secure-coinbase-support[.]pages[.]dev

Analysis shows the domain secure-coinbase-support.pages.dev was created on February 21, 2026 and registered through Cloudflare, Inc. It resolves to the Cloudflare edge address 172.66.47.65, which is geolocated to Canada. The domain is served via HTTPS with HSTS and HTTP/3 enabled, and the authoritative nameservers are pedro.ns.cloudflare.com and nelly.ns.cloudflare.com. An HTTP request returns a 403 status, indicating that the content is not publicly accessible; the site is currently taken offline. Reputation data is strong: VirusTotal records indicate 15 of 95 scanning engines flagged the domain, Google Safe Browsing categorises it as social engineering, and PhishDestroy has blocked it. It appears on one additional security blocklist.

The page title returned by the server is exactly "secure-coinbase-support.pages.dev", offering no further context. Gridinsoft assigns a trust score of 0 out of 100, reinforcing the malicious assessment. The domain explicitly impersonates Coinbase and is classified as a crypto scam. No additional artifacts such as phishing page screenshots or payloads are available.

Defenders should immediately block both the domain name and its resolved IP address at network perimeters, and add the Cloudflare nameservers to DNS monitoring rules to detect any future subdomains that follow a similar naming pattern. Email and web traffic claiming to originate from Coinbase should be subjected to strict verification, given the social engineering flag. Continuous surveillance of newly registered "pages.dev" subdomains that reference Coinbase or other cryptocurrency brands is recommended, as threat actors may reuse the same infrastructure under new URLs. The current intelligence is limited to infrastructure and reputation signals, but the convergence of multiple vendor detections, a zero‑trust score, and explicit brand impersonation warrants a high‑risk classification and proactive mitigation.