secure-get-coinbase[.]pages[.]dev

This domain is flagged with a high-risk level due to its brand impersonation threat type targeting Coinbase. Brand impersonation is a critical concern, designed to trick users into sharing sensitive information under the guise of a trusted entity.

Infrastructure analysis reveals several key indicators associated with this malicious domain. Secure-get-coinbase.pages.dev was registered through Cloudflare, Inc., leveraging a Google Trust Services SSL certificate. The domain resolves to IP address 188.114.96.3 located in the US under AS13335, also associated with Cloudflare, Inc. VirusTotal reports that 15 out of 95 security vendors have flagged the domain as suspicious, indicating a significant detection rate. Furthermore, the domain appears on one security blocklist and has been blocked by PhishDestroy. The domain was created on February 21, 2026, yet is currently offline.

To mitigate risks of brand impersonation threats such as secure-get-coinbase.pages.dev, users are advised to verify the legitimacy of URLs before interacting with online resources, particularly those requesting personal or financial information. Security teams should ensure that such domains are blocked across all networks and systems to prevent potential exposure and that relevant browser extensions, like anti-phishing tools, are deployed for real-time protection.