portal-coinbase-auth-cdn[.]pages[.]dev

This domain, portal-coinbase-auth-cdn.pages.dev, operates as a high-risk brand impersonation site designed to deceive users into believing they are accessing a legitimate Coinbase authentication portal. The infrastructure mimics Coinbase’s official login flow, likely to harvest credentials or distribute malicious payloads under the guise of a trusted cryptocurrency exchange. Analysis indicates the site employs visual and structural elements identical to Coinbase’s legitimate interface, including logos, color schemes, and form fields, increasing the likelihood of successful social engineering attacks against unsuspecting users. Infrastructure analysis reveals multiple concrete indicators of malicious activity. The domain was registered on October 8, 2025, through Cloudflare, Inc., and resolves to the IP address 172.66.45.32, hosted on Cloudflare’s network (AS13335). VirusTotal detection rates confirm the domain is flagged by 18 out of 95 security vendors, while Google Safe Browsing and PhishDestroy have both classified it as phishing. Additionally, the domain appears on one security blocklist, and its SSL certificate is issued by Google Trust Services (WE1), a common tactic to lend false legitimacy. The page title, 'Suspected phishing site | Cloudflare,' further corroborates its malicious classification. Users who visited portal-coinbase-auth-cdn.pages.dev should take immediate action to mitigate potential risks. If credentials were entered, assume they have been compromised and initiate a password reset on the legitimate Coinbase platform using multi-factor authentication. Monitor financial accounts and cryptocurrency wallets for unauthorized transactions, and consider revoking access to any connected third-party applications. Run a full system scan using updated security software to detect potential malware or backdoors. Report the domain to relevant authorities or security teams to aid in broader threat mitigation efforts. Exercise heightened caution with future communications or login prompts purporting to be from Coinbase or other financial services.