host-cuin-base[.]pages[.]dev

On July 25, 2026 the domain host-cuin-base.pages.dev was observed operating as a brand‑impersonation site targeting Coinbase. The site presented the page title "Coinbase Login - Secure Access to Your Crypto," directly referencing the cryptocurrency exchange. Technical analysis shows the domain is registered through Cloudflare, Inc., and resolves to IP address 172.66.47.200, which is hosted in the United States under ASN 13335 owned by Cloudflare. The SSL certificate is issued by Google Trust Services under the WE1 label, indicating a valid TLS handshake despite the malicious intent.

The infrastructure employs HSTS, Cloudflare edge services, and HTTP/3, and the authoritative nameservers are ariella.ns.cloudflare.com and julian.ns.cloudflare.com. Gridinsoft assigned a trust score of 0 out of 100, reflecting a high confidence of malicious use. VirusTotal recorded five detections out of ninety‑three scanned security vendors, confirming that multiple vendors flag the domain as malicious. HTTP requests to the host return a 403 status code, and the domain has been placed on a single security blocklist and is currently blocked by the PhishDestroy feed.

The domain was created on February 21, 2026, and is now taken offline. While the page content cannot be verified directly, the combination of a Coinbase‑specific title, the low trust score, vendor detections, and blocklist inclusion provides strong evidence of a credential‑harvesting campaign. Defenders should ensure the domain is added to firewall and DNS filtering policies, monitor for any resurgence of the host, and advise users to disregard any login prompts referencing Coinbase from this URL. Further investigation of related Cloudflare‑hosted subdomains may uncover additional drop points or phishing infrastructure.