coibase-lon-en[.]pages[.]dev

On July 25, 2026, analysis of the domain coibase-lon-en.pages.dev indicates that the site was provisioned to impersonate Coinbase and was used in a crypto‑scam campaign. The domain was registered on February 21, 2026 through Cloudflare, Inc., and the authoritative nameservers are novalee.ns.cloudflare.com and langston.ns.cloudflare.com. DNS resolution points to the IP address 172.66.44.141, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. An HTTPS connection presents a certificate issued by Google Trust Services under the WE1 intermediate, confirming that TLS termination is performed by Cloudflare’s edge network.

When accessed, the server returns HTTP 403 and the page title “Suspected phishing site | Cloudflare”, indicating that Cloudflare’s automated protection has flagged the request. The site employs HSTS, HTTP/3, and Cloudflare’s security stack, which are typical of legitimate Cloudflare‑protected services but also commonly used by malicious actors to hide behind reputable infrastructure. Reputation checks show that six of ninety‑three VirusTotal scanners flagged the domain, and Gridinsoft assigned a trust score of 0 / 100, reflecting a high likelihood of malicious intent. The domain appears on one security blocklist and has been blocked by the PhishDestroy service.

The overall risk is classified as elevated, and the observed scam type is a crypto scam targeting Coinbase customers. No additional content, screenshots, or login forms have been captured, so the exact phishing payload remains unknown. Defenders should continue to block the domain at perimeter filters, monitor DNS queries for the associated IP and nameservers, and add the domain to internal deny lists. Given the Cloudflare hosting, any future re‑use of the same IP or nameserver pair should be treated with suspicion, and threat‑intel feeds should be updated with the observed indicators of compromise.