info-coin-base-exten[.]pages[.]dev

The domain info-coin-base-exten.pages.dev was registered through Cloudflare, Inc. on September 02, 2020 and resolves to the IP address 172.66.46.236, which is associated with AS13335 Cloudflare, Inc. in the United States. The site presented the HTTP status code 403 and displayed the page title "Suspected phishing site | Cloudflare". SSL termination is provided by Google Trust Services under the WE1 certificate, and the connection enforces HSTS while supporting HTTP/3, confirming the use of Cloudflare's edge services. Reputation checks show a Gridinsoft trust score of 0 / 100, indicating an extremely low credibility rating.

The domain appears on a single security blocklist and was actively blocked by PhishDestroy at the time of analysis. Google Safe Browsing categorised the URL as a social engineering threat, and VirusTotal recorded 12 detections out of 95 security vendors, reinforcing the malicious assessment. The nameserver configuration includes adi.ns.cloudflare.com, adrian.ns.cloudflare.com, george.ns.cloudflare.com, and karl.ns., all owned by Cloudflare. The site impersonates Coinbase, as indicated by the brand target field, and is classified as a brand impersonation phishing campaign.

Current status shows the domain has been taken offline. Defenders should continue to block the domain at perimeter filters, monitor for any re‑registration of similar subdomains under the pages.dev namespace, and consider adding the associated IP address to threat intelligence feeds. Ongoing observation of Cloudflare‑hosted infrastructure is advised, given the frequent reuse of such services by phishing operators.