web-manage-coinbase[.]pages[.]dev

The domain web-manage-coinbase.pages.dev was created on February 21, 2026 and is currently taken offline. It is registered through Cloudflare, Inc. and resolves to the IP address 172.66.47.108, which belongs to AS13335 Cloudflare, Inc. in the United States. The authoritative nameservers tess.ns.cloudflare.com and gordon.ns.cloudflare.com confirm that the hosting is provided by Cloudflare. The site served a page titled "Suspected phishing site | Cloudflare" and returned an HTTP 403 status code, indicating that direct content retrieval was blocked.

TLS termination is performed by a Google Trust Services certificate (WE1), and the connection employed HSTS and HTTP/3, consistent with Cloudflare's security stack. VirusTotal recorded 15 detections out of 93 scanning engines, and Google Safe Browsing labeled the domain for social engineering. Additional threat intelligence shows the domain appears on one security blocklist and has been blocked by PhishDestroy. Reputation services assign a Scamadviser score of 41/100 and a Gridinsoft score of 0/100, reflecting a low trust rating.

The intelligence explicitly identifies the site as a crypto scam that impersonates the Coinbase brand. While the page content has not been captured, the combination of brand impersonation, malicious detection counts, and blocklist presence demonstrates a high‑risk phishing campaign. Defenders should continue to block the domain at network perimeter, monitor for any re‑registration attempts, and add the associated IP range to deny lists. Ongoing surveillance of Cloudflare‑hosted assets targeting Coinbase users is recommended to detect potential replicas or related infrastructure.