coinbase-secure-en[.]pages[.]dev

This domain is flagged for elevated risk due to brand impersonation phishing, specifically targeting Coinbase users. Analysis indicates the domain was designed to mimic legitimate Coinbase authentication portals, likely to harvest credentials or facilitate unauthorized transactions. The threat type is confirmed as brand_impersonation, a tactic commonly used to exploit trust in well-known financial platforms. Infrastructure analysis reveals the domain coinbase-secure-en.pages.dev was registered through Cloudflare, Inc. on February 21, 2026, and resolves to the IP address 188.114.96.3 (AS13335, Cloudflare, Inc., US). It appears on one security blocklist and is blocked by PhishDestroy. VirusTotal reports 17 out of 95 security vendors flagging the domain as malicious. The SSL certificate is issued by Google Trust Services (WE1), and the page title was identified as 'Suspected phishing site | Cloudflare.' The domain is currently offline, though prior activity suggests it was operational for a limited window. Mitigation steps for this threat type include immediate blacklisting of the domain and associated IP (188.114.96.3) across all network security controls. Organizations should deploy indicators of compromise (IOCs) such as the domain, IP, and SSL certificate issuer (Google Trust Services / WE1) into endpoint detection and response (EDR) and security information and event management (SIEM) systems. Users who may have interacted with the domain should be instructed to reset credentials for Coinbase and any other financial accounts accessed during the exposure window. Monitoring for anomalous login attempts or transaction patterns linked to this campaign is recommended for at least 30 days post-exposure.