wihome[.]pages[.]dev

Analysis of wihome.pages.dev shows a high‑risk brand‑impersonation campaign targeting Coinbase. The domain was registered on February 21, 2026 through Cloudflare, Inc., and its authoritative nameservers are adi.ns.cloudflare.com, bryce.ns.cloudflare.com, karl.ns.cloudflare.com, and tara.ns.cloudflare.com. The site resolves to IP 172.66.44.136, which belongs to AS13335 Cloudflare, Inc. in the United States, indicating the use of Cloudflare’s edge network for hosting. No TLS certificate is presented, and the service is currently offline, which aligns with the reported status of being taken down.

The page title observed in the limited crawl data is "Coinbase Wallet," directly referencing the Coinbase brand and confirming the impersonation intent. The domain appears on four security blocklists, including PhishDestroy, MetaMask, ScamSniffer, and SEAL, and 17 of 93 VirusTotal scanners flagged it as malicious, reinforcing the assessment of a crypto‑related scam. The listed scam type is "Crypto Scam," consistent with the brand‑focused page title.

While the infrastructure details are concrete, the exact payload or user‑interaction flow has not been captured, leaving the specifics of the phishing or credential‑harvesting mechanism uncertain. Defenders should continue to block the domain at network perimeters, monitor for any resurgence of the host, and update threat‑intel feeds with the observed indicators: domain name, registration date, nameserver set, IP address, lack of SSL, and the blocklist entries. Organizations that use Coinbase services should educate users about the absence of a valid TLS certificate and the likelihood of fraudulent activity associated with this domain.