coinbase-cdn-loggin--en[.]pages[.]dev

PhishDestroy has analyzed the domain coinbase-cdn-loggin--en.pages.dev, which is a brand impersonation threat targeting Coinbase. Currently, the domain is offline, having been taken down after being reported for malicious activity. The page title displayed by Cloudflare, "Suspected phishing site | Cloudflare," confirms its harmful intent.

This domain was flagged by 18 out of 95 VirusTotal vendors, indicating a moderate detection rate. It was registered through Cloudflare, Inc. and resolves to IP address 188.114.96.3. The domain was created on October 31, 2025, and its SSL certificate was issued by Google Trust Services / WE1. It appears on 2 security blocklists, further corroborating its malicious nature. The trust scores from various security vendors suggest a elevated risk level, consistent with its classification as a brand impersonation threat.

Given the domain is already offline, users should remain vigilant against similar impersonation attempts. PhishDestroy recommends avoiding any unsolicited login pages or links claiming to be from Coinbase, especially those with suspicious domain names. Always verify the legitimacy of websites by checking the URL carefully and enabling multi-factor authentication on your accounts. If you suspect you have interacted with a phishing site, change your passwords immediately and report the incident to the appropriate authorities.