help-coinbase-pro[.]pages[.]dev

This domain, help-coinbase-pro.pages.dev, is identified as a brand impersonation threat specifically targeting Coinbase, a cryptocurrency exchange platform. The site mimics legitimate Coinbase Pro interfaces to deceive users into submitting sensitive credentials, including login details, two-factor authentication codes, or wallet recovery phrases. Such attacks typically aim to gain unauthorized access to cryptocurrency accounts, enabling threat actors to initiate fraudulent transactions or steal digital assets. The domain’s infrastructure and content were designed to exploit trust in the Coinbase brand, increasing the likelihood of successful social engineering attacks against unsuspecting users. Analysis indicates multiple technical indicators supporting the malicious classification of this domain. The domain was registered on October 8, 2025, through Cloudflare, Inc., and resolves to the IP address 172.66.47.142, associated with AS13335 (Cloudflare, Inc.). It appears on one security blocklist and is flagged by 17 out of 95 security vendors on VirusTotal, including detections for phishing and brand impersonation. The SSL certificate is issued by Google Trust Services (WE1), a common practice among both legitimate and malicious sites leveraging Cloudflare’s infrastructure. The page title, 'Suspected phishing site | Cloudflare,' further confirms its detection and subsequent takedown by security mechanisms. Users who visited help-coinbase-pro.pages.dev or entered credentials on the site should take immediate action to mitigate potential risks. First, revoke access to any sessions or devices linked to the compromised account and enable multi-factor authentication if not already active. Monitor the account for unauthorized transactions or changes, such as altered email addresses, phone numbers, or withdrawal addresses. If credentials were submitted, assume they are compromised and update passwords for all associated accounts, particularly those sharing the same or similar login details. Additionally, report the incident to the targeted platform’s security team for further investigation and potential account recovery assistance. Users should also scan their devices for malware, as phishing sites may distribute additional payloads or redirect to exploit kits.