koinbase-pro-log[.]pages[.]dev

Analysis conducted on July 25, 2026 indicates that the domain koinbase-pro-log.pages.dev is currently offline and returns HTTP 403. The site is hosted on Cloudflare infrastructure, resolving to IP 172.66.47.20 belonging to AS13335 Cloudflare, Inc., located in the United States. DNS records show the domain is delegated to the Cloudflare nameservers yichun.ns.cloudflare.com and fay.ns.cloudflare.com, and the registration was performed through Cloudflare, Inc. on February 21, 2026. The TLS certificate presented is issued by Google Trust Services under the WE1 classification, confirming a valid HTTPS endpoint despite the site’s offline status.

Security telemetry reveals a brand‑impersonation phishing classification; the page title presented by Cloudflare reads “Suspected phishing site | Cloudflare,” confirming that the service has identified the content as malicious. A Gridinsoft trust score of 0 out of 100 further underscores the lack of trust. The domain appears on a single blocklist, specifically PhishDestroy, indicating that at least one anti‑phishing feed has flagged it. VirusTotal analysis shows that six out of ninety‑three scanning engines have flagged the domain, providing independent corroboration of malicious intent.

No additional evidence links, Safe Browsing entries, or OTX references were supplied. Defenders should continue to block traffic to the domain, monitor for any future re‑activation, and consider adding the IP address 172.66.47.20 to network‑level deny lists. Given the confirmed brand‑impersonation indicator, the domain should be treated as a high‑confidence phishing threat until further remediation is observed.