coinbase-trading[.]gsgsgsgsg[.]workers[.]dev

This domain is flagged as a high-risk brand impersonation threat designed to deceive users into believing they are accessing legitimate Coinbase trading services. The site mimics the appearance and functionality of the official Coinbase platform, likely harvesting login credentials, personal information, or cryptocurrency wallet details from unsuspecting visitors. Such impersonation attacks are commonly used to facilitate unauthorized account access, financial theft, or identity fraud, posing significant risks to both individual users and institutional stakeholders. Analysis indicates this domain was registered on February 21, 2026, through Cloudflare, Inc., a registrar frequently exploited for rapid domain deployment in phishing campaigns. The domain is currently offline but was previously detected by 12 out of 95 security vendors on VirusTotal, including multiple reputable threat intelligence sources. Infrastructure analysis reveals the domain resolved to the IP address 188.114.97.3, utilized Cloudflare’s hosting services, and employed an SSL certificate issued by Google Trust Services to lend an appearance of legitimacy. Additional technical indicators include the use of HTTP/3 and HSTS, which are often leveraged to evade detection and enhance perceived authenticity. If you visited coinbase-trading.gsgsgsg.workers.dev or entered any credentials, immediate action is required to mitigate potential compromise. First, revoke any active sessions on the legitimate Coinbase platform and enable multi-factor authentication if not already active. Monitor all linked financial accounts, cryptocurrency wallets, and email addresses for unauthorized activity, and report any suspicious transactions to the appropriate financial institutions. Consider resetting passwords for all accounts where similar credentials may have been reused, and scan local devices for malware using updated security tools. Users should also report the domain to their organization’s security team or relevant cybersecurity authorities to aid in broader threat mitigation efforts.