coin-basepro-loggin[.]pages[.]dev

This domain, coin-basepro-loggin.pages.dev, is a confirmed phishing site impersonating Coinbase, as indicated by its page title 'CoinbasePro.com Sign In - Secure Cryptocurrency Access' and explicit classification as a crypto scam. Infrastructure analysis reveals it was registered on February 21, 2026, through Cloudflare, Inc., and is currently offline with an HTTP 403 status. The domain resolves to IP 188.114.96.3, hosted on Cloudflare's network (AS13335), with nameservers reza.ns.cloudflare.com and jose.ns.cloudflare.com. SSL certification is provided by Google Trust Services (WE1), a common setup for malicious domains leveraging Cloudflare's infrastructure to obscure origins.

Detection data shows the domain is flagged by Google Safe Browsing for social engineering and appears on one security blocklist, with PhishDestroy actively blocking it. VirusTotal reports 10 of 93 security vendors marking it as malicious, though the absence of additional context limits granular threat classification. Gridinsoft assigns a trust score of 0/100, reinforcing its high-risk status. The domain's registration details and hosting align with patterns observed in phishing campaigns targeting cryptocurrency users, though no specific phishing kit or payload has been confirmed in available intelligence.

Defenders should treat this domain as a confirmed threat to Coinbase users, particularly given its explicit branding and crypto-focused scam classification. While the site is currently offline, monitoring for reactivation or related domains using similar naming conventions (e.g., 'coinbasepro', 'loggin') is recommended. Blocking the domain, its resolved IP, and associated Cloudflare nameservers at perimeter security controls will mitigate residual risk. Further investigation into the registration email or payment details used during domain creation may uncover broader campaign linkages, though such data is not presently available in public records.