coinbase-login-now[.]pages[.]dev

Analysis indicates that the domain coinbase-login-now.pages.dev was registered on 21 February 2026 through Cloudflare, Inc. and resolves to the Cloudflare address 188.114.97.3, which belongs to AS13335 in the United States. The site presents the page title “Suspected phishing site | Cloudflare”, and Google Safe Browsing classifies it as social engineering. The domain is explicitly listed as impersonating the Coinbase brand and is categorized as a crypto‑scam. Security reputation services assign extremely low trust scores: Scamadviser rates it 1/100, Gridinsoft 0/100, and it appears on one public blocklist.

VirusTotal reports that 15 of 93 scanned scanners flag the domain, confirming malicious intent. The HTTP response is 403, the TLS certificate is issued by Google Trust Services under the WE1 name, and the host advertises HSTS, Cloudflare protection and HTTP/3. PhishDestroy has taken the domain offline and the current status is reported as offline. Evidence does not include a content snapshot beyond the page title, so the exact payload or credential‑harvesting mechanisms remain unverified.

Nevertheless, the convergence of brand impersonation, low trust scores, multiple vendor detections, and active blocklisting constitutes a high‑risk indicator. Defenders should immediately block coinbase‑login‑now.pages.dev at network and DNS layers, add it to internal phishing and malicious‑domain feeds, and monitor for any resurgence on other Cloudflare‑hosted subdomains. Continuous re‑scanning of the IP address 188.114.97.3 is recommended, as Cloudflare hosting can be reused for future threats. Organizations that use Coinbase services should alert users to the impersonation attempt and enforce multi‑factor authentication to mitigate credential compromise.