portal-coinbase-com-learn[.]pages[.]dev

The domain portal-coinbase-com-learn.pages.dev was registered on February 21, 2026 through Cloudflare, Inc. and is hosted on Cloudflare’s edge network, resolving to the IPv6 address 2a06:98c1:3120::3, which is attributed to AS13335 (Cloudflare, Inc.) in the United States. Authoritative nameservers listed are liz.ns.cloudflare.com and andy.ns.cloudflare.com, confirming the use of Cloudflare’s DNS infrastructure. An SSL certificate issued by Google Trust Services (WE1) protects the site, and the server advertises HSTS, Cloudflare protection, and HTTP/3 support. The HTTP response returned a 403 status code, and the page title displayed by the service is “Suspected phishing site | Cloudflare”, indicating that the content has been flagged and blocked by Cloudflare’s protective mechanisms.

Security telemetry shows that 15 of 93 vendors on VirusTotal flagged the domain, and Google Safe Browsing classifies it as a social‑engineering threat. The domain appears on a single blocklist, with PhishDestroy confirming the block. Gridinsoft assigned a trust score of 0 out of 100, reinforcing the malicious assessment. The campaign is identified as a crypto‑scam that impersonates the Coinbase brand, matching the reported scam type.

While the site is currently taken offline, the available artifacts suggest a deliberate attempt to lure victims by leveraging the Coinbase brand. No additional infrastructure or payload details are observable beyond the Cloudflare warning page, leaving the exact phishing landing page content unknown. Defenders should continue to block the domain at network perimeters, update detection signatures with the observed IP address, nameserver pattern, and SSL issuer, and monitor for similarly structured domains that combine brand keywords with Cloudflare's pages.dev subdomain. Ongoing intelligence collection is recommended to capture any re‑appearance or related infrastructure that may be employed in future impersonation attempts.