view-coinbase-pro-app[.]pages[.]dev

This domain, view-coinbase-pro-app.pages.dev, is identified as a high-risk phishing infrastructure impersonating Coinbase, a cryptocurrency exchange platform. Analysis indicates the site employs brand impersonation tactics, likely designed to deceive users into disclosing login credentials or sensitive financial information. No direct evidence of a crypto drainer kit was observed, though the domain’s structure and naming convention suggest an intent to mimic legitimate Coinbase Pro services, a common vector for credential harvesting or wallet compromise. Infrastructure analysis reveals the following technical indicators: the domain is flagged by 12 out of 95 security vendors on VirusTotal, indicating broad detection across multiple threat intelligence sources. It was registered through Cloudflare, Inc. on February 21, 2026, and resolves to the IP address 172.66.47.160, hosted on AS13335 (Cloudflare, Inc.) in the United States. Google Safe Browsing has classified this domain as phishing, and it appears on three independent security blocklists. The SSL certificate is issued by Google Trust Services (WE1), a detail that may lend a false sense of legitimacy to unsuspecting users. As of the latest assessment, the domain has been taken offline, likely in response to takedown requests or automated detection mechanisms. It is currently blocked by multiple threat intelligence platforms, including PhishDestroy, MetaMask, and SEAL. Despite its offline status, residual risk persists due to the potential for the infrastructure to be reactivated or repurposed under a different domain. Users who may have interacted with this domain are advised to revoke any connected wallet permissions, reset credentials, and monitor accounts for unauthorized transactions. Organizations should update blocklists to include this domain and its associated IP address to prevent future access attempts.