official-coin-base[.]pages[.]dev

The domain official-coin-base.pages.dev was registered through Cloudflare on February 21, 2026 and resolves to the IP address 172.66.44.103, which belongs to AS13335 Cloudflare, Inc. in the United States. The site is protected by HSTS, serves HTTP/3 traffic, and presents an SSL certificate issued by Google Trust Services under the WE1 brand, indicating a valid TLS configuration. An HTTP request returns a 403 status code, and the page title returned by the server is "Suspected phishing site | Cloudflare," consistent with a takedown or blockpage response. Independent analysis shows that 13 of 93 security vendors on VirusTotal have flagged the domain, and Google Safe Browsing classifies it as social engineering.

The domain appears on a single external blocklist and is actively blocked by PhishDestroy. The Gridinsoft trust score is 0 out of 100, reflecting an extremely low reputation. The site is identified as a crypto‑related scam that impersonates Coinbase, aligning with the declared brand target. Nameservers listed are kara.ns.cloudflare.com and steven.ns.cloudflare.com, both standard Cloudflare resolver entries.

The current status is offline, suggesting that the hosting provider has taken the site down. While the technical indicators confirm malicious intent, the exact content and functional characteristics of the page have not been publicly disclosed, leaving the specific phishing vector uncertain. Defenders should continue to block the domain at perimeter defenses, monitor for any resurgence of the host or similar subdomains, and update threat intelligence feeds with the observed indicators of compromise, including the IP address, SSL certificate details, and the 403 response pattern. Ongoing observation of Cloudflare‑registered domains that mimic high‑value financial brands is recommended to pre‑empt future impersonation campaigns.