pro-coinbase--login[.]pages[.]dev

The domain pro-coinbase--login.pages.dev was registered on February 21, 2026 through Cloudflare, Inc. and resolves to the Cloudflare‑owned address 172.66.47.53, located in the United States under ASN 13335. The site presents the page title "Suspected phishing site | Cloudflare" and returns an HTTP 403 status, indicating that the underlying content is being blocked by Cloudflare’s protective mechanisms. The SSL certificate presented is issued by Google Trust Services (WE1), a legitimate certificate authority, which is commonly used by Cloudflare‑hosted sites and does not on its own imply malicious intent. However, the domain is explicitly associated with a crypto‑related scam targeting Coinbase users, as indicated by the brand target field and the classification "Crypto Scam".

Reputation data shows a Gridinsoft trust score of 0 / 100 and the domain is listed on one security blocklist. VirusTotal analysis recorded 13 detections out of 93 scanning engines, reinforcing the suspicion of malicious activity. The domain’s authoritative nameservers are malavika.ns.cloudflare.com and dante.ns.cloudflare.com, both standard Cloudflare name servers. Additional infrastructure observations include the use of HTTP/3, HSTS, and Cloudflare’s edge network, all of which are typical for legitimate services but are also leveraged by threat actors to gain trust and hide behind reputable infrastructure.

The domain has been taken offline as of the report date, July 23 2026, and is flagged by PhishDestroy. Defenders should continue to block the domain at the DNS and perimeter firewall levels, monitor for any re‑registration attempts, and add the associated IP and nameserver pair to threat intelligence feeds. Because the site is hosted on shared Cloudflare infrastructure, broader network‑wide blocking of Cloudflare should be avoided; instead, precise rule sets targeting this exact FQDN or its IP address are recommended.