com-coinbase-home[.]pages[.]dev

The domain com-coinbase-home.pages.dev was created on February 21, 2026 and is currently taken offline. It resolves to the IP address 172.66.44.110, which belongs to AS13335 Cloudflare, Inc. in the United States. Registration was performed through Cloudflare, Inc., and the site is protected by Cloudflare’s SSL certificate issued by Google Trust Services (WE1). An HTTPS request returns HTTP 403, and the page title displayed by Cloudflare reads “Suspected phishing site | Cloudflare,” indicating that the content has been blocked. Infrastructure analysis shows the use of HSTS and HTTP/3, both typical of Cloudflare‑enabled services.

Threat intelligence shows the domain is listed on a single security blocklist and has been actively blocked by PhishDestroy. VirusTotal records indicate that 13 of 93 scanning vendors flagged the domain, while Google Safe Browsing classifies it as a social‑engineering threat. Independent trust‑rating services assign extremely low scores: Gridinsoft reports a 0 / 100 trust score and Scamadviser a 10 / 100 score. The site is categorized as a crypto‑related scam that impersonates the Coinbase brand.

The available evidence confirms that the domain was used for brand impersonation targeting Coinbase users, but no publicly available payload or phishing page samples have been disclosed, leaving the exact delivery mechanism uncertain. Defenders should ensure that the IP address 172.66.44.110 is blocked at network perimeters, add the fully qualified domain name to URL filtering and threat intelligence feeds, and monitor Cloudflare‑associated AS13335 for any re‑registration attempts. Updating intrusion‑detection signatures to flag HTTP 403 responses from this host and incorporating the Google Safe Browsing social‑engineering indicator will help mitigate potential re‑use. Continuous review of blocklist status and VirusTotal detections is recommended to capture any future activity associated with this domain.