coibase-un-logn[.]pages[.]dev

The domain coibase-un-logn.pages.dev is a confirmed phishing site engaged in brand impersonation targeting Coinbase users. It presents itself as a legitimate Coinbase login portal to harvest cryptocurrency credentials, though no active drainer kit was detected. As of the latest verification, coibase-un-logn.pages.dev has been taken offline, but it previously posed an elevated risk of credential theft and financial fraud.

Technical indicators confirm the malicious nature of coibase-un-logn.pages.dev. The domain was flagged by 11 of 95 security vendors on VirusTotal, including ChainPatrol, alphaMountain.ai, and BitDefender. It appeared on one security blocklist (PhishDestroy) and was registered through Cloudflare, Inc. on February 21, 2026. The site resolved to the IPv6 address 2606:4700:310c::ac42:2c3c, hosted by Cloudflare in the US (AS13335). The SSL certificate was issued by Google Trust Services / WE1, and the observed page title was 'Suspected phishing site | Cloudflare'. Technologies detected included HSTS, Cloudflare, and HTTP/3, with an HTTP status of 403 at the time of assessment.

Users who interacted with coibase-un-logn.pages.dev should immediately change their Coinbase passwords and enable two-factor authentication (2FA) if not already active. Monitor accounts for unauthorized transactions and report any suspicious activity to Coinbase support. Victims should also report the phishing domain to their local cybercrime unit, the FBI’s Internet Crime Complaint Center (IC3), and platforms like Google Safe Browsing or PhishTank to prevent further abuse.