en-portal-coinbse-logiin[.]pages[.]dev

This domain, en-portal-coinbse-logiin.pages.dev, was configured as a credential phishing site impersonating the Coinbase cryptocurrency platform. The site’s page title displayed a Cloudflare security warning ("Suspected phishing site | Cloudflare"), indicating the hosting provider had already intervened. The threat posed was the theft of user login credentials and potentially financial account access through a fraudulent login page designed to mimic Coinbase.

Technical analysis confirms malicious intent. VirusTotal detection shows 12 out of 95 security vendors flagged the domain as malicious, including BitDefender, ESET, Emsisoft, Fortinet, and G-Data. Google Safe Browsing flagged it for "SOCIAL_ENGINEERING." The domain was registered on 2025-10-24 via Cloudflare, Inc. (registrar) and hosted on IP address 172.66.47.18 (United States), assigned to AS13335 Cloudflare, Inc. SSL certificate was issued by Google Trust Services (WE1). Nameservers were earl.ns.cloudflare.com and priscilla.ns.cloudflare.com.

The domain is currently offline and unreachable. GridinSoft trust rating is 0 out of 100, and the DOM risk score is 100 out of 100, indicating a critical threat level. The domain is listed on 1 blocklist. Given its high detection rate, active flagging by Google Safe Browsing, and complete lack of trust, this site posed a severe credential phishing risk and should be permanently blocked.