coinbasepro---login[.]pages[.]dev

Analysis of coinbasepro---login.pages.dev shows a high‑risk brand‑impersonation operation targeting Coinbase users. The domain was registered on February 21, 2026 through Cloudflare, Inc., and its authoritative nameservers are lochlan.ns.cloudflare.com and cass.ns.cloudflare.com, indicating that the infrastructure is fully hosted on Cloudflare’s network (ASN 13335, United States). DNS resolution points to IP address 172.66.44.111, a Cloudflare edge node that provides HSTS and HTTP/3 support. The site presents the page title "Suspected phishing site | Cloudflare," which aligns with the block page displayed after the domain was taken offline. The SSL certificate is issued by Google Trust Services under the WE1 designation, a legitimate certificate authority, suggesting the attackers obtained a valid TLS certificate to increase credibility.

Google Safe Browsing flags the domain for social engineering, and VirusTotal records 16 detections out of 93 scanned vendors, confirming that multiple security products recognize the domain as malicious. The Gridinsoft trust score of 0 / 100 further underscores its lack of reputation. The domain appears on one security blocklist and has been actively blocked by PhishDestroy, demonstrating that at least one anti‑phishing organization has responded to the threat. The HTTP response currently returns a 403 status code, consistent with the site being taken offline after detection.

Defenders should ensure the domain is added to deny‑list controls across DNS filters, web proxies, and endpoint security solutions. Monitoring for additional domains resolving to the same Cloudflare IP range may reveal a broader campaign. Users should be warned that any login request originating from this domain is fraudulent and that legitimate Coinbase interactions always occur under the official Coinbase.com domain and its known subdomains.