web-coinbaase-pro--learn[.]pages[.]dev

This domain, web-coinbaase-pro--learn.pages.dev, is a confirmed phishing infrastructure targeting Coinbase. The domain was registered on February 21, 2026, through Cloudflare, Inc., and as of the report date of July 24, 2026, it is offline. The HTTP status returned is 403, and the page title is 'Suspected phishing site | Cloudflare', indicating Cloudflare has proactively blocked or flagged the site. The domain resolves to an IPv6 address (2606:4700:310c::ac42:2f2e) hosted in the United States on AS13335 (Cloudflare, Inc.), and its nameservers are virginia.ns.cloudflare.com and guss.ns.cloudflare.com.

The SSL certificate was issued by Google Trust Services (WE1). Security telemetry shows 9 out of 93 security vendors on VirusTotal flagged this domain as malicious, and it appears on one security blocklist. Google Safe Browsing flags the domain for social engineering, consistent with a brand impersonation scam, and Gridinsoft assigns a trust score of 0 out of 100.

The domain has been blocked by PhishDestroy. Defenders should treat the domain as definitively malicious and ensure it remains blocked on all network and email gateways; any user who may have visited the site prior to takedown should be instructed to change Coinbase credentials and enable multi-factor authentication. The exact content of the page was not analysed, but the combination of brand target, detection rates, and blocklists confirms the threat.