coin--based--loggin[.]pages[.]dev

This domain presents a direct threat to users by mimicking the official Coinbase login interface to steal account credentials. Visitors entering their username and password risk immediate account compromise, unauthorized transactions, and potential financial loss. The site may also attempt to harvest two-factor authentication codes or recovery phrases, further escalating the risk of full account takeover. Analysis indicates the domain was registered on October 29, 2025, through Cloudflare, Inc. and is hosted on infrastructure belonging to the same provider. Security vendors on VirusTotal flagged the domain as malicious, with 15 out of 95 engines detecting it as part of a phishing operation. The SSL certificate, issued by Google Trust Services, does not mitigate the threat, as phishing sites commonly use valid certificates to appear legitimate. If you visited coin--based--loggin.pages.dev and entered any login details, immediately change your Coinbase password and revoke any active sessions. Enable two-factor authentication if not already active, and monitor your account for unauthorized transactions. Report the incident to your financial institution if funds were transferred without authorization. Avoid clicking on links in unexpected emails or messages, and always verify the domain in your browser’s address bar before entering sensitive information.