co-in-base-en-cdn[.]pages[.]dev

This domain, co-in-base-en-cdn.pages.dev, operates as a high-risk credential harvesting platform specifically targeting Coinbase users. Analysis indicates the site employs brand impersonation techniques to deceive visitors into submitting login credentials, two-factor authentication codes, and other sensitive account details under the pretense of account verification or security updates. The infrastructure mimics legitimate Coinbase CDN patterns, increasing the likelihood of successful social engineering attacks against both desktop and mobile users. Infrastructure analysis reveals multiple technical indicators confirming malicious intent. The domain was registered on October 03, 2025, through Cloudflare, Inc. and currently appears on one security blocklist. VirusTotal detection shows 13 out of 95 security vendors flagging the domain as malicious, with Google Safe Browsing specifically categorizing it as phishing. The domain resolves to IP address 172.66.47.103 (AS13335 Cloudflare, Inc., US) and uses an SSL certificate issued by Google Trust Services (WE1), which may lend false legitimacy to the fraudulent site. Users who visited co-in-base-en-cdn.pages.dev should immediately revoke any active sessions on their Coinbase accounts and enable multi-factor authentication if not already active. All credentials entered on the site must be considered compromised and changed across any platforms where identical or similar passwords were used. Monitor financial transactions for unauthorized activity and report any suspicious behavior to the targeted brand's official security team. Security teams should update blocklists to include this domain and its associated IP address, while also analyzing network logs for connections to 172.66.47.103 during the period of activity.