coinbase-service-help[.]pages[.]dev

Analysis of coinbase-service-help.pages.dev was performed on July 23, 2026. The domain is currently offline and has been taken down by the PhishDestroy takedown service. It was created on February 21, 2026 and is registered through Cloudflare, Inc. with the authoritative nameservers matteo.ns.cloudflare.com and aria.ns.cloudflare.com. DNS resolution points to 172.66.47.120, an address owned by AS13335 Cloudflare, Inc. and located in the United States. The TLS certificate presented is issued by Google Trust Services under the WE1 root, indicating a valid HTTPS endpoint despite the malicious intent.

An HTTP request to the site returns a 403 status code, and the page title returned by the server is “Suspected phishing site | Cloudflare”, which aligns with the classification of a crypto‑related phishing campaign. Google Safe Browsing flags the domain for social engineering, and the site appears on one security blocklist. VirusTotal scans show that 14 of 93 security vendors have flagged the domain, reinforcing the malicious assessment. Gridinsoft assigns a trust score of 0 out of 100, reflecting extreme risk.

The domain is explicitly identified as impersonating the Coinbase brand and is categorized as a crypto scam. No additional intelligence such as payload samples or C2 infrastructure has been disclosed, leaving the exact phishing workflow unknown. Defenders should continue to block the domain at perimeter and DNS layers, update intrusion‑prevention signatures to include the observed IP address and certificate fingerprint, and monitor for any reuse of the Cloudflare nameservers or the 172.66.47.120 address in future campaigns. Incident response teams should also advise users to verify any unsolicited Coinbase communications and to report any credential submissions to the official Coinbase support channels.