rr-3xo[.]pages[.]dev

This domain is flagged as a high-risk brand impersonation site specifically targeting Coinbase, a major cryptocurrency exchange platform. Analysis indicates the infrastructure is designed to deceive users into believing they are interacting with legitimate Coinbase services, potentially leading to unauthorized access to accounts or financial theft. The page title 'Rotting Roots' further suggests an attempt to obscure malicious intent under seemingly benign content. Infrastructure analysis reveals the domain rr-3xo.pages.dev was registered through Cloudflare, Inc. and resolves to the IP address 172.66.47.49, hosted on Cloudflare's network (AS13335). The domain appears on three security blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL. VirusTotal reports 1 out of 95 security vendors flagging this domain as malicious. The SSL certificate is issued by Google Trust Services (WE1), a common tactic to lend false legitimacy. The domain was created on March 03, 2026, though this date may reflect registry manipulation or a placeholder. Mitigation steps should focus on isolating this domain from user access and preventing interaction with its infrastructure. Network-level blocks should be implemented for the IP 172.66.47.49 and the domain rr-3xo.pages.dev. Users should be educated on recognizing brand impersonation tactics, particularly in the cryptocurrency sector, where financial risks are elevated. Monitoring for similar domains using Cloudflare Pages infrastructure or targeting Coinbase branding is recommended. Organizations should verify SSL certificates against known legitimate issuers for the brand and cross-reference domain creation dates with official service timelines to identify anomalies.