pro-coinbase-loggn[.]pages[.]dev

Analysis of the domain pro-coinbase-loggn.pages.dev shows multiple indicators consistent with a brand‑impersonation crypto scam targeting Coinbase users. The domain was registered through Cloudflare, Inc. on February 21 2026 and resolves to the IP address 172.66.47.199, which belongs to AS13335 Cloudflare, Inc. in the United States. The site presents a page title of "Suspected phishing site | Cloudflare" and returns an HTTP 403 status code, suggesting that the content is being blocked or is otherwise inaccessible. The TLS certificate is issued by Google Trust Services under the WE1 identifier, a standard certificate chain for Cloudflare‑hosted sites.

Technical fingerprints include HSTS, Cloudflare’s edge services, and HTTP/3 support, confirming the use of Cloudflare’s CDN infrastructure. Reputation metrics are poor: Gridinsoft assigns a trust score of 0 out of 100, and the domain appears on one known security blocklist, currently listed by PhishDestroy. VirusTotal analysis shows that 13 of 93 scanning engines flagged the domain, reinforcing the malicious classification. The nameservers listed are mark.ns.cloudflare.com and piper.ns.cloudflare.com, both typical of Cloudflare‑managed domains.

The reported scam type is a crypto‑related scam, and the brand target is explicitly identified as Coinbase. While the page content beyond the title has not been publicly disclosed, the combination of brand impersonation, low trust score, multiple vendor detections, and blocklist inclusion provides strong evidence of malicious intent. Defenders should block the domain at network perimeter, add the resolving IP to deny‑list rules, and monitor for any related traffic patterns. Continuous re‑evaluation is advised in case the site is re‑hosted or the threat actor modifies the infrastructure.