homepage-coinbase-com[.]pages[.]dev

This domain, homepage-coinbase-com.pages.dev, is identified as a high-risk brand impersonation threat designed to deceive users of the Coinbase cryptocurrency platform. The site mimics legitimate Coinbase branding, interfaces, or communications to trick visitors into divulging sensitive credentials, such as login details, two-factor authentication codes, or private wallet keys. Once obtained, these credentials can be exploited to gain unauthorized access to user accounts, enabling attackers to initiate fraudulent transactions, drain cryptocurrency holdings, or conduct further social engineering attacks. The primary objective of this infrastructure is to facilitate credential theft and financial fraud under the guise of a trusted service provider. Analysis indicates this domain exhibits multiple technical indicators of malicious activity. The domain was registered on October 27, 2025, through Cloudflare, Inc., a registrar frequently leveraged by threat actors to obscure ownership and evade detection. VirusTotal analysis reveals that 11 out of 95 security vendors have flagged this domain as malicious, with detections spanning phishing, brand impersonation, and cryptocurrency-related fraud. The site resolves to the IP address 172.66.44.54, which is hosted on Cloudflare's infrastructure (AS13335) in the United States. Additionally, the domain appears on one security blocklist, and Google Safe Browsing has explicitly classified it as a phishing threat. The SSL certificate, issued by Google Trust Services (WE1), does not mitigate the risk, as attackers commonly use valid certificates to lend false legitimacy to malicious sites. If you or someone in your network visited homepage-coinbase-com.pages.dev, immediate action is required to mitigate potential damage. First, disconnect the affected device from the internet to prevent further data exfiltration or remote access. Next, revoke any active sessions on the legitimate Coinbase platform and change all associated passwords, ensuring the use of strong, unique credentials. Enable multi-factor authentication (MFA) if not already active, and monitor the account for unauthorized transactions or configuration changes. Scan the device for malware using updated security tools, as phishing sites may deploy additional payloads. Report the incident to Coinbase's official security team and consider filing a report with relevant cybersecurity authorities or consumer protection agencies. Users should also verify their cryptocurrency wallet addresses and transaction histories for any signs of tampering or unauthorized transfers.