cdn-signin-coinbase[.]pages[.]dev

Analysis of cdn-signin-coinbase.pages.dev shows a recently registered domain (created 21 Feb 2026) that resolves to Cloudflare IP 172.66.47.131 within ASN 13335. The domain is hosted on Cloudflare infrastructure, as indicated by the presence of HSTS, HTTP/3 support and the nameservers vivienne.ns.cloudflare.com and lee.ns.cloudflare.com. The TLS certificate is issued by Google Trust Services under the WE1 label, confirming a valid HTTPS endpoint despite the malicious purpose. The site returned HTTP 403 at the time of observation, and the page title returned by the server is “Suspected phishing site | Cloudflare”, which is a generic Cloudflare warning page rather than a custom login interface.

Multiple threat intelligence sources flag the domain as a crypto‑related brand impersonation targeting Coinbase users. Google Safe Browsing classifies the URL as a social‑engineering threat, and VirusTotal reports 13 of 95 scanning engines marking the domain as malicious. The Gridinsoft trust score is 0/100, and the domain appears on three public blocklists, including PhishDestroy, MetaMask, and SEAL, all of which have actively blocked the address. The listed scam type is “Crypto Scam”, reinforcing the hypothesis that the domain is used to harvest credentials or funds related to Coinbase accounts.

The evidence collectively indicates a high‑risk credential‑ harvesting operation that leverages the credibility of Cloudflare’s CDN to host a counterfeit signin endpoint. The domain is currently offline (HTTP 403) but may be reactivated. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any resurgence, and add the IP address 172.66.47.131 to deny‑list rules for services handling cryptocurrency transactions. Security teams should also update user‑facing alerts to reference this specific domain and the associated impersonation of Coinbase, and consider sharing the indicator set with threat‑sharing platforms to improve collective detection.