name-coinbase-com-sso[.]pages[.]dev

Analysis of the domain name-coinbase-com-sso.pages.dev shows a high‑risk brand‑impersonation campaign targeting Coinbase users. The site was registered on February 21, 2026 through Cloudflare, Inc., and the authoritative nameservers are jeremy.ns.cloudflare.com and izabella.ns.cloudflare.com, both pointing to the Cloudflare network (AS13335) with the IP address 172.66.44.111 located in the United States. The TLS certificate is issued by Google Trust Services under the WE1 root, indicating a legitimate‑looking HTTPS connection, but the page title returned by the server is "Suspected phishing site | Cloudflare" and the HTTP response code is 403, suggesting that the content has been taken down or blocked.

The domain is listed on one security blocklist and has been blocked by PhishDestroy. Google Safe Browsing flags the site for social engineering, and VirusTotal reports that 12 of 93 security vendors have flagged the domain as malicious. The Gridinsoft trust score of 0 / 100 further underscores its malicious nature.

The site is classified as a crypto scam, specifically impersonating Coinbase, and appears in reports as a brand‑impersonation threat. Defenders should immediately add the domain to internal blocklists, monitor DNS queries for the associated IP and nameservers, and enforce URL filtering to prevent user access. Continuous observation of any re‑registration attempts or new sub‑domains under the same Cloudflare account is advised, as the infrastructure could be reused for future campaigns.