coinbase-pro-web-us[.]pages[.]dev

Analysis of coinbase-pro-web-us.pages.dev, created on February 21, 2026 and taken offline as of the report date July 23, 2026, shows multiple indicators of a high‑risk brand‑impersonation campaign targeting Coinbase users. The domain resolves to IP address 172.66.47.119, which belongs to AS13335 Cloudflare, Inc. and is located in the United States. Registration is handled by Cloudflare, Inc., with authoritative nameservers daisy.ns.cloudflare.com and buck.ns.cloudflare.com. The site presented a page title of "Suspected phishing site | Cloudflare" and returned an HTTP 403 status, suggesting that the content was blocked or inaccessible at the time of inspection.

TLS is provided by a Google Trust Services certificate (WE1), an uncommon pairing for a Cloudflare‑hosted domain, and the infrastructure employs HSTS and HTTP/3. Google Safe Browsing classifies the URL as social engineering, and the domain appears on three security blocklists, including PhishDestroy, MetaMask, and SEAL. VirusTotal analysis recorded 13 detections out of 93 scanning engines, reinforcing the malicious assessment. A Gridinsoft trust score of 0 / 100 further indicates a lack of trustworthiness.

The campaign is identified as a crypto‑scam leveraging Coinbase branding. While the exact phishing payload or credential‑harvesting page could not be examined due to the offline status, the converging evidence from DNS, certificate, blocklist, and vendor detections warrants a high‑severity alert. Defenders should block the domain at network and DNS layers, monitor for related subdomains or similar Cloudflare‑hosted assets, and update endpoint and email filters to flag communications referencing the compromised brand.