portal-coinbase-com-sin[.]pages[.]dev

portal-coinbase-com-sin.pages.dev was registered on February 21, 2026 through Cloudflare, Inc. and resolves to the Cloudflare edge address 188.114.96.3, an IP owned by AS13335 in the United States. The site presents the page title “Suspected phishing site | Cloudflare” and returns an HTTP 403 status code, indicating that the content is not publicly accessible. TLS termination is performed by Google Trust Services using the WE1 certificate, and the connection enforces HSTS and HTTP/3, consistent with typical Cloudflare‑hosted services. The domain is listed on a single security blocklist and is actively blocked by PhishDestroy.

Google Safe Browsing classifies the URL as a social‑engineering threat, and VirusTotal reports that 13 of 93 scanning engines have flagged the domain, reinforcing the malicious assessment. Gridinsoft assigns a trust score of 0 out of 100, and the domain is explicitly tagged as a “Crypto Scam” that impersonates the Coinbase brand. Nameservers hans.ns.cloudflare.com and angela.ns.cloudflare.com confirm the use of Cloudflare’s DNS infrastructure. The combination of brand impersonation, low trust scoring, multiple vendor detections, and blocklist presence suggests a high‑risk credential‑harvesting or crypto‑draining campaign targeting Coinbase users.

At present, the site is offline, and no additional content has been captured, leaving the exact phishing payload and lure mechanisms unknown. Defenders should continue to block the domain at network perimeters, update URL filtering and threat‑intel feeds with the observed indicators, and monitor for any re‑registration attempts that reuse the same subdomain pattern or hosting configuration. Ongoing correlation with other Coinbase‑related phishing artifacts may reveal broader actor infrastructure.