en-browser-coinbase[.]pages[.]dev

On July 23 2026, the domain en-browser-coinbase.pages.dev was observed targeting Coinbase users through a crypto‑scam impersonation campaign. The site resolves to the Cloudflare‑owned IP address 188.114.97.3, which is announced as belonging to AS13335 Cloudflare, Inc. in the United States. The domain was registered on February 21 2026 via Cloudflare, Inc., and uses the Cloudflare‑provided nameservers alan.ns.cloudflare.com and alice.ns.cloudflare.com. TLS is delivered by the Cloudflare TLS Issuing ECC CA 3 chain issued to “SSL Corporation / Cloudflare,” and the service enforces HSTS and HTTP/3, indicating a modern Cloudflare edge configuration. An HTTP request to the root URL returns a 403 status code and the page title “Suspected phishing site | Cloudflare,” confirming that the content has been taken offline or blocked.

The domain is listed on a single security blocklist and is actively blocked by PhishDestroy. Google Safe Browsing classifies the site as a social‑engineering threat. VirusTotal analysis shows that 14 of 93 antivirus and URL scanning engines flagged the domain as malicious, reinforcing the malicious classification. The Gridinsoft trust score of 0 / 100 reflects a complete lack of confidence in the site’s legitimacy. The observed indicators collectively describe a high‑risk, brand‑impersonation infrastructure targeting cryptocurrency users.

Uncertainties remain regarding the exact phishing kit or payload served before takedown, as no visual or content analysis is available beyond the generic Cloudflare title. Defensive teams should continue to block the domain at network perimeter devices, update URL filtering and DNS sinkhole lists, and monitor the associated IP address for any future re‑use. Additional telemetry from endpoint detection platforms should be correlated with the 14 VirusTotal detections to identify potential compromise attempts.