coinbase-support-8uc[.]pages[.]dev

The domain coinbase-support-8uc.pages.dev was registered on 30 November 2025 through Cloudflare, Inc. and resolves to the IP address 172.66.44.77, which belongs to AS13335 Cloudflare, Inc. in the United States. The site presents the page title “Suspected phishing site | Cloudflare” and is classified as a crypto‑scam that impersonates the Coinbase brand. No TLS certificate is observed, indicating the service is delivered over plain HTTP. Reputation services show a uniformly low trust rating: Gridinsoft assigned a score of 0 out of 100, and Google Safe Browsing flags the domain for social‑engineering content. On VirusTotal, 16 of 95 antivirus and URL‑reputation engines flagged the domain as malicious.

The domain appears on a single security blocklist and is listed as blocked by the PhishDestroy feed. Nameservers carlane.ns.cloudflare.com and justin.ns.cloudflare.com are the default Cloudflare entries. The current operational status is offline, and the site has been taken down. Analysis confirms that the infrastructure is typical of brand‑impersonation campaigns that leverage Cloudflare’s free hosting to hide the true origin of the content. The lack of an SSL certificate, combined with the low trust score and multiple vendor detections, suggests the site was intended to lure Coinbase users into a credential‑stealing or crypto‑transfer scheme, although the exact payload has not been captured.

Because the domain is already offline, immediate impact appears limited, but the use of the same Cloudflare‑owned IP range and naming pattern may reappear in future campaigns. Defenders should add 172.66.44.77 to network blocklists, enforce DNS filtering for the fully qualified domain, and monitor for newly registered subdomains under pages.dev that contain “coinbase‑support” or similar brand keywords. Continuous ingestion of feeds that reported this domain, such as PhishDestroy and Google Safe Browsing, will help surface repeat offenders.