5thscape-live[.]pages[.]dev

This domain, 5thscape-live.pages.dev, is currently active and engaged in brand impersonation targeting Coinbase, a major cryptocurrency exchange platform. Analysis confirms the domain is designed to deceive users by mimicking Coinbase’s branding, potentially facilitating unauthorized access to sensitive account information or cryptocurrency assets. The page title, '5th Scape - Beyond Boundaries, Virtually Infinite,' does not align with Coinbase’s official branding, further indicating malicious intent. Infrastructure analysis reveals the domain was registered on August 11, 2024, through Cloudflare, Inc., and resolves to the IP address 172.66.44.147, located within the United States under AS13335 (Cloudflare, Inc.). The SSL certificate is issued by Google Trust Services (WE1), a common practice among malicious actors to lend an appearance of legitimacy. The domain appears on three security blocklists and is flagged by 7 of 95 VirusTotal vendors, including PhishDestroy, ScamSniffer, and Enkrypt. These indicators collectively suggest a high-risk threat profile, particularly for users of cryptocurrency platforms. The domain remains active as of the latest verification, posing an ongoing risk to individuals who may interact with it. Users are strongly advised to avoid accessing this domain and to verify the authenticity of any communication or website claiming affiliation with Coinbase. Organizations should update their security controls to block this domain at the network level, and individuals should report any suspicious activity to their security teams or relevant authorities. Enhanced monitoring of related infrastructure, such as domains registered through Cloudflare with similar naming patterns, is recommended to identify and mitigate potential follow-on threats.