coin-base-w-ex[.]pages[.]dev

The domain coin-base-w-ex.pages.dev is a high-risk brand impersonation site targeting the cryptocurrency exchange Coinbase. This domain was used to deceive users into providing sensitive information, potentially leading to credential theft and financial loss.

Infrastructure analysis reveals that the domain is registered through Cloudflare, Inc. and resolves to the IP address 172.66.47.200, located in the United States and operated by Cloudflare, Inc. (AS13335). The domain was created on November 05, 2025. Analysis on VirusTotal indicates that 10 out of 95 security vendors flag this domain as malicious. Google Safe Browsing has also flagged the domain for phishing activities, and it appears on one known security blocklist. The site's SSL certificate is issued by Google Trust Services / WE1, which may have been used to lend a false sense of security to potential victims.

The domain is currently offline, likely due to takedown efforts by security teams or the registrar. Despite this, the risk remains for users who may have already been compromised. Security researchers recommend that affected users change their Coinbase passwords and enable two-factor authentication. Additionally, users should be cautious of unsolicited communications and verify the authenticity of any links or login pages by directly accessing the official Coinbase website.