invesaassist[.]pages[.]dev

Analysis of the domain invesaassist.pages.dev indicates active brand impersonation targeting Coinbase users. The domain was registered on February 11, 2026, through Cloudflare, Inc., and resolves to the IP address 188.114.97.3. The page title explicitly advertises '24/7 Coinbase Customer Service,' a clear indicator of intent to deceive users seeking legitimate support. Infrastructure analysis reveals the use of Cloudflare hosting and security services, including HSTS, HTTP/3, and Google Trust Services SSL certification, which may lend a superficial appearance of legitimacy but are commonly exploited by threat actors to evade detection. Multiple security vendors have flagged this domain. Google Safe Browsing classifies it under 'SOCIAL_ENGINEERING,' and it appears on three security blocklists. Additionally, 12 of 95 security vendors on VirusTotal have detected malicious activity associated with this domain. Technologies such as Google Tag Manager and Google Analytics are present, which are often used to track victim interactions but do not inherently confirm malicious intent. The domain remains active as of July 12, 2026, and is blocked by several security tools, including SEAL, MetaMask, and PhishDestroy. Defenders should treat this domain as high-risk. The combination of brand impersonation, social engineering flags, and blocklist presence provides concrete evidence of malicious activity. Organizations and users are advised to block access to this domain and monitor for similar patterns, such as domains hosted on Cloudflare Pages with support-related page titles. Further investigation into the backend infrastructure and associated threat actors may be warranted, though no additional details about the phishing kit or specific attack vectors are currently available.