divace-eng-geminie[.]pages[.]dev

Analysis of divace-eng-geminie.pages.dev shows a high‑risk brand‑impersonation infrastructure targeting Coinbase users. The domain, created on September 02, 2020 and registered through Cloudflare, Inc., resolves to IP address 172.66.47.118, which is owned by AS13335 Cloudflare, Inc. and geolocated to the United States. The hosting environment presents HSTS, Cloudflare services, and HTTP/3 support, and the TLS certificate is issued by Google Trust Services under the WE1 identifier, indicating a legitimate certificate chain but not necessarily benign intent. The HTTP response returned a 403 status, and the site is currently taken offline, which aligns with its reported status.

The only visible content is the page title "Coinbase Extension - Information & Overview," directly referencing the targeted brand. The domain is classified as a Wallet/Seed Phishing operation, and Google Safe Browsing flags it for social engineering. Fifteen of ninety‑three VirusTotal scanners flagged the domain, and it appears on one external security blocklist. PhishDestroy also lists the domain as blocked, while Gridinsoft assigns a trust score of 0 out of 100, reinforcing the malicious assessment.

Nameserver configuration includes adi.ns.cloudflare.com, chan.ns.cloudflare.com, ignacio.ns.cloudflare.com, and a partially captured "karl.ns.c" entry, all pointing to Cloudflare infrastructure. No additional page content or screenshots have been released, leaving the exact phishing payload unknown beyond the brand‑specific title.

Defenders should immediately deny traffic to divace-eng-geminie.pages.dev at the DNS and proxy layers, add the IP 172.66.47.118 to network blocklists, and monitor for any future re‑hosting of the domain or similar subdomains under the same registrar. Integration of Google Safe Browsing and other threat‑intel feeds that flag this domain can automate preventative actions.