portal-coinbase-webcom[.]pages[.]dev

Analysis of portal-coinbase-webcom.pages.dev indicates it is a high‑risk brand‑impersonation site targeting Coinbase users. The domain was registered on February 21, 2026 through Cloudflare, Inc., and resolves to the IP address 172.66.47.150, which belongs to AS13335 Cloudflare, Inc. in the United States. The hosting infrastructure presents HSTS, Cloudflare services, and HTTP/3 support, and the site responded with HTTP 403 before being taken offline.

The TLS certificate is issued by Google Trust Services under the WE1 label, confirming that the connection was encrypted but does not mitigate the malicious intent. Google Safe Browsing classifies the domain as social engineering, and VirusTotal recorded 15 detections out of 93 security vendors, demonstrating a consensus among scanning engines that the site is malicious. The page title returned by the server is "Suspected phishing site | Cloudflare," and the site was listed on a single security blocklist before being removed by PhishDestroy.

Additional reputation data includes a Gridinsoft trust score of 0/100 and a single blocklist appearance, reinforcing the assessment of a fraudulent operation. Defenders should continue to block the domain at network perimeters, monitor for any resurgence of the host, and advise users to disregard any unsolicited Coinbase‑related communications originating from this URL. The evidence does not reveal the exact payload or credential‑harvesting mechanisms, so further forensic capture would be required if the site reappears.