coinbase-pro-en-us[.]pages[.]dev

Analysis of the domain coinbase-pro-en-us.pages.dev indicates a high-confidence brand impersonation operation targeting Coinbase users, classified as a crypto scam. The domain was registered on February 21, 2026, through Cloudflare Registrar and resolved to the IP address 172.66.44.241, hosted on Cloudflare's infrastructure (AS13335). At the time of assessment, the domain returned an HTTP 403 status with the page title 'Suspected phishing site | Cloudflare,' suggesting Cloudflare's automated systems had already flagged and restricted access. Security vendors exhibit mixed but concerning detection: four of 93 engines on VirusTotal flagged the domain as malicious, while PhishDestroy explicitly blocked it.

The domain appears on at least one security blocklist, and trust scores from Gridinsoft and Scamadviser are critically low at 0/100 and 10/100, respectively. SSL certification was issued by Google Trust Services, a common feature in both legitimate and malicious sites, offering no conclusive signal. Infrastructure analysis reveals the use of Cloudflare nameservers (tina.ns.cloudflare.com and sage.ns.cloudflare.com), HSTS, and HTTP/3, typical of modern phishing setups leveraging Cloudflare's CDN to obscure origin servers and evade takedowns. The domain's current offline status does not eliminate residual risk; historical DNS records and cached content may still pose threats to users who interacted with it prior to deactivation.

Defenders should treat this domain as confirmed malicious infrastructure. Organizations are advised to block the domain at the DNS and proxy levels, monitor for residual connections, and alert users who may have accessed it before takedown. No evidence currently links this domain to a specific phishing kit or campaign beyond the generic 'crypto scam' classification.