secure-coin-base-login[.]pages[.]dev

The domain secure-coin-base-login.pages.dev was registered on February 21, 2026 through Cloudflare, Inc. and is currently taken offline. DNS resolution points to the IP address 172.66.44.52, which belongs to AS13335 Cloudflare, Inc. in the United States. The site presents the page title "Suspected phishing site | Cloudflare" and returns an HTTP 403 status code, indicating that access is being denied. The TLS certificate presented is issued by Google Trust Services under the WE1 designation, confirming the use of a legitimate certificate chain but not validating the site's intent.

Cloudflare‑provided technologies observed include HTTP/3 and HTTP Strict Transport Security (HSTS). The domain is listed on a single security blocklist and has been flagged by PhishDestroy. Google Safe Browsing classifies the site as a social engineering threat, and VirusTotal reports that 13 of 93 security vendors have flagged the domain, reinforcing the malicious assessment. The Gridinsoft trust score is 0 out of 100, the lowest possible rating, and the site is identified as a crypto‑related scam targeting Coinbase users.

Nameservers in use are ashton.ns.cloudflare.com and nena.ns.cloudflare.com. While the domain is offline, the infrastructure evidence—Cloudflare hosting, a legitimate Google‑issued certificate, and multiple vendor detections—suggests a deliberate attempt to impersonate Coinbase for credential harvesting or cryptocurrency theft. Defenders should block the domain and its associated IP address at network perimeter devices, update intrusion‑prevention signatures with the observed indicators, and monitor for any future re‑registration of the same hostnames or similar sub‑domain patterns. Continuous verification against Google Safe Browsing and VirusTotal for new sightings is recommended to maintain coverage against evolving impersonation campaigns.