coinbase-start-en[.]pages[.]dev

This domain is flagged as a high-risk brand impersonation threat targeting Coinbase users. Analysis indicates the infrastructure was specifically designed to mimic legitimate Coinbase login portals, likely to harvest user credentials, payment details, or enable unauthorized account access. The threat type aligns with credential theft and financial fraud, common objectives in cryptocurrency-related phishing campaigns. Infrastructure analysis reveals the following technical indicators: The domain coinbase-start-en.pages.dev resolves to IP address 172.66.44.101, hosted on Cloudflare's network (AS13335) in the United States. It was registered through Cloudflare, Inc. on September 08, 2025, with an SSL certificate issued by Google Trust Services (WE1). Security vendors on VirusTotal flagged the domain as malicious, with 13 out of 95 engines detecting it. Google Safe Browsing classifies it as a phishing site, and it appears on at least one security blocklist. The page title, 'Suspected phishing site | Cloudflare,' further corroborates its malicious intent, though this may reflect post-compromise detection rather than an attacker's original design. To mitigate risks associated with this threat, affected organizations and users should immediately invalidate any credentials entered on this domain. Coinbase account holders should enable multi-factor authentication (MFA) using app-based or hardware tokens, avoiding SMS-based methods where possible. Network administrators are advised to block the domain and its resolving IP (172.66.44.101) at the perimeter, and monitor for indicators of compromise (IOCs) such as unusual login attempts or unauthorized transactions. Security teams should review logs for connections to the domain or IP, particularly from endpoints with access to cryptocurrency wallets or financial systems. Given the domain's registration date and rapid detection, this campaign may have been short-lived, but similar infrastructure could re-emerge under different subdomains or TLDs.