coinnbess-cdn-web[.]pages[.]dev

This domain, coinnbess-cdn-web.pages.dev, is identified as a crypto wallet drainer phishing site designed to impersonate Coinbase, a major cryptocurrency exchange platform. Analysis indicates the site employs social engineering tactics to trick users into connecting their digital wallets, enabling unauthorized fund transfers through malicious smart contracts. The domain exhibits characteristics typical of modern drainer kits, including obfuscated JavaScript payloads and wallet interaction prompts, though no specific kit family has been conclusively attributed at this time. Infrastructure analysis reveals the domain was registered through Cloudflare, Inc. on February 21, 2026, and resolves to the IP address 188.114.97.3, associated with Cloudflare’s autonomous system (AS13335). Detection metrics show 13 out of 95 security vendors on VirusTotal flagged the domain as malicious, while it appears on a single security blocklist. The SSL certificate is issued by Google Trust Services (WE1), a common certificate authority for phishing domains leveraging free hosting services. Google Safe Browsing currently does not list the domain, though this may reflect a lag in detection rather than benign status. As of the latest assessment, the domain has been taken offline, likely due to enforcement actions by the hosting provider following abuse reports. The page title, 'Suspected phishing site | Cloudflare,' suggests Cloudflare’s automated systems or manual review identified and mitigated the threat. Despite its offline status, residual risk persists due to the potential for rapid redeployment under new domains or subdomains. Users are advised to verify wallet connection prompts, scrutinize domain names for typosquatting, and employ browser-based security extensions that block known phishing infrastructure. Organizations should monitor for similar patterns, particularly domains mimicking cryptocurrency brands and hosted on content delivery networks.