learn--app-coinbase[.]pages[.]dev

PhishDestroy has identified the domain learn--app-coinbase.pages.dev as a high-risk brand impersonation threat specifically targeting Coinbase users. This domain was designed to mimic legitimate Coinbase services in order to deceive visitors into revealing sensitive information or installing malicious software. The risk level is high due to its sophisticated impersonation and active flagging by multiple security sources.

Technical indicators reveal that the domain was registered on October 14, 2025 through Cloudflare, Inc., and resolves to IP address 172.66.44.130. VirusTotal analysis shows 12 out of 95 security vendors flagging this domain as malicious. The SSL certificate was issued by Google Trust Services (WE1). The page title displayed was "Suspected phishing site | Cloudflare," indicating that Cloudflare itself detected the threat. Additionally, Google Safe Browsing flags the domain for phishing, and it appears on one security blocklist. The current status is offline, meaning the site has been taken down following detection.

To protect against such brand impersonation attacks, users should always verify the URL carefully before entering any credentials or personal information. Enable two-factor authentication on all financial accounts, and avoid clicking links in unsolicited messages. Use a reputable password manager to auto-fill credentials only on known legitimate sites. If you suspect you have visited a phishing site, change your passwords immediately and monitor your accounts for unauthorized activity. Report any suspicious domains to the impersonated brand and to security organizations like PhishDestroy.