coinandbasecrptohelp[.]pages[.]dev

coinandbasecrptohelp.pages.dev is flagged as a brand‑impersonation site targeting Coinbase customers. The domain was registered on 21 February 2026 through Cloudflare, Inc. and uses Cloudflare DNS (aarav.ns.cloudflare.com, oaklyn.ns.cloudflare.com). DNS resolution points to 188.114.96.3, an address belonging to AS13335 Cloudflare, Inc. located in the United States. TLS is provided by a Let’s Encrypt “E7” certificate, indicating a valid HTTPS configuration with HSTS and HTTP/3 support.

Google Safe Browsing classifies the URL as a social‑engineering threat, and fifteen of ninety‑three VirusTotal scanners have raised detections. The page title returned from the server is “Coinbase – Customer Support”, directly matching the brand target. Blocklists operated by PhishDestroy, MetaMask and SEAL have already listed the domain, and it appears on three additional security blocklists. An HTTP 451 response was observed, and the site is currently offline, preventing live content analysis.

The available evidence points to a crypto‑scam campaign that attempts to lure Coinbase users into disclosing credentials or transferring assets. Uncertainty remains regarding the exact phishing workflow because the site is not reachable for content inspection. Defenders should add the domain to URL filtering, DNS sinkhole, and endpoint blocklists, monitor for other subdomains using the same Cloudflare nameservers, and enforce safe‑browsing policies that warn users about social‑engineering attempts involving Coinbase. Continuous tracking of the IP address and any future re‑registration of similar domains is advised.