mozilla-coinbase[.]pages[.]dev

This domain, mozilla-coinbase.pages.dev, is a confirmed credential harvesting site designed to impersonate Coinbase, a major cryptocurrency exchange platform. The site targets users by mimicking legitimate Coinbase login interfaces, tricking victims into entering sensitive account credentials, including usernames, passwords, and two-factor authentication codes. Such attacks are commonly used to gain unauthorized access to cryptocurrency wallets, enabling threat actors to initiate fraudulent transactions or steal digital assets. The domain’s infrastructure and content were specifically engineered to deceive users into believing they are interacting with an official Coinbase service, increasing the likelihood of successful credential compromise.

Infrastructure analysis reveals multiple high-confidence indicators of malicious activity. The domain was registered on October 17, 2025, through Cloudflare, Inc., and resolves to the IP address 188.114.96.3, associated with Cloudflare’s network (AS13335). Security vendors flagged the domain in 11 out of 95 VirusTotal engines, and it appears on at least one security blocklist. Google Safe Browsing has classified the site as phishing, and the SSL certificate, issued by Google Trust Services (WE1), aligns with patterns observed in other impersonation campaigns. The page title, "Suspected phishing site | Cloudflare," further corroborates its malicious intent, as legitimate services do not self-identify as suspicious.

Users who visited mozilla-coinbase.pages.dev or entered credentials on the site should immediately take corrective action. First, reset passwords for Coinbase and any other accounts where the same credentials may have been reused. Enable multi-factor authentication (MFA) if not already active, using an authenticator app or hardware token rather than SMS-based verification. Monitor Coinbase accounts for unauthorized transactions and report any suspicious activity to the platform’s support team. Additionally, scan local devices for malware, as credential harvesting sites may deploy secondary payloads. If financial loss is suspected, contact relevant financial institutions and law enforcement to initiate fraud investigations.