home-pro-coinbase[.]pages[.]dev

The domain home-pro-coinbase.pages.dev was flagged on 2026-07-23 as an elevated‑risk brand‑impersonation site targeting Coinbase users. Registration data shows the domain was created on 2026-02-21 through Cloudflare, Inc., and the authoritative nameservers are journey.ns.cloudflare.com and matias.ns.cloudflare.com. DNS resolution points to IP address 188.114.96.3, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The HTTPS endpoint presents a Google Trust Services / WE1 certificate, and HTTP headers indicate HSTS enforcement, Cloudflare protection, and HTTP/3 support. The web server returned HTTP 403 and the page title returned by the server is "Suspected phishing site | Cloudflare", indicating that the site has been taken offline by Cloudflare’s takedown mechanisms.

Independent analysis by PhishDestroy confirms the takedown; the domain is listed on at least one public blocklist. VirusTotal scans show that 14 of 93 security vendors classified the domain as malicious, providing additional corroboration of the threat. Gridinsoft assigned a trust score of 0/100, and the domain appears on a single security blocklist, further reinforcing the malicious assessment. Publicly available intelligence does not include a detailed payload sample, login form capture, or malware dropper; therefore the exact phishing workflow remains undetermined. No evidence of additional infrastructure, such as command-and-control servers or secondary domains, has been disclosed.

Defenders should immediately block DNS resolution to 188.114.96.3 and add home-pro-coinbase.pages.dev to URL filtering and email security policies. Because the domain leverages Cloudflare’s infrastructure, monitoring for other sub‑domains under the pages.dev namespace that contain the "coinbase" keyword is advised. Continuous re‑scanning with VirusTotal or comparable multi‑engine services is recommended to detect any future re‑hosting attempts.