koinbase-logi[.]pages[.]dev

Analysis of the domain koinbase-logi.pages.dev confirms it as a phishing site targeting the Coinbase brand, classified under brand impersonation. The domain was registered on February 21, 2026, and resolved to the IP address 172.66.44.158, hosted on Cloudflare's infrastructure (AS13335). Nameservers dylan.ns.cloudflare.com and naomi.ns.cloudflare.com further link it to Cloudflare's network. The SSL certificate, issued by Google Trust Services (WE1), aligns with Cloudflare's standard deployment practices, though this does not mitigate the malicious intent. At the time of assessment (July 23, 2026), the domain returned an HTTP 403 status, indicating it was taken offline or restricted.

Cloudflare's own page title labeled it as a 'Suspected phishing site,' reinforcing its classification. The domain appears on one security blocklist, and PhishDestroy has explicitly blocked it. Gridinsoft assigned a trust score of 0/100, reflecting high confidence in its malicious nature. VirusTotal detections from 9 of 93 security vendors further corroborate the phishing classification, though the specific vendors and detection rules are not disclosed in the available data. The exact content and functionality of the site remain unanalyzed, as no forensic capture or screenshot evidence is provided.

However, the combination of brand impersonation targeting Coinbase, the low trust score, and the security vendor detections leave little ambiguity regarding its purpose. Defenders should treat this domain as malicious and ensure it is blocked at the DNS, proxy, and endpoint levels. Given its offline status, monitoring for re-emergence under the same or similar infrastructure (e.g., Cloudflare Pages, identical nameserver patterns) is recommended. No evidence suggests lateral movement or secondary payload delivery, but historical associations with the IP or nameservers should be reviewed for additional compromised domains.