learn-coinbaseprologin[.]pages[.]dev

This domain, learn-coinbaseprologin.pages.dev, operates as a fraudulent Coinbase login portal designed to harvest cryptocurrency credentials. The site mimics the legitimate Coinbase Pro interface, presenting users with a seemingly authentic login form that captures entered usernames, passwords, and two-factor authentication codes. Analysis indicates the infrastructure is tailored for credential theft, with potential secondary objectives including wallet-draining malware deployment or unauthorized fund transfers. The domain specifically targets users seeking Coinbase Pro services, exploiting brand recognition to lower victim suspicion during phishing attempts. Infrastructure analysis reveals multiple technical indicators confirming malicious intent. The domain was registered on October 29, 2025, through Cloudflare, Inc., and resolves to the IP address 172.66.44.203, hosted on AS13335 (Cloudflare, Inc.) in the United States. VirusTotal detection rates show 11 out of 95 security vendors flagging the domain as malicious, while it appears on one security blocklist. The SSL certificate is issued by Google Trust Services (WE1), a common pattern observed in phishing campaigns leveraging free certificates to appear legitimate. The page title, 'Suspected phishing site | Cloudflare,' suggests automated detection by the hosting provider, though the domain remained active long enough to pose a credible threat. Users who visited learn-coinbaseprologin.pages.dev or entered credentials on the site should immediately take corrective action. First, revoke any active sessions on the legitimate Coinbase platform and change passwords using a secure device. Enable multi-factor authentication if not already active, and monitor account activity for unauthorized transactions. If cryptocurrency wallets were accessed or private keys entered, transfer remaining funds to a new wallet address and consider the compromised wallet as permanently exposed. Report the incident to the targeted brand’s security team and relevant cybersecurity authorities to aid in takedown efforts. Proactive monitoring of financial accounts and credit reports is recommended to detect potential follow-up attacks.