coinbase-io-net[.]pages[.]dev

This domain, coinbase-io-net.pages.dev, was registered on February 21, 2026 through Cloudflare, Inc. and resolves to the Cloudflare IP address 172.66.44.173 (AS13335, United States). The site presents the page title “Suspected phishing site | Cloudflare” and returns HTTP 403, indicating that content is blocked. The TLS certificate is issued by Google Trust Services under the WE1 root, confirming use of a legitimate certificate chain. Infrastructure analysis shows the domain is served behind Cloudflare with HSTS enabled and HTTP/3 support, typical of many abuse‑hosting setups.

Brand‑targeted intelligence flags the domain as a Coinbase impersonation used in a crypto‑scam campaign. Google Safe Browsing lists it for social engineering, and PhishDestroy has added it to its blocklist. The domain appears on one additional security blocklist and receives a Gridinsoft trust score of 0 / 100, reinforcing the malicious assessment. VirusTotal scans report that 14 of 93 AV engines flag the domain, providing further corroboration.

Despite the presence of a valid SSL certificate, the combination of the domain name, the brand targeting, the malicious page title, and multiple detection sources indicates a high‑risk impersonation site. Uncertainty remains regarding the exact payload or credential‑stealing mechanisms because the site content has not been captured. Defenders should block the domain at the DNS and proxy layers, add the IP address 172.66.44.173 to deny lists, and monitor for any outbound connections to Cloudflare‑hosted services that may be used for credential exfiltration. Continuous re‑scanning with VirusTotal and reviewing updates from PhishDestroy and Google Safe Browsing are recommended to capture any changes in the threat posture.