sso-coinbase-com[.]pages[.]dev

The domain sso-coinbase-com.pages.dev was registered through Cloudflare, Inc. on 21 February 2026 and is hosted on Cloudflare’s network (AS13335) with the IP address 172.66.44.203 located in the United States. DNS resolution points to the authoritative nameservers emerson.ns.cloudflare.com and jill.ns.cloudflare.com. The site serves an HTTP 403 response and presents the page title "Suspected phishing site | Cloudflare", indicating that Cloudflare’s automated takedown page is active. Security telemetry shows that 16 of 93 VirusTotal scanners have flagged the domain as malicious, and Google Safe Browsing classifies it as a social‑engineering threat.

PhishDestroy has already blocked the site, and it appears on one external blocklist. The SSL certificate is issued by Google Trust Services under the WE1 label, confirming the use of a valid TLS certificate despite the malicious intent. Gridinsoft assigns a trust score of 0 / 100, and the overall risk rating is high. The domain is explicitly linked to a crypto‑scam campaign that impersonates the Coinbase brand, as reflected in the "Brand target: Coinbase" field.

Current observations indicate the domain is offline, but the infrastructure – Cloudflare hosting, the specific nameservers, and the low trust score – remains reusable for future impersonation attempts. Defenders should continue to block the domain at network perimeter filters, add the IP address 172.66.44.203 to deny lists, and monitor for any re‑registration of similar subdomains under the pages.dev namespace. Continuous vigilance is advised for any new domains that resolve to the same Cloudflare edge IPs or that use the same nameserver pair, as adversaries frequently recycle these assets for brand‑targeted crypto scams.