coinbase-walleth-extnn[.]pages[.]dev

Analysis of coinbase-walleth-extnn.pages.dev shows a high‑risk brand‑impersonation campaign targeting Coinbase users. The domain was registered on 21 February 2026 through Cloudflare, Inc. and is hosted on Cloudflare’s network (AS13335) with the IP address 188.114.97.3 located in the United States. DNS resolution uses the Cloudflare authoritative nameservers plato.ns.cloudflare.com and athena.ns.cloudflare.com, and the site served an HTTP 403 response over TLS using a Google Trust Services certificate (issuer WE1) with HSTS and HTTP/3 enabled. The page title returned by the server is “Suspected phishing site | Cloudflare”, indicating that the content has already been taken down or blocked. Google Safe Browsing classifies the URL as a social‑engineering threat, and the domain appears on the PhishDestroy blocklist as well as one additional security blocklist.

VirusTotal reports that 14 of 95 scanned security vendors flag the domain, reinforcing the malicious assessment. The Gridinsoft trust score of 0 / 100 further confirms the lack of legitimacy. The observed scam type is recorded as “Crypto Scam”, and the activity explicitly impersonates the Coinbase brand. Defenders should treat any traffic to this host as malicious. Immediate actions include adding the domain and its associated IP (188.114.97.3) to deny‑list rules in firewalls, proxy filters, and endpoint protection platforms.

Because the domain resolves to a shared Cloudflare address, consider blocking the entire IP range or applying URL‑filtering policies that reference the full hostname. Continuous monitoring of Cloudflare‑registered domains that contain “coinbase” substrings is advised, as the infrastructure can be reused for future campaigns. Analysts should also query DNS logs for recent resolution of the domain or its nameservers to identify potential internal exposure before the takedown.