page-coinbase-secure[.]pages[.]dev

Analysis shows that the domain page-coinbase-secure.pages.dev is currently offline and returns HTTP 403. The domain resolves to 172.66.44.58, an address owned by Cloudflare (AS13335) located in the United States. Registration information indicates the domain was created on 2020-09-02 via Cloudflare, Inc., and the authoritative nameservers are adi.ns.cloudflare.com and karl.ns.cloudflare.com. The TLS certificate is issued by Google Trust Services under the WE1 root, confirming the presence of HTTPS.

Detected technologies include HSTS, HTTP/3, and the Cloudflare edge network. Security monitoring shows the site was flagged by 15 of 93 VirusTotal AV engines and is listed on one external blocklist. PhishDestroy has taken the site offline, and the Gridinsoft trust score is 0/100, reflecting a high confidence of malicious intent. The page title returned by the server is “Suspected phishing site | Cloudflare”, and the listed scam type is “Crypto Scam” with a brand impersonation targeting Coinbase.

No additional content has been captured, and the exact phishing page content remains unverified. Defenders should ensure that the IP address 172.66.44.58 is blocked at network perimeters, add the domain to URL filtering policies, and monitor for any re‑registration attempts that reuse the same sub‑domain pattern or Cloudflare nameservers. Ongoing intelligence collection on similar Coinbase‑related impersonation domains is recommended, as the use of Cloudflare’s free registration pathway can facilitate rapid re‑deployment. Given the elevated risk rating, the domain should be treated as hostile and excluded from any legitimate traffic.