wcow[.]pages[.]dev

The domain wcow.pages.dev is actively impersonating Coinbase, a well-known cryptocurrency brand. The threat type is classified as brand impersonation, and the domain is currently active, posing a high risk to users who may be misled into believing it is the official Coinbase website.

Infrastructure analysis reveals that wcow.pages.dev has been flagged by 3 of 95 security vendors on VirusTotal, indicating a moderate level of suspicion among the security community. The domain was registered through Cloudflare, Inc. and was created on March 06, 2026. It resolves to the IP address 188.114.96.3, which is located in the United States under the Autonomous System (AS) number 13335, associated with Cloudflare, Inc. Notably, the domain lacks an SSL certificate, which is a red flag for security-conscious users. Additionally, the domain appears on 3 security blocklists, suggesting it has been identified as malicious by certain security organizations. The absence of an SSL certificate and the presence on blocklists are significant indicators of the domain's potential to be used for fraudulent activities.

Given the current status of the domain as active and the high risk level associated with brand impersonation, it is imperative that users exercise extreme caution when interacting with this domain. Organizations are advised to monitor traffic to this domain and consider blocking it at the network level to prevent potential phishing attacks. Furthermore, security teams should disseminate information about this domain to end-users and ensure that they are aware of the risks associated with visiting unsecured or suspicious websites. Immediate action should be taken to report this domain to relevant authorities and the brand being impersonated for further investigation and potential takedown.