view-official-walet-en[.]pages[.]dev

This domain, view-official-walet-en.pages.dev, has been confirmed as a brand impersonation phishing site targeting Coinbase users. Analysis indicates the site presents itself as a legitimate Coinbase Wallet portal, using the page title 'Coinbase Wallet: The 2025 Guide' to deceive visitors into entering sensitive credentials or cryptocurrency wallet details. The domain is currently offline, but prior activity suggests it operated as a credential harvester or crypto drainer, a common tactic in cryptocurrency-related phishing schemes. Infrastructure analysis reveals the domain was registered through Cloudflare, Inc., and resolves to the IP address 188.114.97.3. The domain was created on March 25, 2026, an anomalous date likely indicative of incorrect registration metadata or intentional obfuscation. It appears on one security blocklist and is flagged by 13 of 95 security vendors on VirusTotal, with Google Safe Browsing categorizing it under 'SOCIAL_ENGINEERING.' The SSL certificate is issued by Google Trust Services, and the site employs technologies such as Tailwind CSS, HSTS, Cloudflare, and HTTP/3. Gridinsoft assigns a trust score of 0/100, further confirming its malicious nature. The domain has been taken offline, but users who accessed it prior to its removal may remain at risk. Organizations and individuals are advised to block the domain and its associated IP (188.114.97.3) at the network level. Users should verify the authenticity of any cryptocurrency-related communications by directly accessing official platforms through verified URLs. Security teams are recommended to monitor for indicators of compromise, including unusual login attempts or unauthorized cryptocurrency transactions, and to educate users on recognizing brand impersonation tactics in phishing campaigns.