nav-sso-coinbasepro[.]pages[.]dev

The domain nav-sso-coinbasepro.pages.dev was registered on February 21, 2026 through Cloudflare, Inc. and resolves to the IP address 188.114.96.3, which is owned by AS13335 Cloudflare, Inc. in the United States. The site is currently taken offline, but its historical footprint shows a 403 HTTP response and a page title of "Suspected phishing site | Cloudflare," indicating that Cloudflare’s automated phishing protection flagged the content. The TLS certificate presented by the host was issued by Google Trust Services under the WE1 intermediate, a legitimate certificate authority that attackers often exploit to lend credibility to malicious sites. Nameserver records point to abby.ns.cloudflare.com and todd.ns.cloudflare.com, both standard Cloudflare resolver entries used by many short‑lived malicious deployments.

Technical headers reveal the presence of HSTS, Cloudflare CDN, and HTTP/3, all consistent with the hosting platform. VirusTotal analysis recorded 14 of 93 security vendors labeling the domain as malicious, and the site appears on one external security blocklist. Additional detections include a block by PhishDestroy and a Gridinsoft trust score of 0 out of 100, reinforcing the elevated risk assessment. The page is categorized as a "Crypto Scam" and explicitly impersonates Coinbase, suggesting the intent was to lure cryptocurrency users into credential or fund harvesting.

While the domain is no longer serving content, the infrastructure—Cloudflare‑hosted IP, recent registration, and use of a reputable SSL certificate—remains reusable for future campaigns. Defenders should immediately add nav-sso-coinbasepro.pages.dev to network and email filtering blocklists, monitor the originating IP range for similar newly registered domains, and watch for analogous naming patterns that combine "nav" or "sso" with "coinbasepro".