coinbase-explanetion[.]pages[.]dev

The domain coinbase-explanetion.pages.dev was registered on February 21, 2026 through Cloudflare, Inc. and resolves to the IP address 172.66.45.13, which belongs to AS13335 Cloudflare, Inc. in the United States. The site is currently offline, returning an HTTP 403 status code, and the page title presented by Cloudflare reads "Suspected phishing site | Cloudflare". Analysis of the TLS certificate shows it was issued by Google Trust Services under the WE1 certificate authority, indicating a legitimate SSL chain despite the malicious intent. The domain is flagged by multiple defensive sources: PhishDestroy has listed it as blocked, Google Safe Browsing classifies it as social engineering, and it appears on one additional security blocklist.

VirusTotal reports that 16 out of 93 scanning engines have flagged the domain, reinforcing the suspicion of malicious activity. The site employs standard Cloudflare services, including HTTP/3 and HTTP Strict Transport Security (HSTS), which can obscure traffic analysis. Gridinsoft assigns a trust score of 0 out of 100, reflecting extreme risk. The domain explicitly impersonates the Coinbase brand and is categorized as a crypto scam.

While the page content has not been publicly disclosed, the combination of the brand impersonation, the crypto‑related scam type, and the detection coverage suggests a high likelihood of credential harvesting or financial fraud targeting Coinbase users. Defenders should continue to block the domain at network perimeters, monitor DNS queries for the domain and its associated nameservers (byron.ns.cloudflare.com, autumn.ns.cloudflare.com), and advise users to avoid any unsolicited communications referencing Coinbase that direct them to this URL. Ongoing threat intelligence feeds should be updated to include this indicator, and any residual traffic should be logged for forensic correlation with potential compromise events.