koinbase--ext-wallet-s5s[.]pages[.]dev

Analysis of the domain koinbase--ext-wallet-s5s.pages.dev indicates that it was actively used as a crypto‑drainer phishing infrastructure before being taken offline. The site presented the page title “Suspected phishing site | Cloudflare” and employed Cloudflare services, including HSTS enforcement and HTTP/3 support, as reflected in the detected technology stack. DNS resolution maps the hostname to the IP address 172.66.46.225, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. Registration data shows the domain was created on 21 February 2026 and was registered through Cloudflare, Inc., using the authoritative name servers javier.ns.cloudflare.com and aleena.ns.cloudflare.com. The SSL certificate is issued by Google Trust Services under the WE1 designation, confirming a valid TLS layer despite the malicious intent.

Reputation services provide consistent evidence of abuse. VirusTotal recorded ten detections out of ninety‑three submitted scanners, and Google Safe Browsing categorises the domain as a social‑engineering threat. Gridinsoft assigned a trust score of zero out of one hundred, reinforcing the malicious assessment. The domain appears on a single external blocklist and has been added to the PhishDestroy blocklist, confirming community‑wide mitigation. The HTTP response returned a 403 status code, indicating that the site is no longer serving content.

The available data confirm that the domain was leveraged for a cryptocurrency‑drain scam, but the specific payload, victim interaction flow, and any associated command‑and‑control infrastructure remain undisclosed. Defenders should continue to block the resolved IP address and the domain itself at network perimeter and DNS filtering layers. Ongoing monitoring of Cloudflare‑hosted address ranges for similar registration patterns is recommended, as the attacker may re‑deploy under new subdomains.