packnode-pnd41086[.]coinbasedevelopers-activity[.]workers[.]dev

The domain packnode-pnd41086.coinbasedevelopers-activity.workers.dev is actively engaged in brand impersonation targeting Coinbase, a major cryptocurrency exchange platform. This domain is currently operational and presents a high-risk threat due to its deceptive infrastructure and association with fraudulent activities. Analysis indicates the domain is designed to mimic legitimate Coinbase services, potentially to facilitate unauthorized access or credential harvesting. Infrastructure analysis reveals the domain is flagged by 4 of 95 security vendors on VirusTotal, indicating a moderate but concerning detection rate. It resolves to the IP address 23.12.147.135, located in the United States under AS20940 (Akamai International B.V.). The domain is registered through Cloudflare, Inc., and lacks an SSL certificate, a common red flag for malicious sites. It appears on one security blocklist and is blocked by at least one threat intelligence provider. The page title, 'Search - Microsoft Bing,' suggests an attempt to obfuscate its true purpose by mimicking a legitimate search engine interface. As of the latest assessment, the domain remains active and poses a continued risk to users. Organizations and individuals are advised to block the domain and its associated IP address (23.12.147.135) at the network level. Users should be educated to recognize brand impersonation tactics, particularly those targeting cryptocurrency platforms. Monitoring for similar domains registered through Cloudflare or resolving to Akamai-hosted IPs may help identify additional threats. Immediate reporting to relevant security teams and domain registrars is recommended to mitigate further exposure.