coin-base-en-pro-io[.]pages[.]dev

On July 23, 2026, the domain coin-base-en-pro-io.pages.dev was flagged as a high-risk brand impersonation site targeting Coinbase. The domain is currently offline and returns an HTTP 403 status code, indicating that the server understands the request but refuses to authorize it. The page title, 'Suspected phishing site | Cloudflare,' further supports the assessment that this domain was used for malicious activities. Analysis indicates that the domain was registered through Cloudflare, Inc. on February 21, 2026.

The SSL certificate is issued by Google Trust Services, suggesting the use of Cloudflare's services to enhance the domain's credibility. The domain resolves to the IP address 188.114.97.3, which is located in the United States and is part of Cloudflare, Inc.'s network (AS13335). According to Google Safe Browsing, the domain is flagged for social engineering, which aligns with the brand impersonation threat type. The domain appears on one known security blocklist and is blocked by PhishDestroy.

Gridinsoft's trust score for this domain is 0 out of 100, indicating a high level of distrust. While the domain is currently offline, the infrastructure and historical data suggest that it was used to impersonate Coinbase and potentially compromise user information. Defenders should remain vigilant and ensure that this domain is blocked to prevent any future misuse. The exact content of the site has not been analyzed, but the technical indicators and blocklist presence provide strong evidence of its malicious intent.