secure-coinbasecom-cdn[.]pages[.]dev

Analysis for secure-coinbasecom-cdn.pages.dev, observed as a fraudulent actor targeting Coinbase users, was compiled on July 23, 2026. The domain was registered on February 21, 2026 through Cloudflare, Inc. and resolves to the Cloudflare edge address 172.66.44.91, belonging to ASN 13335 in the United States. DNS configuration lists elly.ns.cloudflare.com and darwin.ns.cloudflare.com as authoritative nameservers, confirming the use of Cloudflare’s DNS infrastructure. The site presents the page title "Suspected phishing site | Cloudflare," and the HTTP response is a 403 status code, indicating that the server is currently refusing access, consistent with the reported offline status. TLS termination is provided by a Google Trust Services certificate (WE1), and the connection enforces HSTS while supporting HTTP/3, reflecting a modern web stack that can be leveraged to gain user trust.

Reputation services flag the domain heavily. Google Safe Browsing categorises it as social engineering, and VirusTotal records 14 of 95 scanned security vendors marking the domain as malicious. Gridinsoft assigns a trust score of 0 out of 100. The domain appears on a single security blocklist and has been actively blocked by PhishDestroy, reinforcing the high confidence that the site is being used for a crypto‑related scam.

The identified scam type is "Crypto Scam," and the domain is explicitly noted to impersonate Coinbase. While the HTTP status and blocklist presence confirm that the site is currently inaccessible, the underlying infrastructure—dedicated Cloudflare nameservers, a valid Google‑issued TLS certificate, and modern protocol support—demonstrates that the operators have access to reputable hosting services, which can be abused for future campaigns. Defenders should continue to monitor the domain and any subdomains that may be re‑activated, enforce content‑filtering rules for the "coinbase" keyword, and add the IP address 172.66.44.91 to network‑level blocklists.