eng-wallet-coiinbase-ext[.]pages[.]dev

The domain eng-wallet-coiinbase-ext.pages.dev was registered through Cloudflare, Inc. on 21 February 2026 and is delegated to the Cloudflare‑provided authoritative nameservers hassan.ns.cloudflare.com and jamie.ns.cloudflare.com. DNS resolution points to IP address 172.66.47.61, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The site presents an HTTPS endpoint secured by a Google Trust Services certificate (WE1), but HTTP requests receive a 403 response and the page title reported by the scanner is “Suspected phishing site | Cloudflare”. This title, together with the 403 status, indicates that Cloudflare has already classified the host as a phishing resource and is actively blocking client access. Security telemetry classifies the domain as a crypto‑drainer scam.

It appears on one public blocklist and is listed by PhishDestroy as blocked. Google Safe Browsing flags the site for social engineering, and VirusTotal records 14 detections out of 93 scanned vendors, reinforcing the malicious classification. The Gridinsoft trust score of 0 / 100 further confirms the low reputation. Detected technologies include HSTS, Cloudflare services, and HTTP/3, all of which are typical for a Cloudflare‑protected front‑end. Analysis confirms that the infrastructure is fully hosted on Cloudflare’s network, making attribution to a specific operator difficult.

The exact phishing content, payload, or wallet addresses targeted have not been captured in the available data, leaving the specific tactics and victim interaction details uncertain. Defenders should therefore treat the domain as hostile, enforce network‑level blocking of the hostname and its resolved IP address, and add it to local and cloud‑based URL filtering lists. Monitoring for any re‑registration or reuse of the same IP range is advisable, as threat actors frequently recycle Cloudflare‑hosted assets.