app-coinbase-login[.]pages[.]dev

Analysis of app-coinbase-login.pages.dev shows a high‑risk brand‑impersonation campaign targeting Coinbase users. The domain was registered on February 21, 2026 through Cloudflare, Inc., and it resolves to the Cloudflare‑owned address 188.114.97.3 (AS13335, United States). The site presently returns HTTP 403, and its page title is "Suspected phishing site | Cloudflare," indicating that the host has flagged the content as malicious. Google Trust Services issued the TLS certificate (WE1), while the connection is protected by HSTS and served over HTTP/3 via Cloudflare infrastructure.

Google Safe Browsing classifies the site under social engineering, and VirusTotal records 14 detections out of 93 scanning engines, confirming a consensus of malicious intent. The domain appears on one public blocklist and is actively blocked by PhishDestroy, further evidencing its status as a phishing vector. Gridinsoft assigns a trust score of 0 out of 100, reinforcing the conclusion that the site is unsafe. The listed scam type is "Crypto Scam," and the brand target is explicitly Coinbase, matching the domain’s naming pattern.

Uncertainty remains regarding any active payload or credential‑stealing mechanisms, as no page content has been captured beyond the title. Defenders should immediately add the domain and its associated IP address to blocklists, enforce outbound filtering for connections to 188.114.97.3, and monitor for similar Cloudflare‑hosted subdomains that mimic Coinbase branding. Continuous scanning with multi‑engine services is recommended to capture any future changes, and any alerts triggered by Google Safe Browsing or similar feeds should be treated as high priority.