coinbase-4fv[.]pages[.]dev

This domain, coinbase-4fv.pages.dev, was observed hosting a counterfeit Coinbase Wallet landing page titled “Coinbase Wallet - The Most Trusted Crypto Wallet”. The site was created on 21 February 2026 and is registered through Cloudflare, Inc., using the same provider for DNS and hosting. DNS resolution points to IP address 172.66.44.190, which belongs to AS13335, a Cloudflare network located in the United States. No TLS certificate is presented; HTTP connections are served without encryption. VirusTotal reports that 2 of 93 scanned security vendors flagged the domain, indicating that at least a minority of scanners recognize malicious behavior.

The domain appears on a single known security blocklist and has been listed as blocked by PhishDestroy, confirming active remediation by at least one anti‑phishing platform. The classified scam type is “Crypto Scam” and the domain explicitly impersonates the Coinbase brand. Current HTTP status is offline, suggesting the site has been taken down or is temporarily inaccessible. Because the hosting infrastructure resides on a cloud platform that can be rapidly re‑provisioned, the threat actor could redeploy the same payload on a different host or sub‑domain. The lack of an SSL certificate does not mitigate risk, as the malicious page can still capture credentials over plain HTTP.

Defenders should continue to block the hostname and the associated IP address in perimeter firewalls and DNS filtering solutions. Monitoring for new sub‑domains under the same Cloudflare account or for repeat patterns in page titles that reference Coinbase wallet terminology is recommended. Incident response teams should also review any internal logs for connections to 172.66.44.190 during the active window and consider user‑education messages warning that unsolicited requests claiming to be from Coinbase may appear under similar URLs.