web-coinbase-pro-in[.]pages[.]dev

The domain web-coinbase-pro-in.pages.dev was registered on February 21, 2026 through Cloudflare, Inc. and is hosted on Cloudflare’s network (AS13335) at IP address 188.114.96.3, which resolves to a United States location. The authoritative nameservers are lara.ns.cloudflare.com and cody.ns.cloudflare.com, confirming the use of Cloudflare’s DNS service. The site presents the page title "Suspected phishing site | Cloudflare" and serves an SSL certificate issued by Google Trust Services under the WE1 identifier, indicating a valid TLS layer but not mitigating the underlying abuse. HTTP responses return a 403 status code, suggesting that the resource is currently inaccessible, and the domain has been taken offline.

Security telemetry shows that the domain is listed on a single blocklist and has been blocked by PhishDestroy. Google Safe Browsing flags the domain for social engineering, and VirusTotal reports that 12 of 93 scanning engines label the domain as malicious. Additional heuristics assign a Gridinsoft trust score of 0 out of 100, reinforcing the high‑risk assessment. The observed technology stack includes HTTP/3, HSTS, and Cloudflare services, all typical of legitimate sites but also commonly leveraged by threat actors to gain trust.

The site explicitly impersonates the cryptocurrency exchange Coinbase and is categorized as a crypto‑related scam. While the current offline status limits immediate interaction, defenders should continue to monitor the IP address and associated Cloudflare account for any re‑activation, block the domain at perimeter defenses, and update phishing detection signatures. Organizations that use Coinbase services should educate users about the existence of this impersonation attempt and enforce multi‑factor authentication to mitigate credential harvesting risk.