go-with-coenbase-logen[.]pages[.]dev

Analysis indicates that the domain go-with-coenbase-logen.pages.dev was registered on 21 February 2026 through Cloudflare, Inc. and resolves to the IP address 188.114.97.3, which belongs to AS13335 Cloudflare, Inc. in the United States. The host presents an HTTPS certificate issued by Google Trust Services under the WE1 label, and the server advertises HSTS, Cloudflare protection, and HTTP/3. The page title returned by the server is "Suspected phishing site | Cloudflare" and the HTTP response code is 403, consistent with an offline or takedown state. Google Safe Browsing classifies the URL as a social-engineering threat, and the Gridinsoft trust score is 0/100, reinforcing the malicious rating.

The scam type is identified as Brand Impersonation, though the specific brand is not disclosed in the supplied metadata. VirusTotal records show that 13 of 93 scanning engines flagged the domain, and the site appears on one external security blocklist, with PhishDestroy confirming the block. The nameservers ziggy.ns.cloudflare.com and toby.ns.cloudflare.com are typical of Cloudflare‑hosted domains and do not provide additional attribution. Current evidence confirms a high-risk classification and that the site has been taken offline as of the report date.

Uncertainty remains regarding the exact phishing payload, target brand, and any active command-and-control infrastructure because no content-level analysis is available. Defenders should continue to block the domain at perimeter filters, monitor DNS queries for the IP 188.114.97.3, and add the URL to internal reputational lists. Ongoing vigilance is advised in case the domain is re‑registered or the underlying infrastructure is reused for future campaigns.