guide-coinbase-com-en[.]pages[.]dev

This domain is a credential harvesting site designed to impersonate Coinbase, a cryptocurrency exchange platform. Visitors are presented with a fraudulent login interface that mimics the legitimate Coinbase website, tricking users into entering their account credentials, which are then captured by threat actors. The site may also attempt to collect additional sensitive information such as two-factor authentication codes or recovery phrases, enabling unauthorized access to victims' cryptocurrency wallets and financial accounts. Analysis indicates the domain was registered on October 27, 2025, through Cloudflare, Inc., and is hosted on infrastructure associated with the same provider. As of the latest scan, 13 out of 95 security vendors on VirusTotal flag the domain as malicious, while Google Safe Browsing and one additional security blocklist classify it as phishing. The SSL certificate, issued by Google Trust Services, does not mitigate the risk, as phishing sites frequently use valid certificates to appear legitimate. The domain resolves to the IP address 188.114.96.3, located in the United States under Cloudflare's autonomous system (AS13335). If you visited guide-coinbase-com-en.pages.dev or entered any login details, immediately change your Coinbase password and enable multi-factor authentication if not already active. Review your account for unauthorized transactions or changes, and revoke access to any unfamiliar connected applications or devices. Monitor linked financial accounts and cryptocurrency wallets for suspicious activity. Report the incident to the legitimate platform's support team and consider filing a report with local cybercrime authorities or dedicated fraud reporting platforms. Avoid clicking on links in unsolicited emails or messages, and verify website authenticity by manually entering the official domain in your browser.