887f4f5c[.]lkjddhd[.]pages[.]dev

Analysis of 887f4f5c.lkjddhd.pages.dev indicates a high‑risk crypto‑related impersonation campaign targeting Coinbase users. The site presented the page title “Download Coinbase Wallet - Official Website,” explicitly referencing Coinbase and suggesting a malicious wallet download. Technical probing returned HTTP status code 403, confirming that the server denied access at the time of observation, which aligns with the reported offline status and the block applied by PhishDestroy. The domain resolves to IP address 172.66.45.14, owned by AS13335 Cloudflare, Inc. in the United States, and is served behind Cloudflare’s infrastructure, as reflected by the nameservers adi.ns.cloudflare.com and karl.ns.cloudflare.com and the presence of HSTS and HTTP/3.

The SSL certificate is issued by Google Trust Services under the WE1 identifier, providing a valid TLS connection but offering no assurance of legitimacy. Google Safe Browsing flags the domain for social engineering, and VirusTotal records 16 of 93 security vendors marking the host as malicious, reinforcing the suspicion of a crypto scam. Gridinsoft assigned a trust score of 0 / 100, and the domain appears on a single security blocklist, further evidencing malicious intent.

Registration data shows the domain was created on September 02 2020 through Cloudflare, Inc., suggesting the attacker leveraged the provider’s privacy‑protective services. While the exact phishing payload, such as credential‑stealing forms or malware, has not been captured due to the site’s offline state, the combination of brand impersonation, malicious page title, and multiple vendor detections confirms a credible threat.