get-coinbase-home[.]pages[.]dev

The domain get-coinbase-home.pages.dev was registered on February 21 2026 through Cloudflare, Inc. and resolves to the Cloudflare address 172.66.44.95 located in the United States under ASN 13335. The authoritative nameservers are sydney.ns.cloudflare.com and brian.ns.cloudflare.com. An SSL certificate issued by Google Trust Services (WE1) is present, and the site enforces HSTS while supporting HTTP/3. Access to the page returns HTTP 403 and the page title reported by crawlers is “Suspected phishing site | Cloudflare”. VirusTotal records show that 15 of 93 security vendors have flagged the domain as malicious.

Google Safe Browsing classifies it as a social‑engineering threat, and the domain appears on a single security blocklist and has been blocked by PhishDestroy. Reputation services assign extremely low scores: Gridinsoft 0/100 and Scamadviser 10/100. The site is labeled as a “Crypto Scam” and explicitly impersonates the Coinbase brand. The current operational status is offline, as indicated by the takedown notice. Analysis confirms that the infrastructure is typical of Cloudflare‑hosted impersonation campaigns, leveraging legitimate SSL issuance and CDN services to gain user trust.

The combination of multiple vendor detections, Google Safe Browsing flag, and the very low reputation scores indicates a high probability of malicious intent despite the temporary offline state. The exact content of the page beyond the title has not been captured, leaving the specific lure or credential‑collection mechanisms uncertain. Defenders should continue to block the IP address 172.66.44.95 and the fully qualified domain name, add the domain to internal URL filtering and DNS sinkhole lists, and monitor for any re‑registration or use of similar subdomains under the pages.dev namespace.