us-coenbase-en[.]pages[.]dev

This domain is flagged as a high-risk brand impersonation threat targeting Base, a cryptocurrency platform. The site operates as a fraudulent replica designed to deceive users into disclosing sensitive credentials or transferring digital assets under false pretenses. Analysis indicates the domain exhibits classic characteristics of a credential harvesting or crypto drainer operation, leveraging trusted branding to lower user defenses. Infrastructure analysis reveals the domain us-coenbase-en.pages.dev was registered on October 15, 2025, through Cloudflare, Inc., a registrar frequently exploited for rapid phishing deployment. The domain resolves to IP address 172.66.44.96, hosted on AS13335 (Cloudflare, Inc.) in the United States. At the time of assessment, 15 out of 95 security vendors on VirusTotal flagged the domain as malicious, while it appeared on one additional security blocklist. Google Safe Browsing has classified the site as phishing, and the SSL certificate is issued by Google Trust Services (WE1). The page title, 'Suspected phishing site | Cloudflare,' further corroborates its deceptive nature, though the domain has since been taken offline by the hosting provider or registrar. Mitigation against such brand impersonation threats requires multi-layered defenses. Users should verify domain authenticity by cross-referencing official communications and checking for subtle misspellings or unusual subdomains. Organizations are advised to implement domain monitoring tools to detect lookalike domains registered through high-risk registrars. Network-level protections, such as DNS filtering and real-time threat intelligence feeds, should be configured to block known malicious IPs and domains. Additionally, enabling multi-factor authentication on all cryptocurrency accounts can mitigate the impact of credential compromise. Security teams should prioritize user education on recognizing phishing indicators, particularly in the context of cryptocurrency transactions.