coinbase-355[.]pages[.]dev

Analysis as of July 23 2026 indicates that the domain coinbase-355.pages.dev is actively hosting a malicious page that mimics Coinbase support channels. The domain was registered on February 21 2026 via Cloudflare, Inc. and resolves to the IP address 172.66.47.7, which belongs to AS13335 (Cloudflare) located in the United States. No TLS certificate is presented, meaning the site is served over plain HTTP. The page title returned by the server is “Get Help with Your Coinbase Account - 24/7 Support”, confirming a direct attempt to impersonate Coinbase’s customer‑service brand.

Google Safe Browsing classifies the URL as a social‑engineering threat, and the domain is listed on one public security blocklist. VirusTotal reports that 12 of 95 scanning engines flag the domain as malicious, and the feed from PhishDestroy has already blocked it. The overall risk assessment is high, and the site is currently offline, likely after takedown actions. Evidence points to a crypto‑scam campaign that leverages brand impersonation to lure victims into disclosing credentials or sending cryptocurrency.

However, the exact payload, credential‑harvesting mechanism, and any downstream command‑and‑control infrastructure remain unknown because the site is no longer reachable for deeper inspection. Defenders should continue to monitor the IP address 172.66.47.7 for any future reuse, enforce outbound filtering for the domain name and its parent zone pages.dev, and ensure that users are educated about unsolicited support requests referencing Coinbase. Adding the domain to internal blocklists and sharing the indicators of compromise with threat‑intel sharing platforms will help prevent re‑use. Ongoing observation of Cloudflare‑hosted assets targeting the Coinbase brand is recommended.