hub-coinbase-prologs[.]pages[.]dev

On July 23, 2026, the domain hub-coinbase-prologs.pages.dev was confirmed to be a phishing site impersonating Coinbase. This domain was registered through Cloudflare, Inc. on February 21, 2026, and is currently offline. The page title indicates that the site was flagged as a suspected phishing site by Cloudflare. Analysis of the domain reveals a Gridinsoft trust score of 0/100 and a Scamadviser trust score of 10/100, both indicating a high level of risk. The domain resolves to the IPv6 address 2a06:98c1:3120::3, which is located in the United States and is part of the AS13335 Cloudflare, Inc. network.

The SSL certificate for the domain is issued by Google Trust Services under the WE1 web application. Technologies detected on the site include HSTS, Cloudflare, and HTTP/3, suggesting an attempt to appear legitimate and secure. The domain has been flagged by 12 of 93 security vendors on VirusTotal, and it appears on one security blocklist. PhishDestroy has blocked the domain.

The HTTP status code of 403 indicates that the site is currently inaccessible, likely due to being taken offline by the hosting provider or the security community. Defenders should monitor for any resurrection of the domain and ensure that users are aware of the risk to avoid falling victim to a crypto scam. The exact content and structure of the site have not been analyzed, but the evidence strongly suggests that it was designed to impersonate Coinbase and deceive users into divulging sensitive information. Given the elevated risk level and the specific targeting of a well-known cryptocurrency brand, organizations should update their threat intelligence databases and conduct user awareness training to mitigate the impact of such phishing attempts.