coinbase-pro-en-net[.]pages[.]dev

This domain, coinbase-pro-en-net.pages.dev, is flagged as a high-risk brand impersonation threat specifically targeting Coinbase, a cryptocurrency exchange platform. Analysis indicates the site was designed to deceive users into entering credentials or financial details under the false pretense of a legitimate Coinbase Pro interface. No explicit drainer kit signatures were identified in initial scans, though the domain structure and content closely mimic official Coinbase subdomains to maximize credibility with potential victims.

Infrastructure analysis reveals the domain was registered through Cloudflare, Inc. and resolves to the IPv6 address 2606:4700:310c::ac42:2f36, hosted on Cloudflare's network (AS13335). The domain was created on October 11, 2025, and is currently flagged by Google Safe Browsing as phishing. VirusTotal reports 15 out of 95 security vendors detecting malicious activity associated with this domain. Additionally, the domain appears on one security blocklist, specifically PhishDestroy, and uses an SSL certificate issued by Google Trust Services (WE1). The page title, "Suspected phishing site | Cloudflare," suggests Cloudflare's automated systems may have also identified the malicious nature of the domain.

As of the latest verification, the domain has been taken offline, likely due to enforcement actions by the hosting provider or domain registrar. However, residual risk remains due to the potential for the threat actor to re-establish the domain or migrate the phishing infrastructure to a new domain with similar characteristics. Users who may have interacted with this domain are advised to immediately revoke any active sessions, reset credentials, and monitor financial accounts for unauthorized transactions. Organizations should update blocklists to include this domain and its associated indicators of compromise (IOCs) to prevent future access attempts.