genuine--coinbase-wallet-extension[.]pages[.]dev

The domain genuine--coinbase-wallet-extension.pages.dev was registered on February 21, 2026 through Cloudflare, Inc. and resolves to the IPv6 address 2606:4700:310c::ac42:2d1d, which is allocated to AS13335 Cloudflare, Inc. in the United States. The site presented the page title "Suspected phishing site | Cloudflare" and served an SSL certificate issued by Google Trust Services under the WE1 designation, indicating a legitimate‑looking HTTPS endpoint. HTTP headers revealed the presence of HSTS, Cloudflare protection, and HTTP/3 support. VirusTotal analysis recorded five detections out of ninety‑five scanned security vendors, confirming that multiple scanners identified malicious behavior.

Gridinsoft assigned a trust score of 0 / 100, and the domain was listed on a single security blocklist. PhishDestroy has already taken the domain offline, and current status confirms it is no longer reachable (HTTP 403 response before takedown). The observed evidence aligns with a crypto‑related scam targeting the Coinbase brand, as indicated by the listed scam type and the brand target field.

Uncertainty remains regarding the exact payload or credential‑harvesting mechanisms, as the page content has not been captured beyond the generic title. Defenders should continue to block the IPv6 address and associated Cloudflare nameservers (zariyah.ns.cloudflare.com, amit.ns.cloudflare.com) at network perimeter devices, update URL filtering rules to include the domain, and monitor for any re‑registration attempts that reuse similar sub‑domain patterns. Given the low trust score and multiple vendor detections, the domain should be treated as high‑confidence malicious activity pending further forensic analysis.