123-7bf[.]pages[.]dev

On July 24, 2026 the domain 123-7bf.pages.dev was examined following its classification as a brand‑impersonation site targeting Coinbase users. The domain was registered on February 21, 2026 through Cloudflare, Inc. and resolves to the Cloudflare‑owned address 172.66.45.11, which belongs to ASN 13335 located in the United States. TLS termination is provided by a Google Trust Services certificate (WE1), and the site served an HTTP 403 response at the time of capture, indicating that content was not publicly accessible. The page title returned by the server is "Web 3 Dapp," and the infrastructure advertises HSTS, Cloudflare and HTTP/3 support, consistent with typical abuse of legitimate CDN services.

VirusTotal analysis recorded nine detections out of ninety‑five scanners, confirming that multiple security products flag the domain as malicious. The domain appears on three independent blocklists—PhishDestroy, ScamSniffer and Enkrypt—reinforcing its reputation as a phishing vector. Reputation services assign low confidence scores: Gridinsoft reports a trust score of 0 / 100 and Scamadviser a trust score of 11 / 100, both indicating a high likelihood of abuse. The observed scam type is Wallet/Seed Phishing, and the intelligence explicitly notes that the site impersonates Coinbase, suggesting that any credential‑collection pages would be aimed at extracting cryptocurrency wallet seeds or login details.

Because the domain is currently taken offline, the exact content and phishing kit cannot be verified, and the page title alone does not reveal the specific lure employed. Defenders should continue to block the domain at network and DNS layers, monitor for any re‑registration attempts, and add the IP address 172.66.45.11 to threat‑intel feeds. Organizations using Coinbase services should remind users to verify URLs, enforce multi‑factor authentication, and employ anti‑phishing solutions that incorporate the listed blocklist entries and the observed VirusTotal detections.