4909d4aa[.]faqconn[.]pages[.]dev

The domain 4909d4aa.faqconn.pages.dev was registered on 21 February 2026 through Cloudflare, Inc. It resolves to the IP address 172.66.44.174, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The authoritative nameservers are adi.ns.cloudflare.com and karl.ns.cloudflare.com, indicating the use of Cloudflare’s DNS infrastructure. No TLS certificate is presented for the site, meaning HTTPS connections would be unencrypted or rejected by browsers. The page title returned from the live host was “Download Coinbase Wallet – Official Website,” directly referencing the Coinbase brand and suggesting a crypto‑wallet download page.

The domain is classified as a crypto‑scam that impersonates Coinbase, and Google Safe Browsing has flagged it for social engineering. VirusTotal analysis shows that 14 of 93 security vendors have flagged the domain as malicious, reinforcing the suspicion of phishing activity. The domain appears on three public blocklists and has been actively blocked by PhishDestroy, MetaMask, and SEAL, confirming that multiple security products have identified it as a threat. As of the report date, the site is taken offline, which may be the result of takedown actions or temporary hosting changes.

While the infrastructure details are clear, the exact content served before takedown has not been captured, so the specific techniques used to lure victims remain unknown. Defenders should continue to monitor the IP address 172.66.44.174 for any resurgence, enforce blocklist updates for the domain, and ensure that any internal users are warned about the brand‑impersonation attempt. Organizations using Coinbase services should reinforce user education on verifying legitimate URLs and consider implementing web‑filtering rules that block known malicious domains associated with crypto‑scams.