en-coinbase-log-web[.]pages[.]dev

The domain en-coinbase-log-web.pages.dev was created on 21 February 2026 through Cloudflare, Inc. It resolves to IP address 172.66.47.112, which belongs to AS13335 Cloudflare, Inc. in the United States. The server presents a valid SSL certificate issued by Google Trust Services under the WE1 designation, and the connection is protected by HSTS with HTTP/3 support. DNS resolution uses the Cloudflare nameservers opal.ns.cloudflare.com and emerson.ns.cloudflare.com. The site returns HTTP status code 403 and the page title is "Suspected phishing site | Cloudflare," indicating that Cloudflare’s automated block page is being served.

The domain is explicitly listed as impersonating Coinbase and is categorized as a crypto‑related scam. It appears on a single security blocklist and has been blocked by PhishDestroy. VirusTotal analysis shows that 13 of 93 scanned security vendors flagged the domain as malicious. Independent scoring from Gridinsoft assigns a trust score of 0 out of 100.

The current operational status is offline, and the risk level is marked as elevated. Defenders should add en-coinbase-log-web.pages.dev to denial‑list rules, monitor for any DNS resolution to the Cloudflare IP range, and enforce TLS inspection to detect the Google‑issued certificate. Network sensors should alert on any outbound attempts to the 172.66.47.112 address, and security teams should verify that endpoint protection correlates the VirusTotal detections with internal threat feeds. Continuous observation of the associated Cloudflare nameservers is recommended to catch any re‑registration attempts.