ex-coinbase--tension[.]pages[.]dev

The domain ex-coinbase--tension.pages.dev was registered on February 21, 2026 through Cloudflare, Inc. and resolves to the IP address 172.66.44.169, which belongs to AS13335 Cloudflare, Inc. in the United States. The site presents the page title "Suspected phishing site | Cloudflare" and is classified as a crypto scam that impersonates the Coinbase brand. The SSL certificate is issued by Google Trust Services under the identifier WE1, indicating a valid TLS termination on the Cloudflare edge. HTTP responses return a 403 status code, and the domain enforces HSTS and HTTP/3, consistent with Cloudflare's security stack.

Trust scoring services rate the site poorly: Scamadviser assigns a score of 1 out of 100, and Gridinsoft records a score of 0 out of 100. Google Safe Browsing flags the domain for social engineering, and 16 of 95 VirusTotal security vendors have flagged it as malicious. The domain appears on at least one public security blocklist and is actively blocked by PhishDestroy. Current operational status is offline, indicating that the hosting has been taken down or the site is no longer serving content.

While the exact phishing page content has not been publicly released, the combination of brand impersonation, low trust scores, multiple vendor detections, and blocklist presence demonstrates a high‑risk profile. Defenders should add the domain and its associated IP address to blocklists, monitor for any resurgence of similar subdomains, and ensure that endpoint protection solutions are updated to reflect the 16 vendor detections. Continuous verification of Cloudflare‑registered domains targeting financial brands is recommended to mitigate future impersonation attempts.