coinbaselogin-cloud[.]pages[.]dev

The domain coinbaselogin-cloud.pages.dev was registered on February 21, 2026 through Cloudflare, Inc. and resolves to the IPv6 address 2a06:98c1:3120::3, which is announced by AS13335 Cloudflare, Inc. in the United States. The site presented the page title "Suspected phishing site | Cloudflare" and was identified as a crypto‑related scam that impersonates the Coinbase brand. Analysis of public reputation services shows a Gridinsoft trust score of 0 / 100 and a Scamadviser rating of 1 / 100, indicating extreme distrust. The SSL certificate is issued by Google Trust Services under the WE1 designation, confirming the use of a valid TLS certificate despite the malicious intent.

HTTP response headers reported a 403 status code before the site was taken offline. Security vendor visibility includes 15 of 93 VirusTotal scanners flagging the domain, and Google Safe Browsing classifies it as social engineering. The domain appears on a single blocklist, specifically PhishDestroy, confirming that at least one anti‑phishing service has added it to its watchlist. Detected technologies include HSTS, Cloudflare services, and HTTP/3, all consistent with the hosting provider.

While the page content has not been publicly released, the combination of brand impersonation, low trust scores, and multiple vendor detections strongly suggests a credential‑harvesting or crypto‑drain operation targeting Coinbase users. Defenders should block the domain at perimeter firewalls, update URL filtering feeds with the observed indicators, and monitor for related traffic to the associated IPv6 address. Incident response teams should also consider scanning for any credential submissions that may have been captured before the domain was taken offline, and advise users to verify authentic Coinbase URLs before entering login information.