views-coinbase-en[.]pages[.]dev

The domain views-coinbase-en.pages.dev was registered through Cloudflare, Inc. on 21 February 2026 and resolves to the Cloudflare address 172.66.47.55, which is advertised as part of AS13335 in the United States. The authoritative name servers are austin.ns.cloudflare.com and riya.ns.cloudflare.com, confirming that the hosting infrastructure is provided by Cloudflare. An HTTPS certificate issued by Google Trust Services (WE1) is present, but the site returns HTTP 403 responses and the page title is “Suspected phishing site | Cloudflare”, indicating that the content has been flagged by the provider. The domain appears on a single security blocklist and is listed as blocked by PhishDestroy.

Google Safe Browsing classifies the URL as a social‑engineering threat, and VirusTotal reports that 14 of 93 scanning engines have flagged the domain, reinforcing the malicious assessment. Reputation services assign extremely low trust scores, with Scamadviser rating the site 1 / 100 and Gridinsoft rating it 0 / 100. The observed behavior aligns with a crypto‑scam impersonation of Coinbase, as indicated by the brand target and the “Crypto Scam” classification. The domain is currently taken offline, but its infrastructure—particularly the shared Cloudflare IP—could be reused for related campaigns.

Defenders should add the domain to block lists, enforce DNS‑level filtering, and monitor the associated IP address for future activity. Updating web‑gateway signatures to detect the “Suspected phishing site | Cloudflare” title and the specific certificate fingerprint can reduce exposure. Continuous re‑inspection of the Cloudflare name servers for new subdomains targeting the Coinbase brand is also recommended.