access-un-us-coinbase[.]pages[.]dev

The domain access-un-us-coinbase.pages.dev was registered through Cloudflare, Inc. on February 21, 2026 and resolves to the IP address 172.66.44.126, which belongs to AS13335 Cloudflare, Inc. in the United States. DNS resolution is handled by becky.ns.cloudflare.com and frank.ns.cloudflare.com, confirming that the domain is hosted on Cloudflare’s edge network. The site presents a page title of “Suspected phishing site | Cloudflare” and returns an HTTP 403 status code, indicating that the server is actively denying client requests. TLS termination is performed by a Google Trust Services certificate (WE1), and the connection employs HSTS and HTTP/3, consistent with modern Cloudflare deployments.

Security assessments show a Gridinsoft trust score of 0 out of 100, and the domain is listed on one security blocklist. PhishDestroy has taken the domain offline, and the current status is reported as offline. VirusTotal analysis recorded 16 detections out of 93 scanning engines, while Google Safe Browsing flags the site for social engineering, reinforcing the classification of a crypto‑related scam. The brand target is explicitly identified as Coinbase, and the scam type is recorded as a crypto scam, confirming that the domain is being used to impersonate the cryptocurrency exchange.

Open questions remain regarding the specific payload or credential‑harvesting mechanisms employed, as no visual or content analysis is available beyond the page title. Defenders should treat the domain as hostile, enforce blocklisting at network perimeters, and monitor related Cloudflare‑hosted subdomains for similar naming patterns. Continuous re‑evaluation of the domain’s status is advised, as offline takedown actions may be temporary. Indicators such as the IP address, nameserver set, SSL certificate issuer, and the observed trust score provide reliable artifacts for detection and correlation with threat‑intel feeds.