helps-pro-lgn-coinbase[.]pages[.]dev

PhishDestroy identifies this domain as a high-risk brand impersonation threat, specifically targeting Coinbase users. The website was designed to mimic legitimate Coinbase login pages in an attempt to steal credentials. Although the site is now offline, the risk to users who may have encountered it remains significant.

This domain was registered through Cloudflare, Inc. on October 30, 2025, and resolves to IP address 188.114.96.3. It appears on 1 security blocklist and is flagged by Google Safe Browsing as phishing. VirusTotal analysis shows 13 out of 95 security vendors flagging this domain as malicious. The SSL certificate was issued by Google Trust Services (WE1), and the page title displayed "Suspected phishing site | Cloudflare."

Users who visited this domain should change their Coinbase passwords immediately and enable two-factor authentication if not already active. Avoid entering any credentials on pages that appear suspicious, and always verify the URL before logging in. Report any similar domains to Coinbase’s security team and consider using a password manager to detect lookalike domains.