coin-en-base-login-web[.]pages[.]dev

Analysis of coin-en-base-login-web.pages.dev shows a high‑risk credential phishing operation that was taken offline as of the report date, July 24 2026. The domain was registered through Cloudflare, Inc. on February 21 2026 and resolves to the Cloudflare‑hosted address 188.114.96.3, which belongs to AS13335 in the United States. DNS resolution uses the Cloudflare nameservers kenia.ns.cloudflare.com and merlin.ns.cloudflare.com, indicating the attacker leveraged Cloudflare’s edge network to mask the true hosting location. The site presented a Cloudflare‑generated page titled “Suspected phishing site | Cloudflare” and returned an HTTP 403 status, suggesting the content was blocked by the service provider.

SSL is supplied by Google Trust Services under the WE1 certificate, confirming a valid TLS handshake but offering no protection against the underlying malicious intent. Reputation checks are uniformly negative: Gridinsoft assigned a 0 out of 100 score, Scamadviser a 1 out of 100, and Google Safe Browsing flagged the domain for social‑engineering risk. VirusTotal recorded 14 of 93 security vendors marking the domain as malicious, and the URL appears on at least one dedicated blocklist, PhishDestroy.

The combination of a recent creation date, low trust scores, Cloudflare‑based hosting, and multiple independent detections indicates a deliberate credential‑stealing campaign. Defenders should immediately block the domain and its associated IP address at perimeter firewalls and DNS filtering solutions, monitor for any resurgence of the host or related sub‑domains, and consider reporting the indicator to additional threat‑intel sharing platforms. Continuous observation of Cloudflare‑originating traffic is advised, as the attacker could re‑deploy the phishing site using the same infrastructure.