laern-coinbase-sin[.]pages[.]dev

The domain laern-coinbase-sin.pages.dev poses a high risk of brand impersonation, specifically targeting the cryptocurrency exchange platform Coinbase. Analysis indicates that this domain was likely created to deceive users into believing it is an official Coinbase page, potentially leading to the theft of personal information, such as login credentials and financial data.

Evidence supporting the threat includes the domain being flagged as phishing by Google Safe Browsing and 14 out of 95 security vendors on VirusTotal. The domain was registered through Cloudflare, Inc. on October 29, 2025, and resolves to the IP address 172.66.47.79, located in the United States and operated by AS13335 Cloudflare, Inc. The page title 'Suspected phishing site | Cloudflare' further corroborates the suspicion of malicious intent. Additionally, the domain appears on one security blocklist, and it has been taken offline, indicating that it was likely in the process of being used for fraudulent activities.

Users who have visited this domain are advised to immediately change their Coinbase account passwords and enable multi-factor authentication (MFA) if not already enabled. They should also monitor their financial accounts for any unauthorized transactions and report any suspicious activity to Coinbase support. It is recommended to avoid clicking on links from unknown sources and to verify the URL of any Coinbase-related pages by manually typing the official domain into the browser.