build-coin-base-pro[.]pages[.]dev

The domain build-coin-base-pro.pages.dev was registered on February 21, 2026 through Cloudflare, Inc., and resolves to the Cloudflare address 172.66.47.18 located in the United States under ASN 13335. The site presented a TLS certificate issued by Google Trust Services (WE1), indicating a valid HTTPS connection, and employed HSTS, HTTP/3, and Cloudflare edge services. An HTTP request returned a 403 status code, and the page title reported as "Coinbase Pro Login | Official Guide for Safe Account Access," directly referencing the Coinbase brand.

The domain is cataloged as a crypto‑related scam and is flagged for impersonating Coinbase. Reputation data shows a Gridinsoft trust score of 0 out of 100 and placement on a single security blocklist. VirusTotal analysis recorded 12 of 95 scanning engines labeling the domain as malicious, and PhishDestroy has actively blocked it.

The domain is currently offline, but the infrastructure—Cloudflare hosting and a Google‑issued certificate—could be reused for future impersonation attempts. Defenders should continue to block the domain and associated IP address at perimeter filters, monitor for re‑registration or similar subdomains, and enforce brand‑specific URL filtering for any URLs containing "coinbase" or "coinbase pro". Ongoing threat‑intel feeds should be consulted for any resurgence, and incident response teams should treat any user reports of credential submission to this domain as compromised, prompting credential rotation and user awareness notifications.