coinbas-en--extension--pro[.]pages[.]dev

Analysis of coinbas-en--extension--pro.pages.dev shows that the domain was registered on February 21 2026 through Cloudflare, Inc. and resolves to the Cloudflare address 172.66.44.216, which is announced as AS13335 in the United States. The site is protected by an HSTS‑enabled Cloudflare front end that also serves HTTP/3 traffic. The TLS certificate is issued by Google Trust Services under the WE1 designation, confirming a valid HTTPS endpoint. An HTTP request to the root returned status code 403, and the page title presented by the server is “Suspected phishing site | Cloudflare”, indicating that Cloudflare’s automated block page is being displayed.

The domain appears on a single public blocklist and has been actively blocked by PhishDestroy. Google Safe Browsing classifies the URL as a social‑engineering threat, and VirusTotal reports that 16 of 93 scanning engines have flagged the domain as malicious. Gridinsoft assigned a trust score of 0 out of 100, and the domain is listed in the “Crypto Scam” category, specifically impersonating the Coinbase brand. Nameserver records point to vick.ns.cloudflare.com and nina.ns.cloudflare.com, both operated by Cloudflare.

The current operational status is offline, suggesting that the hosting provider or a takedown request has removed the content. Evidence confirms the domain is being used for brand impersonation aimed at cryptocurrency users, but the exact content of the phishing page was not captured in the available data. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any re‑registration attempts of similar strings, and update detection signatures to include the observed infrastructure fingerprints such as the Cloudflare IP range, the specific nameservers, and the Google‑issued certificate.