welcm-coinsbase-pro-eng[.]pages[.]dev

On July 24, 2026 the domain welcm-coinsbase-pro-eng.pages.dev was observed as an offline host linked to a brand‑impersonation campaign targeting Coinbase. The domain was registered on February 21, 2026 through Cloudflare, Inc., and its authoritative nameservers are ines.ns.cloudflare.com and pedro.ns.cloudflare.com, indicating the use of Cloudflare’s DNS infrastructure. DNS resolution points to IP address 188.114.97.3, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The site presented an HTTPS certificate issued by Google Trust Services under the WE1 label, and the server advertised HSTS, Cloudflare services, and HTTP/3 support.

An HTTP request returned a 403 status code, suggesting that the content is not publicly accessible at the time of analysis. The page title retrieved from the site, "Coinbase Pro — Login Guide & Security Best Practices," aligns with the declared scam type of brand impersonation and the listed brand target of Coinbase. Google Safe Browsing classified the domain as a social‑engineering threat, and VirusTotal reported that nine of ninety‑five scanning engines flagged the domain as malicious.

Additional reputation data includes a Gridinsoft trust score of 0 out of 100, placement on a single security blocklist, and a block action by PhishDestroy. While the technical indicators strongly suggest a malicious intent, the offline status prevents direct observation of payloads or phishing pages, leaving the exact content of the compromised page unverified. Defenders should continue to block the domain at network perimeters, monitor for any future re‑hosting of the same host or similar Cloudflare‑based infrastructure, and update endpoint and URL filtering solutions with the observed indicators, including the domain name, IP address, and associated nameservers.