coinbase-hack-c2a[.]pages[.]dev

The domain coinbase-hack-c2a.pages.dev was observed by multiple infrastructure sensors and is currently listed as offline. Registration records show creation on 14 Mar 2026 through Cloudflare, Inc., with authoritative nameservers kianchau.ns.cloudflare.com and stella.ns.cloudflare.com. DNS resolution points to 172.66.44.217, an IP owned by AS13335 (Cloudflare) located in the United States. The host presents an SSL certificate issued by SSL Corporation under the Cloudflare TLS Issuing ECC CA 3 chain, and the site enforces HTTP Strict Transport Security and HTTP/3.

An HTTP GET returns a 403 status code, and the page title reported by scanners is “frontend”. VirusTotal’s latest scan recorded a single positive detection out of 94 scanners, and three independent blocklists (PhishDestroy, MetaMask, SEAL) have already added the domain. Gridinsoft assigned a trust score of 0 / 100, indicating a high likelihood of malicious intent. The site is classified as a wallet/seed phishing operation targeting the Coinbase brand, consistent with the observed branding in the intelligence feed.

Because the infrastructure is hosted on a shared Cloudflare edge, the same IP address may serve unrelated legitimate traffic, making IP‑based blocking unreliable; instead, defenders should block the fully qualified domain name at DNS or proxy layers and monitor for any future re‑registration of the sub‑domain pattern “coinbase‑hack‑*.pages.dev”. Users of Coinbase should be warned not to enter private keys, seed phrases, or login credentials on any page that presents the “frontend” title or mimics Coinbase services. Continuous threat‑intel feeds should be consulted for re‑appearance of the domain or related indicator sets, and any internal security tooling that flags the single VirusTotal positive should treat the domain as malicious given the corroborating blocklist entries and the zero trust score.