begincoinbasesignin[.]pages[.]dev

The domain begincoinbasesignin.pages.dev was registered on February 21, 2026 through Cloudflare, Inc. and resolves to the Cloudflare edge address 172.66.44.147, located in the United States under ASN 13335. The site presents a Cloudflare‑issued SSL certificate signed by Google Trust Services / WE1, and the HTTP response returns a 403 status code with the page title “Suspected phishing site | Cloudflare”. Scamadviser assigns a trust score of 10/100, while Gridinsoft rates it 0/100, indicating a high likelihood of malicious intent. Google Safe Browsing flags the URL for social engineering, and the domain appears on one security blocklist and is actively blocked by PhishDestroy.

VirusTotal analysis shows that 14 of 93 security vendors have flagged the domain, reinforcing the suspicion of a crypto‑related scam. The page title and the brand target field identify Coinbase as the impersonated brand, and the scam type is listed as “Crypto Scam”. Detected technologies include HSTS, Cloudflare, and HTTP/3, which are typical of legitimate Cloudflare‑protected sites but do not mitigate the malicious use of the infrastructure. The domain’s nameservers are laylah.ns.cloudflare.com and kanye.ns.cloudflare.com, both standard Cloudflare resolvers.

Current status is offline, suggesting that the phishing infrastructure has been taken down or is no longer serving content. Defenders should continue to block the IP address 172.66.44.147 at network perimeters, add the domain to web filtering and email security policies, and monitor for any re‑registration or similar sub‑domains that use the same Cloudflare nameservers. Because the underlying hosting provider is Cloudflare, any future attempts may leverage new edge IPs, so continuous threat‑intel feeds should be consulted. Evidence from the listed intelligence sources should be archived for attribution and trend analysis.