guide-pro-coin[.]pages[.]dev

Analysis of guide-pro-coin.pages.dev confirms it operated as a high-risk brand-impersonation domain targeting Coinbase users. The domain, registered on September 2, 2020, was hosted on Cloudflare infrastructure (AS13335) and resolved to 172.66.47.84, a US-based IP. Google Safe Browsing flagged the site for social engineering, and the page title 'Coinbase Pro Access Guide' aligns with the reported scam type: a crypto scam impersonating Coinbase. The domain was detected on one security blocklist and blocked by PhishDestroy, while Gridinsoft assigned a trust score of 0/100. Fifteen of 93 security vendors on VirusTotal flagged the domain, though the exact detection categories are not detailed in available intelligence.

Infrastructure analysis reveals the use of Cloudflare nameservers (adi.ns.cloudflare.com, gabriella.ns.cloudflare.com, henrik.ns.cloudflare.com) and an SSL certificate issued by Google Trust Services (WE1). The site enforced HSTS and supported HTTP/3, typical of modern phishing kits leveraging Cloudflare’s security features to evade initial scrutiny. At the time of assessment (July 23, 2026), the domain returned an HTTP 403 status, indicating it had been taken offline, likely following enforcement action. While the domain’s registration date predates the reported activity, this is not uncommon for repurposed phishing infrastructure.

The absence of additional technical indicators—such as specific phishing kit signatures, wallet addresses, or redirect chains—limits further attribution. Defenders should treat any prior interaction with this domain as a potential compromise of credentials or personal data. Monitoring for reuse of the same IP, nameservers, or SSL certificate in future campaigns is recommended, particularly for domains impersonating Coinbase or other cryptocurrency platforms.