auth-learn-coinbseproo[.]pages[.]dev

The domain auth-learn-coinbseproo.pages.dev has been identified as a sophisticated credential theft phishing site designed to impersonate Coinbase, a popular cryptocurrency exchange. This malicious domain is currently offline, having been taken down after security vendors flagged its activities. The page title, "Suspected phishing site | Cloudflare," indicates that hosting provider Cloudflare intervened to block access, likely in response to abuse reports.

PhishDestroy's analysis reveals that this domain was flagged by 17 of 95 VirusTotal vendors, underscoring its malicious nature. It was registered through Cloudflare, Inc. on February 21, 2026, and resolved to IP address 172.66.46.246. The SSL certificate was issued by Google Trust Services (WE1), adding a veneer of legitimacy. The domain appears on one security blocklist, and Google Safe Browsing flags it as phishing. These technical indicators, combined with the low trust scores, confirm the site's intent to steal login credentials from unsuspecting victims.

Given that the domain is now offline, the immediate risk is mitigated, but users who may have visited the site before its takedown should change their Coinbase passwords and enable two-factor authentication. PhishDestroy recommends monitoring accounts for suspicious activity and avoiding clicking on links in unsolicited messages claiming to be from Coinbase. Always verify URLs by manually typing the official domain (coinbase.com) into the browser.