f170b3da[.]purree[.]pages[.]dev

Analysis on July 23, 2026 indicates that the domain f170b3da.purree.pages.dev is currently offline but exhibits multiple indicators of a high‑risk cryptocurrency impersonation campaign targeting Coinbase users. The domain was created on September 2, 2020 and is registered through Cloudflare, Inc., using the authoritative name servers adi.ns.cloudflare.com and karl.ns.cloudflare.com. DNS resolution points to IP 172.66.47.41, an address owned by AS13335 Cloudflare, Inc., located in the United States. An SSL certificate issued by Google Trust Services (WE1) validates the HTTPS endpoint, while the server advertises HSTS and HTTP/3 support, both typical of legitimate Cloudflare‑protected sites and often leveraged by threat actors to gain trust.

The site returns an HTTP 403 status code, preventing content retrieval, and the page title was captured as “Download Coinbase Wallet – Official Website,” directly referencing Coinbase and suggesting a crypto‑wallet lure. Google Safe Browsing flags the URL for social engineering, and VirusTotal reports 15 of 93 scanned security vendors flagging the domain as malicious. The domain appears on one security blocklist and has been listed by PhishDestroy as a known phishing source.

Gridinsoft assigns a trust score of 0 out of 100, reinforcing the malicious assessment. Given the convergence of a brand‑specific page title, a reputable SSL certificate, Cloudflare infrastructure, and multiple independent detections, defenders should continue to block f170b3da.purree.pages.dev at network perimeters, update URL filtering lists, and monitor for any re‑activation of the domain. Incident response teams should also audit internal communications for any attempted credential or private‑key submissions that reference Coinbase Wallet, and educate users about the risk of unsolicited download prompts tied to the Coinbase brand.