view-coinbasepro-cdn[.]pages[.]dev

view-coinbasepro-cdn.pages.dev was observed on July 24, 2026 and is currently offline. The domain was registered on February 21, 2026 through Cloudflare, Inc., and resolves to the IP address 188.114.97.3, which belongs to AS13335 owned by Cloudflare, Inc. The TLS certificate presented is issued by Google Trust Services under the WE1 intermediate, indicating a legitimate certificate chain but not guaranteeing the authenticity of the hosted content. The page title returned by the server is “Suspected phishing site | Cloudflare”, and the HTTP response code is 403, suggesting active blocking by the hosting provider. Infrastructure analysis shows that the domain uses HSTS, HTTP/3, and Cloudflare’s DNS with nameservers aldo.ns.cloudflare.com and amber.ns.cloudflare.com, confirming reliance on Cloudflare’s edge network. Reputation signals are uniformly negative.

The Gridinsoft trust score is 0 out of 100. VirusTotal scans reported 11 detections out of 93 security vendors, indicating multiple vendors flagged the site as malicious. The domain appears on three external blocklists and has been specifically listed by PhishDestroy, MetaMask, and SEAL as a blocked resource. The identified scam type is “Crypto Scam”, and the target brand is Coinbase, as indicated by the “Impersonates: Coinbase” tag. Given the convergence of independent indicators—low trust score, multiple vendor detections, blocklist inclusion, and the explicit “Crypto Scam” classification—defenders should treat the domain as high‑risk.

Network defenders should continue to block the IP 188.114.97.3 and the domain itself at DNS and proxy layers. Security tools that rely on reputation feeds should update their databases to reflect the confirmed malicious status. Analysts should monitor for re‑registration or similar domain patterns that reuse the “view‑coinbasepro‑cdn” prefix, as attackers often recycle naming conventions.