coin-bases-login[.]pages[.]dev

The domain coin-bases-login.pages.dev is a confirmed phishing site engaged in brand impersonation targeting Coinbase users. It presents itself as a legitimate Coinbase login portal to deceive victims into entering cryptocurrency credentials, though no active drainer kit was detected. As of the latest verification, coin-bases-login.pages.dev has been taken offline, but prior activity classified it as an elevated-risk scam.

Technical indicators confirm the malicious nature of coin-bases-login.pages.dev. The domain was flagged by 13 of 95 VirusTotal security vendors, including ADMINUSLabs, ChainPatrol, and alphaMountain.ai, and appears on one security blocklist (PhishDestroy). Registered through Cloudflare, Inc. on October 27, 2025, it resolved to the IPv6 address 2606:4700:310c::ac42:2cb3, hosted on Cloudflare’s US-based infrastructure (AS13335). The SSL certificate was issued by Google Trust Services (WE1), and the observed page title was 'Suspected phishing site | Cloudflare'. Technologies detected include HSTS, Cloudflare, and HTTP/3, with an HTTP status of 403 at the time of assessment.

Victims who interacted with coin-bases-login.pages.dev should immediately change their Coinbase passwords and enable two-factor authentication (2FA) to prevent unauthorized access. Monitor accounts for suspicious transactions and report any fraudulent activity to Coinbase support. To mitigate further risk, revoke any token approvals granted during the suspected compromise and consider transferring funds to a new wallet. Report the phishing domain to Google Safe Browsing, the Anti-Phishing Working Group (APWG), and Cloudflare’s abuse team for further investigation.