coinbaecom-wallet-learn[.]pages[.]dev

Analysis of the domain coinbaecom-wallet-learn.pages.dev indicates it was a high-risk phishing infrastructure impersonating Coinbase, specifically targeting cryptocurrency wallet users. The domain, registered on February 21, 2026, through Cloudflare, Inc., resolved to IP 172.66.47.127 (AS13335, Cloudflare, Inc., US) and was hosted on Cloudflare Pages. The page title, 'Coinbase Wallet Extension | Secure Crypto Access,' directly aligns with the identified scam type: wallet/seed phishing, as noted in the available intelligence. Google Safe Browsing flagged the domain for social engineering, and it appeared on at least one security blocklist, including PhishDestroy.

As of July 24, 2026, the domain returned an HTTP 403 status, suggesting it was taken offline or restricted. Twelve of 93 security vendors on VirusTotal detected the domain as malicious, reinforcing its classification as a confirmed phishing site. The SSL certificate, issued by Google Trust Services (WE1), and observed technologies such as HSTS and HTTP/3, are consistent with infrastructure used to lend legitimacy to phishing operations. No evidence confirms whether the domain successfully harvested credentials or seed phrases, but its alignment with known wallet phishing tactics and the use of Cloudflare’s infrastructure to obscure hosting details are notable.

Defenders should treat this domain as part of a broader campaign targeting Coinbase users and prioritize blocking it at the DNS and proxy levels. The domain’s nameservers, pete.ns.cloudflare.com and nora.ns.cloudflare.com, may also warrant monitoring for related activity. Given its current offline status, further analysis of historical captures or related domains may provide additional context.