hub-koinbase-eng[.]pages[.]dev

The domain hub-koinbase-eng.pages.dev is a brand impersonation threat specifically targeting Base, a popular cryptocurrency platform. As of the latest check, the domain is offline and displays a Cloudflare phishing warning page, indicating it has been taken down by the hosting provider. This domain was created on October 30, 2025, and registered through Cloudflare, Inc., adding a layer of anonymity for the threat actors.

PhishDestroy's analysis reveals that hub-koinbase-eng.pages.dev has a risk level of elevated, supported by concrete data: it is flagged by 12 out of 95 VirusTotal security vendors, appears on 1 security blocklist, and resolves to IP address 172.66.47.99. The SSL certificate is issued by Google Trust Services (WE1), which is typical for legitimate sites but can be misused by phishers. Despite being offline now, the domain's registration and initial activity posed a significant risk to Base users who might have been tricked into entering credentials or private keys.

Given the domain's current offline status, immediate risk is mitigated, but PhishDestroy recommends that Base users remain vigilant against similar domains with slight variations in spelling (e.g., "koinbase" instead of "coinbase"). Always verify URLs before entering sensitive information, enable two-factor authentication on all accounts, and report any suspicious domains to the security team. Monitoring for re-registration or new phishing campaigns using similar patterns is advised to stay protected.