coinbas-pro-logn[.]pages[.]dev

The domain coinbas-pro-logn.pages.dev was registered on February 21, 2026 through Cloudflare, Inc. and is currently taken offline. Infrastructure analysis shows the domain resolves to IP address 172.66.47.119, which belongs to AS13335 Cloudflare, Inc. in the United States. The site is protected by Cloudflare services, employing HSTS and HTTP/3, and presents a valid SSL certificate issued by Google Trust Services (WE1). The observed HTTP response code is 403, indicating access is denied for generic requests. Google Safe Browsing flags the domain for social‑engineering content, and PhishDestroy has listed it as blocked.

VirusTotal reports that 15 of 93 security vendors have flagged the domain, reinforcing the malicious assessment. Gridinsoft assigns a trust score of 0 / 100, the lowest possible rating. The page title returned by the server is “Suspected phishing site | Cloudflare,” and the site appears on one additional security blocklist. Nameservers listed are memphis.ns.cloudflare.com and mona.ns.cloudflare.com.

The declared scam type is credential phishing, targeting login credentials. While the technical indicators confirm malicious intent, no content analysis of the landing page is available, so the exact phishing vector (e.g., which service credentials are sought) remains unknown. Defenders should continue to block the domain at DNS and proxy layers, monitor for any re‑hosting attempts, and incorporate the IP address and ASN into threat‑intel feeds. Ongoing observation of Cloudflare‑hosted domains with similar naming patterns is advised, as the infrastructure can be reused for future campaigns.