loggin-coin-base-eng[.]pages[.]dev

This domain, loggin-coin-base-eng.pages.dev, is identified as a high-risk phishing infrastructure impersonating Coinbase, a major cryptocurrency exchange platform. Analysis indicates the site was designed to deceive users into entering legitimate credentials or wallet recovery phrases, likely functioning as a credential harvester or crypto drainer. No explicit drainer kit signatures were observed in initial scans, but the domain structure and page content closely mimic Coinbase’s official login interface, including cloned branding elements and URL path obfuscation techniques. Infrastructure analysis reveals the domain was registered through Cloudflare Pages on November 01, 2025, and resolves to the IP address 172.66.44.230, hosted within Cloudflare’s network (AS13335). The domain is flagged by Google Safe Browsing as phishing and appears on at least one security blocklist. VirusTotal reports 14 out of 95 security vendors detecting the domain as malicious, with detections spanning phishing, brand impersonation, and credential theft categories. The SSL certificate is issued by Google Trust Services (WE1), a common characteristic of both legitimate and malicious Cloudflare-hosted domains. As of the latest verification, the domain has been taken offline, likely following automated or manual takedown procedures by the hosting provider or security teams. However, residual risk remains due to potential re-registration or migration of the phishing kit to alternative domains. Users who accessed the site prior to its deactivation may still be at risk of credential compromise or unauthorized wallet access. Organizations are advised to monitor for related indicators of compromise, including the IP address 172.66.44.230 and associated SSL certificate thumbprints, and to implement proactive blocking of newly observed domains matching the loggin-[brand]-eng.pages.dev pattern.