coinbase-verify-5lj[.]pages[.]dev

coinbase-verify-5lj.pages.dev has been confirmed as a live phishing domain impersonating Coinbase to harvest user credentials and deploy crypto drainers. The page leverages Cloudflare Pages, a legitimate hosting service, to deliver a convincing replica of Coinbase’s login interface. The domain is actively resolving to a malicious server and has been observed in the wild attempting to trick users into connecting their cryptocurrency wallets via a fake “verification” flow. This is consistent with recent trends in crypto drainer phishing campaigns targeting major exchanges.

PhishDestroy’s analysis reveals this domain was registered through Cloudflare, Inc., with a Let’s Encrypt SSL certificate issued to support HTTPS lures. The domain resolves to IP 188.114.97.3 and was first observed on security blocklists on an unknown date. VirusTotal detection stands at 2/95 security vendors as of the latest scan. It has been flagged by MetaMask and appears on at least one public blocklist. The domain follows a predictable pattern using a Pages.dev subdomain and the prefix “coinbase-verify-” to mimic legitimate Coinbase verification flows.

This domain remains active and poses an elevated risk to users who may encounter it via phishing emails, social media, or malicious ads. PhishDestroy has blocked access to this domain and continues to monitor for related infrastructure. Remaining risk is elevated due to its recent deployment, low initial detection rate, and use of trusted platforms. Users are strongly advised to verify any unexpected “Coinbase” link using PhishDestroy before entering credentials or connecting wallets. The presence of a crypto drainer payload cannot be ruled out given the domain’s behavior and targeting.