coiin-based-login[.]pages[.]dev

The domain coiin-based-login.pages.dev is identified as a threat due to brand impersonation, specifically targeting Coinbase. The domain was designed to deceive users by mimicking legitimate login interfaces associated with the targeted brand, thereby posing a significant risk of unauthorized access and data theft. The domain does not appear to be associated with any known drainer kits, but its impersonation aims to exploit user trust in the brand.

Technical indicators of the threat include a VirusTotal detection score of 12 out of 95 vendors, signaling a notable recognition of its malicious nature. Registered through Cloudflare, Inc., the domain resolves to IP address 172.66.47.2, located in the United States under AS13335 Cloudflare, Inc. infrastructure. The domain was created on October 29, 2025, and has been flagged by Google Safe Browsing (GSB) as well as appearing on one security blocklist, specifically blocked by PhishDestroy.

Currently, the domain is offline, which mitigates immediate risk. However, the existence of this domain and its detection history suggest that proactive monitoring and ongoing vigilance are necessary to prevent similar threats. Organizations and users are advised to remain cautious of domains mimicking known brands and to employ robust security measures, such as multi-factor authentication and regular security awareness training, to safeguard against potential phishing attacks.