faqs-coiibase-eng[.]pages[.]dev

Analysis indicates that the domain faqs-coiibase-eng.pages.dev is a confirmed phishing site impersonating the Coinbase brand, as classified by multiple security vendors. The domain was registered on February 21, 2026, through Cloudflare, Inc., and is hosted on Cloudflare infrastructure, resolving to the IP address 172.66.44.135 (AS13335, United States). The SSL certificate is issued by Google Trust Services (WE1), a common feature among phishing domains leveraging Cloudflare's services to appear legitimate. At the time of this report, the domain is offline, returning an HTTP 403 status, and is explicitly flagged by Cloudflare with the page title 'Suspected phishing site | Cloudflare.' Detection data reveals that 13 out of 93 security vendors on VirusTotal have flagged this domain as malicious, with Google Safe Browsing specifically categorizing it as engaging in social engineering.

The domain appears on at least one security blocklist, and Gridinsoft assigns it a trust score of 0/100, further corroborating its malicious nature. The scam type is explicitly identified as brand impersonation, targeting Coinbase users. Infrastructure analysis reveals the use of Cloudflare nameservers (suzanne.ns.cloudflare.com and steven.ns.cloudflare.com) and technologies such as HSTS and HTTP/3, which are often employed to evade detection and enhance perceived legitimacy. Defenders should treat this domain as a high-risk threat.

While the domain is currently offline, historical DNS and WHOIS records should be preserved for forensic analysis. Organizations are advised to block the domain and its associated IP (172.66.44.135) at the network level, and monitor for any re-emergence under similar naming conventions or Cloudflare-hosted subdomains. Given the explicit brand impersonation, Coinbase users should be alerted to potential credential harvesting or fraudulent transaction attempts linked to this campaign.