coin-base-pro-ask[.]pages[.]dev

This domain, coin-base-pro-ask.pages.dev, was registered on 2020-09-02 through Cloudflare, Inc. and uses Cloudflare’s authoritative name servers adi.ns.cloudflare.com and karl.ns.cloudflare.com. DNS resolution points to the IPv6 address 2606:4700:310c::ac42:2f1b, which belongs to AS13335 operated by Cloudflare in the United States. The site presented a TLS certificate issued by Google Trust Services under the WE1 identifier, indicating a valid HTTPS endpoint. The HTTP response observed before takedown was a 403 status code and the page title returned “Suspected phishing site | Cloudflare”.

Automated analysis flagged the page as a crypto‑related scam and identified HSTS, Cloudflare and HTTP/3 as active technologies. Google Safe Browsing classified the URL as social engineering, and PhishDestroy confirmed the domain as malicious, resulting in its removal from the internet. Reputation scoring from Gridinsoft assigned a zero out of one hundred, reflecting extreme distrust. VirusTotal reports show that fifteen of ninety‑three scanning engines marked the domain as malicious, reinforcing the suspicion.

The domain appears on a single external blocklist, and its primary threat vector is brand impersonation of Coinbase, as indicated by the “Impersonates: Coinbase” tag. Although the site is currently offline, the infrastructure details—Cloudflare hosting, a legitimate‑looking TLS certificate, and the use of a pages.dev subdomain—demonstrate a typical pattern for credential‑harvesting campaigns targeting cryptocurrency users. Defenders should continue to block the IPv6 address and the associated ASN, monitor any future registrations that reuse the same name servers or certificate authority, and ensure that endpoint detection rules incorporate the observed page title and HTTP status. Additional investigation into any residual URLs or redirects that may have been cached before takedown is recommended, as attackers often reuse similar infrastructure for new campaigns.