collab-gatepass-user[.]pages[.]dev

This domain, collab-gatepass-user.pages.dev, is flagged as a brand impersonation threat targeting Coinbase users through a fraudulent wallet connection interface. Analysis indicates the site operates as a wallet drainer phishing page, presenting a fake Collab.Land Connect login portal to harvest cryptocurrency wallet credentials and execute unauthorized asset transfers. The infrastructure mimics legitimate authentication flows, increasing the likelihood of successful social engineering attacks against users expecting to interact with decentralized applications or token-gated communities. Infrastructure analysis reveals multiple high-confidence technical indicators. The domain was registered on October 10, 2025, through Cloudflare, Inc., and resolves to IP address 172.66.46.217, hosted on Cloudflare's network (AS13335). VirusTotal detection shows 8 out of 95 security vendors flagging the domain as malicious. The domain appears on five distinct security blocklists, including PhishDestroy, ScamSniffer, Polkadot, Enkrypt, and Codeesura. The SSL certificate is issued by Google Trust Services (WE1), providing a false sense of legitimacy while the page title, Collab.Land Connect, reinforces the deception by impersonating a known token-gating service. The domain has been taken offline, reducing immediate exposure to users. However, residual risk remains due to potential re-deployment under new subdomains or alternative hosting providers. Users who interacted with the site should immediately revoke any connected wallet permissions, transfer assets to new wallets, and monitor transaction histories for unauthorized activity. Organizations should update blocklists to include this domain and its associated IP, while security teams should investigate related infrastructure for signs of persistent threat actor activity. Continuous monitoring of newly registered Cloudflare Pages subdomains with similar naming patterns is recommended to detect potential follow-up campaigns.