coinbase-signs[.]pages[.]dev

coinbase-signs.pages.dev was registered on 2026-02-21 and is hosted on Cloudflare’s edge network (AS13335, United States). DNS resolution points to 172.66.47.87 and the authoritative nameservers are margot.ns.cloudflare.com and rocco.ns.cloudflare.com. The site presented the page title “Suspected phishing site | Cloudflare”, which is the default block page served by Cloudflare when a domain is flagged. TLS termination uses a certificate issued by Google Trust Services under the “WE1” designation, indicating a standard Cloudflare‑provided SSL. Network analysis shows support for HSTS and HTTP/3, consistent with Cloudflare’s platform.

An HTTP 403 response was observed, confirming that the content is being blocked rather than served. The domain is listed on one security blocklist and has been actively blocked by the PhishDestroy service. VirusTotal scans returned 13 positive detections out of 93 scanners, reinforcing the malicious classification. Gridinsoft assigned a trust score of 0 out of 100, the lowest possible rating.

The infrastructure is identified as a brand‑impersonation campaign targeting Coinbase and is categorized as a crypto‑scam. No additional content was captured before the site was taken offline, so the exact phishing vector remains unknown. Defenders should add the domain and its IP address to deny‑list rules, monitor for new subdomains under pages.dev that reference Coinbase, and consider broader Cloudflare edge‑network indicators when hunting for related activity. Continuous verification of blocklist updates and VirusTotal re‑scans is recommended to capture any changes in the threat posture.