divace-learn-coinbase-procom[.]pages[.]dev

The domain divace-learn-coinbase-procom.pages.dev was registered on February 21, 2026 through Cloudflare, Inc. and is served by Cloudflare’s edge network (AS13335) from the IPv6 address 2606:4700:310c::ac42:2cc3 located in the United States. DNS resolution points to the Cloudflare nameservers pete.ns.cloudflare.com and paris.ns.cloudflare.com, and the site presents a Google Trust Services / WE1 SSL certificate, indicating a valid TLS chain but offering no guarantee of legitimacy. HTTP requests to the host return a 403 status code, and the page title returned by the server reads "Suspected phishing site | Cloudflare", reflecting that the content has been taken down by Cloudflare’s takedown mechanisms. The site employed modern web technologies including HSTS and HTTP/3, which are typical of legitimate sites but also aid malicious operators in evading certain detection techniques. Multiple security controls have flagged the domain.

Google Safe Browsing classifies it as social engineering, and the anti‑phishing service PhishDestroy has blocked it. The Gridinsoft trust score is 0 out of 100, indicating a highly suspicious reputation. VirusTotal analysis shows that 14 of 93 scanned security vendors flagged the domain, reinforcing the malicious assessment. The domain appears on one external blocklist, further confirming its abuse status. The only brand explicitly associated with the infrastructure is Coinbase, as indicated by the brand target field and the “Crypto Scam” classification, suggesting the attacker intended to lure cryptocurrency users.

No public evidence of the site’s visual content or specific phishing workflow is available beyond the page title and the fact that the site is currently offline. Consequently, defenders cannot describe the exact user‑experience or credential‑harvesting mechanisms that may have been employed.