. Analysis indicates the infrastructure was likely established to deploy a wallet drainer kit, targeting users attempting to access trading or account management interfaces. The domain mimics branding elements associated with major exchanges, though no direct trademark infringement has been confirmed. The page title, 'Suspected phishing site | Cloudflare,' suggests automated detection by the hosting provider prior to takedown, though no specific phishing kit signature has been attributed at this time. Technical indicators reveal the domain was registered through Cloudflare, Inc. on October 17, 2025, and resolves to the IP address 172.66.44.99, geolocated to the United States under AS13335. The SSL certificate is issued by Google Trust Services (WE1), a common configuration for Cloudflare-hosted domains. Security telemetry shows the domain appears on one blocklist and is detected by 13 out of 95 security vendors on VirusTotal. No Google Safe Browsing (GSB) listing is recorded, though this may reflect latency in propagation rather than absence of detection. The domain's creation date and rapid inclusion in blocklists suggest a short-lived, high-velocity campaign typical of opportunistic phishing operations. As of the latest assessment, user-coinbsepro.pages.dev has been taken offline, likely following reports to the hosting provider or registrar. The domain is blocked by PhishDestroy and other security feeds, reducing immediate exposure risk. However, residual threats persist, including potential reuse of the underlying infrastructure or migration of the phishing kit to newly registered domains. Users who interacted with the site prior to takedown should assume credential or wallet compromise and conduct a full security review, including revocation of active sessions, password resets, and transaction history audits. Organizations should monitor for related domains leveraging similar naming conventions or hosting patterns, particularly those using Cloudflare Pages or subdomains under .pages.dev.