basiclover[.]pages[.]dev

The domain basiclover[.]pages[.]dev is currently flagged as an active brand impersonation threat targeting Coinbase, a prominent cryptocurrency exchange platform. Analysis indicates the site is designed to deceive users into believing they are interacting with legitimate Coinbase services, potentially facilitating unauthorized transactions or credential harvesting. The domain remains operational as of the latest verification. Infrastructure analysis reveals the domain resolves to the IP address 188.114.96.3, hosted under AS13335 (Cloudflare, Inc.) with a geolocation attributed to the United States. The domain was registered through Cloudflare, Inc., with a creation date of March 05, 2026, suggesting a recently established infrastructure. Security telemetry shows the domain is flagged by 5 of 95 vendors on VirusTotal, and it appears on four distinct security blocklists, including PhishDestroy, MetaMask, ScamSniffer, and SEAL. The SSL certificate is issued by Google Trust Services (WE1), a common characteristic observed in both legitimate and malicious domains leveraging Cloudflare’s services. Current status confirms the domain remains active, posing an ongoing risk to users. Organizations and individuals are advised to block the domain and associated IP at the network level. End-users should be alerted to verify the authenticity of any communications or websites claiming affiliation with Coinbase, particularly those prompting cryptocurrency transactions or login requests. Monitoring for similar domains registered under Cloudflare’s infrastructure may aid in preemptive threat detection.