welcome-secure-pro-coinbase[.]pages[.]dev

Analysis of the domain welcome-secure-pro-coinbase.pages.dev indicates a verified cryptocurrency‑related impersonation campaign targeting Coinbase. The domain was registered on February 21 2026 through Cloudflare, Inc., and the authoritative nameservers lorna.ns.cloudflare.com and reese.ns.cloudflare.com resolve the zone to the IP address 188.114.97.3, which is hosted within AS13335 (Cloudflare, Inc.) in the United States. The site presented the page title "Suspected phishing site | Cloudflare" and responded with an HTTP 403 status, suggesting that the hosting provider has taken the content offline.

TLS termination is provided by a Google Trust Services certificate identified as WE1, and the site employed HSTS and HTTP/3, consistent with Cloudflare’s standard security stack. Reputation data shows that 11 of 93 VirusTotal scanners flagged the domain as malicious, and the Gridinsoft trust score was recorded as 0 / 100, indicating a high confidence of malicious intent. The domain appears on a single external blocklist and has been explicitly blocked by the PhishDestroy service.

The observed characteristics align with the declared scam type of a crypto scam and the stated impersonation of the Coinbase brand. While the site is currently inactive, the infrastructure—particularly the use of Cloudflare’s free hosting, the low trust score, and the multi‑vendor detection—suggests a repeatable template that could be reused under different subdomains. Defensive teams should continue to monitor the IP 188.114.97.3 and associated Cloudflare ranges for similar patterns, enforce blocklist updates for the domain and its nameservers, and advise end users to disregard any unsolicited communications referencing Coinbase that direct recipients to pages hosted on the pages.dev subdomain space.