support-coinbaselogin-web[.]pages[.]dev

Analysis of the domain support-coinbaselogin-web.pages.dev indicates that it is actively used for a cryptocurrency‑related impersonation campaign targeting Coinbase customers. The domain was registered on 21 February 2026 through Cloudflare, Inc., and resolves to the IPv6 address 2a06:98c1:3121::3, which belongs to AS13335 operated by Cloudflare, Inc., located in the United States. The site presents the page title “Suspected phishing site | Cloudflare” and returns an HTTP 403 status code, suggesting that the content is being blocked or is inaccessible. VirusTotal has recorded 16 detections out of 93 scanning engines, and Google Safe Browsing flags the domain for social‑engineering, reinforcing the suspicion of malicious intent. The site is listed on at least one public blocklist and is explicitly blocked by the PhishDestroy service.

Additional reputation metrics are uniformly negative: Gridinsoft assigns a trust score of 0 / 100, and the domain appears on a security blocklist, confirming its classification as a high‑risk crypto scam. The SSL certificate presented is issued by Google Trust Services under the label “WE1,” which is typical for Cloudflare‑proxied sites and does not provide any indication of legitimate ownership. Detected technologies include HTTP/3, HSTS, and Cloudflare’s CDN services, all of which are consistent with the hosting provider but do not mitigate the malicious purpose. Nameservers emerson.ns.cloudflare.com and jill.ns.cloudflare.com further confirm the use of Cloudflare’s DNS infrastructure.

While the exact phishing page content has not been captured, the combination of brand impersonation (Coinbase), the “Crypto Scam” classification, and the presence of multiple security detections make the domain a clear threat to users. Uncertainty remains regarding the current operational status of any credential‑harvesting infrastructure, as the site is reported as taken offline at the time of analysis.