view-conbase-chrome[.]pages[.]dev

Analysis of the domain view-conbase-chrome.pages.dev indicates it was a phishing site impersonating the Coinbase brand, active under Cloudflare hosting. The domain was registered on February 21, 2026, and resolved to IP 172.66.44.78, part of Cloudflare's network (AS13335). As of July 25, 2026, the domain returns an HTTP 403 status, with Cloudflare serving a page titled 'Suspected phishing site | Cloudflare,' confirming its classification as malicious. Security vendors flagged the domain on one blocklist, and 11 of 93 engines on VirusTotal detected it as malicious.

The SSL certificate, issued by Google Trust Services (WE1), remains valid, though this does not mitigate the threat. Infrastructure analysis reveals the use of Cloudflare nameservers (jerome.ns.cloudflare.com, addilyn.ns.cloudflare.com) and technologies such as HSTS and HTTP/3, common in both legitimate and malicious sites. The domain was explicitly blocked by PhishDestroy, which classified it as a brand impersonation scam targeting Coinbase.

No evidence of a specific phishing kit or payload delivery was provided, and the exact content of the site remains unanalyzed. Defenders should treat this domain as compromised and ensure it is blocked at the network level, particularly in environments where Coinbase is used. The domain's current offline status reduces immediate risk, but historical logs should be reviewed for connections to 172.66.44.78 or the domain itself.