get-started-coinbase-wallet[.]pages[.]dev

On 23 July 2026, the domain get-started-coinbase-wallet.pages.dev was identified as a high‑risk brand‑impersonation site targeting Coinbase users. The site was registered on 21 February 2026 through Cloudflare, Inc., and resolves to the Cloudflare‑owned IP address 188.114.97.3 (AS13335, United States). TLS is provided by a Google Trust Services / WE1 certificate and the service advertises HSTS, HTTP/3 and Cloudflare caching. When queried, the server returned HTTP 403, and the page title reported by the response header is “Suspected phishing site | Cloudflare”, matching the behavior of a takedown page rather than the original content.

Google Safe Browsing classifies the domain as social engineering, and 15 of 93 antivirus and URL‑reputation engines on VirusTotal have flagged it as malicious. The domain appears on a single external blocklist and has been actively blocked by the PhishDestroy feed. Additional reputation signals include a Gridinsoft trust score of 0 / 100 and a classification as a Crypto Scam that impersonates Coinbase. The nameservers listed are venus.ns.cloudflare.com and osmar.ns.cloudflare.com, both typical of Cloudflare‑hosted domains.

No further public screenshots or content analysis are available, so the exact phishing payload remains unknown. Defenders should immediately deny resolution to 188.114.97.3 for any internal clients, add get‑started‑coinbase‑wallet.pages.dev to DNS‑based blocklists, and monitor for newly‑registered subdomains under pages.dev that reference Coinbase or cryptocurrency terminology. Continuous ingestion of Google Safe Browsing, VirusTotal, and PhishDestroy alerts is recommended to capture any re‑hosted variants. Because the site is currently offline, remediation focuses on preventing future access and correlating any credential‑theft incidents with this indicator.