begin-coinbase-wallet-extension[.]pages[.]dev

The domain begin-coinbase-wallet-extension.pages.dev was registered on February 21, 2026 and is hosted behind Cloudflare’s network, resolving to IP address 172.66.44.103 located in Canada. The authoritative nameservers are paris.ns.cloudflare.com and west.ns.cloudflare.com, confirming Cloudflare as the registrar. The site presents a page title identical to the fully qualified domain name and is currently returning HTTP 403, indicating that the content is not publicly reachable; the domain has been taken offline by the operators. Multiple security services have flagged the domain. Google Safe Browsing classifies it as a social engineering threat, and PhishDestroy lists it as blocked.

It appears on one additional security blocklist. VirusTotal reports that 11 of 93 scanning engines have flagged the domain, reinforcing the malicious assessment. Reputation services are extremely low: Gridinsoft assigns a trust score of 0 / 100 and Scamadviser a score of 1 / 100. The page is identified as a crypto scam that impersonates the Coinbase brand, matching the declared brand target. Detected infrastructure technologies include HSTS, Cloudflare, and HTTP/3, all typical of legitimate services but also used to lend credibility to fraudulent sites.

The precise content of the page has not been captured, so the exact phishing mechanisms or credential‑stealing forms remain unknown. Defenders should add the domain to internal blocklists, monitor DNS queries for the associated Cloudflare IP range, and enforce outbound filtering that blocks connections to this host. Given the Google Safe Browsing and VirusTotal detections, security solutions that integrate these feeds will already flag the domain, but manual policies should be reinforced to prevent any residual traffic from reaching end users. Continuous observation of Cloudflare‑hosted domains that mimic financial brands is advised, as the infrastructure can be rapidly reused for new campaigns.