coin-com-base[.]pages[.]dev

This domain, coin-com-base.pages.dev, was created on 21 February 2026 and is currently taken offline. The site is hosted on Cloudflare infrastructure, as indicated by the registrar entry (Cloudflare, Inc.) and the authoritative name servers lady.ns.cloudflare.com and jakub.ns.cloudflare.com. DNS resolution points to IP address 188.114.97.3, which is allocated to Cloudflare in Canada. The HTTP response returned a 403 status code, and the page title reported by the server is “Suspected phishing site | Cloudflare”.

Security telemetry shows that Google Safe Browsing classifies the domain as a social‑engineering threat, and the site appears on a single blocklist, PhishDestroy. VirusTotal analysis records 16 of 93 scanning engines flagging the domain, reinforcing the malicious classification. Reputation services assign extremely low trust scores, with Scamadviser rating the domain 1 out of 100 and Gridinsoft rating it 0 out of 100. Detected technologies include HSTS and Cloudflare’s edge services, which are typical for domains used in credential‑ harvesting campaigns.

The threat type is identified as brand impersonation targeting Coinbase, confirming that the adversary aims to deceive users into believing the site is affiliated with the cryptocurrency exchange. While the site is no longer reachable, the observed indicators—IP address, name servers, registration details, detection counts, and low trust scores—should be added to internal blocklists and security information and event management (SIEM) correlation rules. Defenders are advised to monitor outbound traffic for connections to 188.114.97.3 and to update web filtering policies to deny any HTTP or HTTPS requests to coin-com-base.pages.dev. Continuous threat‑intel feeds should be consulted for potential re‑use of the same infrastructure in future campaigns.