cloud-en-coinbasepro[.]pages[.]dev

This report details a threat domain identified during analysis. The site, hosted at cloud-en-coinbasepro.pages.dev, displayed a page title of "Suspected phishing site | Cloudflare," indicating it was blocked by a security service. The domain impersonated the Coinbase brand and was classified as a cryptocurrency scam type. The primary threat posed was social engineering, as flagged by Google Safe Browsing, designed to deceive users into divulging sensitive cryptocurrency account credentials or funds.

Technical evidence confirms the domain's malicious nature. VirusTotal detected the site as malicious by 14 out of 95 security vendors. The domain was flagged by multiple security entities including ADMINUSLabs, ChainPatrol, alphaMountain.ai, BitDefender, and CyRadar. Google Safe Browsing reported a status of FLAGGED with a classification of ["SOCIAL_ENGINEERING"], and it appeared on one blocklist. The domain was registered with Cloudflare, Inc., created on 2025-11-03, and resolved to IP address 188.114.96.3 located in the United States, assigned to AS13335 Cloudflare, Inc. SSL certificate was issued by Google Trust Services / WE1, and nameservers were suzanne.ns.cloudflare.com and devin.ns.cloudflare.com.

The current operational status of the domain is DOWN/OFFLINE, indicating it is no longer accessible. Based on the GridinSoft trust score of 0/100 and a DOM risk score of 100, the risk level is assessed as critical. This domain represents a high-severity threat due to its targeted impersonation of a legitimate cryptocurrency platform and confirmed malicious infrastructure.