coinbasse-en-setup[.]pages[.]dev

On July 24, 2026, the domain coinbasse-en-setup.pages.dev was observed being used in a credential phishing campaign. The domain was registered on February 21, 2026 through Cloudflare, Inc., and resolves to the IP address 188.114.96.3, which belongs to AS13335 Cloudflare, Inc. and is geographically located in the United States. DNS configuration shows the authoritative nameservers meadow.ns.cloudflare.com and julio.ns.cloudflare.com, indicating the infrastructure is fully hosted behind Cloudflare’s edge network. The site presented a TLS certificate issued by Google Trust Services under the “WE1” label, confirming the use of a valid, publicly trusted certificate. HTTP responses return status code 403, and the server advertises HSTS and HTTP/3, consistent with Cloudflare’s security stack.

Google Safe Browsing has flagged the URL for social engineering, and the domain appears on one security blocklist, where it was subsequently taken offline by the PhishDestroy takedown service. VirusTotal analysis reports that 12 of 93 scanning engines flag the domain as malicious, reflecting a moderate level of consensus among antivirus and URL‑reputation vendors. Gridinsoft’s trust score assigns a value of 0 out of 100, indicating an extremely low trustworthiness rating. The page title returned by the server is “Suspected phishing site | Cloudflare”, providing no further indication of the targeted brand or credential type.

Based on the available evidence, the primary confidence is that the domain is being leveraged for credential phishing, though the exact victim brand or login portal being spoofed has not been disclosed in the collected data. The lack of a public landing page and the immediate 403 response suggest the site may have been used transiently or is currently in a takedown state.