nesa-verify[.]pages[.]dev

The domain nesa-verify.pages.dev is currently active and is a high-risk brand impersonation threat targeting Coinbase. The domain impersonates Coinbase to deceive users, potentially leading to financial loss or data theft.

Infrastructure analysis reveals that the domain is registered through Cloudflare, Inc. and was created on March 02, 2024. It resolves to the IP address 188.114.96.3, which is located in the United States and is part of the AS13335 Cloudflare, Inc. network. The domain is flagged by 12 of 95 security vendors on VirusTotal, indicating a moderate level of detection. Additionally, the domain appears on three security blocklists and is blocked by PhishDestroy, ScamSniffer, and Enkrypt. The SSL certificate is issued by Google Trust Services / WE1, which may lend a false sense of security to unsuspecting users. The page title, "$NES token airdrop is now live!", suggests a cryptocurrency-related scam.

Given the current active status of the domain and the high-risk nature of the threat, it is recommended that users avoid interacting with nesa-verify.pages.dev. Security teams should monitor the domain and consider adding it to their blocklists to prevent potential exposure. Additionally, users should be educated on the signs of brand impersonation and encouraged to verify the authenticity of any communication or website claiming to be associated with Coinbase.