io-procoin[.]pages[.]dev

This domain, io-procoin.pages.dev, is flagged as a brand impersonation threat specifically targeting Coinbase Pro, a digital asset exchange platform. The page title, 'Coinbase Pro | Digital Asset Exchange® — Presentation,' closely mimics legitimate Coinbase Pro branding, indicating an intent to deceive users into divulging credentials or financial information. No explicit drainer kit signatures were identified in initial analysis, though the infrastructure aligns with known phishing campaigns impersonating cryptocurrency services.

Infrastructure analysis reveals the domain was registered on April 09, 2026, through Cloudflare, Inc., and resolves to the IP address 172.66.44.56. The SSL certificate is issued by Google Trust Services, a common tactic to lend an appearance of legitimacy. Detection metrics show 12 out of 95 security vendors on VirusTotal flagged the domain as malicious, while it appears on one security blocklist. Google Safe Browsing (GSB) status is not explicitly listed, but the domain’s presence on PhishDestroy’s blocklist further corroborates its malicious classification. The Gridinsoft trust score of 0/100 underscores the domain’s high-risk profile.

As of the latest assessment, io-procoin.pages.dev has been taken offline, likely in response to detection and reporting. However, the underlying infrastructure remains a potential vector for future attacks, particularly if the threat actors re-deploy the phishing kit under a new domain. Users who may have interacted with the domain are advised to rotate credentials immediately, monitor financial accounts for unauthorized activity, and verify the legitimacy of any cryptocurrency-related communications. Organizations should update blocklists to include this domain and its associated IP address, while remaining vigilant for similar impersonation attempts targeting digital asset platforms.