divace-eng-coinbasecomsign[.]pages[.]dev

Analysis of the domain divace-eng-coinbasecomsign.pages.dev indicates that it is being used for a brand impersonation campaign targeting Coinbase users. The site was created on February 21, 2026 and is registered through Cloudflare, Inc. When accessed, the server returns an HTTP 403 status code and presents the page title "Suspected phishing site | Cloudflare," confirming that the content has been flagged by Cloudflare's protective mechanisms. The domain resolves to the IP address 172.66.44.123, which belongs to AS13335 owned by Cloudflare, Inc., and is geolocated to the United States. The SSL certificate presented is issued by Google Trust Services under the WE1 identifier, and the site employs HSTS, Cloudflare services, and HTTP/3.

Reputation checks show a Gridinsoft trust score of 0 out of 100, and the domain appears on one security blocklist. VirusTotal reports that 13 of 93 scanning vendors have flagged the domain as malicious, reinforcing the suspicion of malicious activity. PhishDestroy has actively taken the domain offline, and the current status is reported as offline. Nameservers rita.ns.cloudflare.com and jerome.ns.cloudflare.com are associated with the domain, consistent with its Cloudflare registration.

While the exact page content has not been publicly disclosed, the combination of brand impersonation, the "Crypto Scam" classification, and the multiple security detections suggests a high likelihood of credential harvesting or financial fraud aimed at Coinbase users. Defenders should block the domain at network perimeter and update any URL filtering lists to include it. Continuous monitoring of Cloudflare‑hosted infrastructure for similar naming patterns is advised, and organizations should educate users about unexpected Coinbase‑related communications that reference unfamiliar URLs.