digit-coinbase--xtnsonn[.]pages[.]dev

The domain digit-coinbase--xtnsonn.pages.dev was registered on 21 February 2026 through Cloudflare, Inc. The authoritative nameservers quinton.ns.cloudflare.com and meera.ns.cloudflare.com resolve the domain to the Cloudflare edge address 172.66.44.194, which is announced by AS13335 (Cloudflare, Inc.) and geolocated to the United States. The site is protected by a Google Trust Services certificate (WE1) and serves over HTTPS with HSTS and HTTP/3 enabled. An HTTP GET returns a 403 status code and the page title reported by crawlers is “Suspected phishing site | Cloudflare”, indicating that Cloudflare’s automated abuse page is being displayed. Threat intelligence aggregators have flagged the domain.

Fourteen of ninety‑five VirusTotal scanners raise an alert, Google Safe Browsing classifies the URL as a social‑engineering threat, and Gridinsoft assigns a trust score of zero out of one hundred. The domain appears on a single public blocklist and is actively blocked by the PhishDestroy feed. The observed scam type is listed as “Crypto Scam” and the brand target is identified as Coinbase, suggesting that the infrastructure is intended to lure victims into credential or wallet‑key harvesting attempts against the cryptocurrency exchange. Current evidence does not reveal the underlying phishing kit, content of the landing page, or any observed credential‑submission endpoints, as the site is presently offline.

Analysts should therefore monitor the domain for any re‑activation, continue to enforce blocklist updates, and consider adding the IP address 172.66.44.194 to network‑level deny lists. Correlation with other Cloudflare‑hosted phishing infrastructure that shares the same nameserver pattern may uncover additional campaigns. Defenders are advised to keep endpoint protection signatures up‑to‑date, enforce multi‑factor authentication for Coinbase accounts, and educate users about the presence of a Cloudflare‑generated “Suspected phishing site” warning page.