acc-login-coinbase[.]pages[.]dev

On July 24, 2026, the domain acc-login-coinbase.pages.dev was identified as a potential threat impersonating Coinbase. This domain is flagged as a crypto scam and has been taken offline. The domain's infrastructure was registered through Cloudflare, Inc., and it has nameservers configured at 'seamus.ns.cloudflare.com' and 'surina.ns.cloudflare.com'. The domain resolves to the IP address 188.114.97.3, which is located in the United States and is part of AS13335 Cloudflare, Inc. The site's HTTP status is 403, suggesting that the server is refusing to fulfill the request, which is a common security measure to prevent unauthorized access. The SSL certificate is issued by Google Trust Services under the WE1 certificate authority, indicating a secure connection when the site was active.

However, the site has been marked as a suspected phishing site by Cloudflare, and the page title confirms this suspicion. The Gridinsoft trust score for this domain is 0/100, indicating a high level of distrust. Furthermore, the domain appears on at least three security blocklists, reinforcing the assessment of it being a malicious site. Security vendors such as PhishDestroy, MetaMask, and SEAL have actively blocked this domain. Despite the domain being offline, defenders should remain vigilant and ensure that firewalls and security filters are updated to protect against any residual or reactivated threats.

It is also advisable to monitor for similar domain names and to educate users about the risks of visiting untrusted websites, especially those purporting to be cryptocurrency platforms. The exact content of the site has not been fully analyzed, but based on the available evidence, it is clear that the domain was used to impersonate Coinbase for potentially fraudulent purposes. Analysis indicates that the domain was created on February 21, 2026, and was taken offline shortly after detection.