coinbaseinteriorr[.]pages[.]dev

This domain, coinbaseinteriorr.pages.dev, is assessed as a high-risk phishing site targeting Coinbase users, with infrastructure analysis confirming its malicious intent. Registered on February 21, 2026, through Cloudflare, Inc., the domain currently resolves to IP 172.66.44.147 (US, AS13335 Cloudflare, Inc.) and lacks an SSL certificate, a common red flag in phishing operations. The page title, 'Suspected phishing site | Cloudflare,' aligns with Cloudflare's automated warning system for flagged content, though this does not confirm takedown. Google Safe Browsing explicitly classifies the domain as engaging in social engineering, a tactic frequently used in crypto scams to deceive victims into divulging credentials or transferring assets.

Detection data from VirusTotal indicates that 11 of 93 security vendors have flagged this domain, providing moderate consensus on its malicious nature. The domain appears on at least one security blocklist (PhishDestroy) and is categorized as a crypto scam, consistent with its impersonation of Coinbase. While the domain is currently offline, defenders should treat it as a confirmed threat due to its presence on blocklists, Safe Browsing classification, and detection by multiple security vendors. No evidence suggests the use of a phishing kit or additional infrastructure beyond the Cloudflare hosting environment.

Defenders are advised to block the domain and its resolving IP at firewall and proxy levels, monitor for related subdomains or newly registered lookalike domains, and alert users to the specific threat of crypto scams impersonating Coinbase. Given the domain's recent creation and rapid detection, further variants or resurrection attempts are possible. No additional evidence links this domain to broader campaigns or advanced threat actors, but its alignment with common phishing tactics warrants continued vigilance.