faq-coinbase-pro-en[.]pages[.]dev

This domain, faq-coinbase-pro-en.pages.dev, was registered on February 21 2026 through Cloudflare, Inc. and resolves to the Cloudflare edge address 172.66.44.133, which belongs to ASN 13335 located in the United States. The authoritative nameservers are lucy.ns.cloudflare.com and donovan.ns.cloudflare.com, indicating the domain is fully hosted on Cloudflare’s infrastructure. The site presents the page title “Suspected phishing site | Cloudflare” and returns HTTP status 403, suggesting the content has been taken offline. The SSL certificate is issued by Google Trust Services under the “WE1” label, a standard Cloudflare‑provided certificate.

Technical fingerprints show HSTS, Cloudflare and HTTP/3 support. The domain is flagged by a single security blocklist and is listed as blocked by PhishDestroy. Gridinsoft assigns a trust score of 0 out of 100. VirusTotal analysis shows that 13 of 95 scanning engines have flagged the domain, reinforcing the malicious assessment.

The intelligence tags the activity as a crypto‑related scam that impersonates the Coinbase brand. While the site is currently inaccessible, the combination of a low trust score, multiple vendor detections, blocklist inclusion, and explicit brand impersonation indicates a high likelihood of credential‑stealing or financial fraud. Defenders should continue to block the domain at perimeter and DNS layers, monitor for any resurgence of the host, and add the IP address 172.66.44.133 to any threat‑intel feeds that track Cloudflare‑based abuse. Ongoing verification of DNS queries for this FQDN is recommended, and any internal alerts that reference Coinbase‑related credential capture should be correlated with this indicator.