authmgr-amg67430[.]coinbasedevelopers-activity[.]workers[.]dev

This domain, authmgr-amg67430.coinbasedevelopers-activity.workers.dev, is identified as a high-risk brand impersonation threat targeting Coinbase users. Analysis indicates the domain mimics legitimate Coinbase authentication portals, likely to harvest credentials or facilitate unauthorized transactions. No explicit crypto drainer kit signatures were observed, but the page title "Pesquisa - Microsoft Bing" suggests an attempt to evade detection by masquerading as a search engine result, a common tactic in phishing campaigns. Infrastructure analysis reveals the domain is flagged by 5 out of 95 security vendors on VirusTotal, with a registrar of Cloudflare, Inc. It resolves to the IP address 184.86.251.29, hosted under AS20940 (Akamai International B.V.) in Germany. The domain appears on three security blocklists and lacks an SSL certificate, further indicating malicious intent. Google Safe Browsing (GSB) status is not explicitly provided, but the domain remains active and unblocked by default in most consumer security tools. As of the latest assessment, the domain remains operational, though it is blocked by select security providers. Response actions include monitoring for credential harvesting activity and transaction anomalies linked to this infrastructure. The remaining risk is classified as high due to the domain's active status, lack of SSL encryption, and persistent brand impersonation tactics. Users are advised to verify domain authenticity before entering credentials and to report any suspicious activity to their security teams for further investigation.