secure-home-coinbase[.]pages[.]dev

The domain secure-home-coinbase.pages.dev was registered on February 21, 2026 through Cloudflare, Inc. and is currently offline. DNS resolution points to IP address 188.114.96.3, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The authoritative nameservers are arch.ns.cloudflare.com and georgia.ns.cloudflare.com, and the TLS certificate is issued by Google Trust Services under the WE1 label, indicating a valid HTTPS endpoint at the time of observation. HTTP responses return status code 403, and the page title presented by the server is "Suspected phishing site | Cloudflare".

Security assessments show extremely low credibility scores: Scamadviser rates the site 1 out of 100 and Gridinsoft assigns a score of 0 out of 100. The domain appears on a single blocklist, PhishDestroy, and Google Safe Browsing flags it for social engineering. VirusTotal analysis reports 15 detections out of 95 scanned vendors, reinforcing the malicious classification. Detected technologies include HSTS, Cloudflare proxy services, and HTTP/3 support.

The site is identified as a crypto‑related scam impersonating the Coinbase brand. While the site is no longer reachable, the infrastructure details—Cloudflare hosting, the specific IP address, and the observed SSL certificate—provide actionable indicators for defenders. Organizations should update their threat intelligence feeds with the IP 188.114.96.3, the two Cloudflare nameservers, and the domain name itself, and ensure that any inbound traffic to this host is blocked at network perimeters. Continued monitoring of Cloudflare‑associated assets is recommended, as the same hosting environment may be reused for future impersonation campaigns targeting financial services.