sso-coinbascom-cdn[.]pages[.]dev

The domain sso-coinbascom-cdn.pages.dev is suspected of being a crypto drainer and is currently offline. This domain appears to impersonate the well-known cryptocurrency platform Coinbase, leveraging the similarity in its name to deceive users into providing sensitive information or executing malicious actions.

Analysis indicates that the domain sso-coinbascom-cdn.pages.dev was flagged by 10 of 95 VirusTotal vendors, suggesting a significant level of suspicion among security professionals. The domain is registered through Cloudflare, Inc., and resolves to the IPv6 address 2606:4700:310c::ac42:2d07, which is located in the United States and operated by AS13335 Cloudflare, Inc. The domain was created on October 28, 2025, and has appeared on one security blocklist. The SSL certificate is issued by Google Trust Services, indicating that the site may have been designed to appear more trustworthy to users. The page title, 'Suspected phishing site | Cloudflare,' further reinforces the domain's malicious intent.

Given the current status of the domain being taken offline, it is highly recommended that organizations and individuals exercise caution when encountering any similar or related domains. Security teams should monitor for any reactivation or related subdomains and consider implementing DNS filtering or web proxy solutions to block access to this site. Additionally, users should be educated on the importance of verifying the legitimacy of websites, especially those related to financial services, through official channels before providing any personal or financial information.