coinbase-exten-portal[.]pages[.]dev

Analysis as of July 23 2026 shows that the domain coinbase-exten-portal.pages.dev was provisioned on February 21 2026 through Cloudflare, Inc. The domain resolves to the Cloudflare edge address 172.66.47.84, which belongs to ASN 13335 and is geolocated in the United States. An SSL certificate issued by Google Trust Services (WE1) secures the site, and the HTTP response observed during the last scan returned a 403 status code, indicating access denial. The page title returned by the server is “Suspected phishing site | Cloudflare,” which aligns with the classification of a crypto‑related scam. Multiple threat‑intelligence sources concur that the site impersonates the cryptocurrency exchange Coinbase, and Google Safe Browsing categorises the URL as “social engineering.” Reputation services assign extremely low trust scores (Gridinsoft 0/100, Scamadviser 1/100), and the domain appears on a single security blocklist, currently blocked by PhishDestroy.

VirusTotal scans recorded 13 detections out of 95 AV engines, reinforcing the malicious assessment. The site employs Cloudflare security features including HSTS and HTTP/3, and its authoritative nameservers are pearl.ns.cloudflare.com and moura.ns.cloudflare.com. No additional artifact such as phishing page content or credential‑stealing form has been publicly disclosed; the only observable indicator is the generic “Suspected phishing site” title.

Defenders should update URL filtering rules to deny traffic to coinbase‑exten‑portal.pages.dev, add the domain to internal blocklists, and monitor for any related sub‑domains that may be registered under the same Cloudflare account. Continuous observation of Cloudflare‑associated IP ranges for new registrations matching the Coinbase brand is recommended, as the rapid creation date suggests an opportunistic campaign targeting cryptocurrency users.