coinbase-prologine[.]pages[.]dev

coinbase-prologine.pages.dev was observed hosting a suspected phishing page that targets Coinbase users. The site is served through Cloudflare, using the nameservers venkat.ns.cloudflare.com and edna.ns.cloudflare.com, and resolves to IP 188.114.97.3, which belongs to AS13335 Cloudflare, Inc. in the United States. The TLS certificate is issued by Google Trust Services under the WE1 intermediate, indicating a valid HTTPS endpoint, but the page title returned by the server is “Suspected phishing site | Cloudflare”, and the HTTP response code is 403, suggesting the content has been taken down or blocked. Threat intelligence shows that 11 of 95 VirusTotal scanners flagged the domain, and the domain appears on a single security blocklist. Google Safe Browsing classifies the URL as a social‑engineering threat, and Gridinsoft assigns a trust score of 0 out of 100, reinforcing the malicious assessment.

The site is listed as a crypto‑scam in the provided intelligence, and PhishDestroy has already blocked the domain. The domain was registered on February 21, 2026 via Cloudflare’s registrar service, and the creation date aligns with the emergence of the phishing campaign. HSTS and HTTP/3 are enabled, which are typical of legitimate Cloudflare‑protected sites, making detection based on infrastructure alone more challenging. While the page content has not been captured, the combination of brand impersonation metadata, multiple vendor detections, and active blocklist entries provides strong evidence that the domain was used to harvest Coinbase credentials or lure victims into a cryptocurrency fraud.

Uncertainty remains regarding the specific payload delivered to victims and whether any victim data was exfiltrated before the takedown. Defenders should continue to monitor the domain’s IP and associated Cloudflare edge nodes for any re‑use, enforce URL filtering for the exact hostname, and add the domain to internal blocklists.