coinbase-io-pro[.]pages[.]dev

The domain coinbase-io-pro.pages.dev was created on February 21, 2026 and is registered through Cloudflare, Inc. It resolves to the IP address 188.114.96.3, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The authoritative name servers for the zone are bart.ns.cloudflare.com and monroe.ns.cloudflare.com. An SSL certificate issued by Google Trust Services under the identifier WE1 secures the site, indicating the use of a widely trusted certificate authority. HTTP requests to the domain return a 403 status code, and the page title reported by crawlers is "Suspected phishing site | Cloudflare".

The site is classified as a crypto scam aimed at impersonating Coinbase, and Google Safe Browsing flags it for social engineering. Detection data show that 14 of 93 security vendors on VirusTotal flag the domain, and it appears on a single public blocklist. The PhishDestroy blocklist has already taken the domain offline. Independent testing by Gridinsoft assigns a trust score of 0 out of 100, reinforcing the malicious assessment.

While the technical infrastructure and vendor detections provide strong evidence of abuse, the exact payload or credential‑harvesting mechanisms have not been publicly disclosed. Defenders should continue to block the domain at network perimeters, update URL filtering feeds with the observed indicators, and monitor for any related subdomains that may share the same Cloudflare IP range. Additional analysis of traffic logs for the 188.114.96.3 address may reveal further campaign components.