learn-coinbase[.]pages[.]dev

The domain learn-coinbase.pages.dev was registered on February 21, 2026 through Cloudflare, Inc. and is currently taken offline. The site presented the page title "Suspected phishing site | Cloudflare" and advertised a crypto‑related scam, explicitly impersonating the Coinbase brand. Technical inspection shows the domain resolves to IP address 188.114.96.3, which belongs to AS13335 Cloudflare, Inc. in the United States. The hosting infrastructure uses Cloudflare services, including HSTS enforcement and HTTP/3 protocol support, and the TLS certificate is issued by Google Trust Services under the WE1 identifier.

DNS resolution is handled by the authoritative nameservers demi.ns.cloudflare.com and bradley.ns.cloudflare.com. An HTTP request to the domain returns a 403 status code, indicating access is denied. Reputation scoring from Gridinsoft assigns a trust score of 0 out of 100, reflecting a high confidence of malicious intent. VirusTotal analysis recorded 11 detections out of 93 scanned security vendors, confirming the domain’s malicious classification.

The domain appears on a single security blocklist and has been actively blocked by the PhishDestroy service. While the page content itself has not been examined, the combination of brand impersonation, crypto‑scam labeling, low trust score, multiple vendor detections, and active blocklist inclusion provides strong evidence of a credential‑stealing or asset‑exfiltration operation targeting Coinbase users. Defenders should continue to block the domain at network perimeters, update URL filtering policies, and monitor for any related infrastructure reuse, especially other subdomains under the pages.dev namespace that may leverage the same Cloudflare configuration.