eng-coimbase--nav-c-auth[.]pages[.]dev

This domain, eng-coimbase--nav-c-auth.pages.dev, is identified as a high-risk brand impersonation threat targeting Base, a cryptocurrency platform. Analysis indicates the infrastructure was designed to mimic legitimate login portals, likely to harvest user credentials or facilitate unauthorized transactions. No specific drainer kit signatures have been confirmed, but the domain structure and naming convention suggest intent to deceive users into entering sensitive information. Infrastructure analysis reveals the following technical indicators: the domain was registered on November 01, 2025, through Cloudflare, Inc., and resolves to the IP address 188.114.96.3. Google Safe Browsing flags it as phishing, and VirusTotal reports 19 out of 95 security vendors detecting it as malicious. The SSL certificate is issued by Google Trust Services (WE1), and the domain appears on one security blocklist. The page title, 'Suspected phishing site | Cloudflare,' further corroborates its malicious classification. As of the latest assessment, eng-coimbase--nav-c-auth.pages.dev has been taken offline, likely due to enforcement actions by the hosting provider or domain registrar. However, residual risk remains for users who may have interacted with the site prior to its removal. Organizations are advised to monitor for credential reuse or unauthorized access attempts linked to this domain. Users should verify the authenticity of any communication or login portal claiming affiliation with Base, particularly those hosted on non-standard or newly registered domains.