secure-coinbase-login[.]pages[.]dev

secure-coinbase-login.pages.dev was registered on 21 February 2026 and resolves to the Cloudflare‑owned address 172.66.47.117 (AS13335, United States). The domain is hosted behind Cloudflare’s CDN and uses a Google Trust Services / WE1 SSL certificate, which is typical for legitimate Cloudflare customers but does not guarantee authenticity of the hosted content. An HTTP 451 response – “Unavailable For Legal Reasons” – is returned, indicating that the site has been taken down, likely after abuse reports. Intelligence collected prior to takedown shows the page title was exactly “Unavailable For Legal Reasons”, offering no further visual clues.

The domain appears on three independent security blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL, reinforcing the assessment that it was being used for malicious purposes. VirusTotal scans recorded 7 positive detections out of 93 security vendors, confirming that multiple engines flagged the domain as malicious. The registrar information lists Cloudflare, Inc. as the registrar, and the authoritative nameservers are surina.ns.cloudflare.com and jakub.ns.cloudflare.com, both standard Cloudflare entries. The combination of a brand‑specific sub‑domain (secure‑coinbase‑login) targeting Coinbase, the short lifespan of the domain, the presence on blocklists, and multiple vendor detections aligns with a crypto‑related brand impersonation campaign.

Because the site is currently offline, immediate mitigation focuses on preventing re‑use of the same host. Defenders should add the domain and its associated IP address to deny‑list rules across firewalls, DNS filters, and endpoint protection solutions. Continuous monitoring of Cloudflare‑registered domains that embed the “coinbase” keyword is advised, as threat actors often recreate similar impersonation sites after takedowns.