promo-coinbese-extenson[.]pages[.]dev

The domain promo-coinbese-extenson.pages.dev was observed resolving to the IP address 172.66.46.215, which belongs to the Cloudflare network (AS13335) and is geolocated in the United States. The site employed a TLS certificate issued by Google Trust Services under the WE1 designation, indicating the use of Cloudflare's SSL termination service. The HTTP response returned a 403 status code and the page title presented by Cloudflare was "Suspected phishing site | Cloudflare," confirming that the hosting provider has actively blocked access to the content. Registration data shows the domain was created on February 21, 2026 and was provisioned through Cloudflare, Inc., with authoritative nameservers nolan.ns.cloudflare.com and zelda.ns.cloudflare.com.

Security assessments reveal a Gridinsoft trust score of zero out of one hundred, and the domain is listed as blocked by PhishDestroy. Google Safe Browsing has flagged the site for social engineering, and VirusTotal reports that thirteen of ninety‑three scanning vendors identified malicious characteristics, resulting in the domain appearing on a single security blocklist. Detected technologies include HTTP/3, HTTP Strict Transport Security (HSTS), and standard Cloudflare services. The threat profile is classified as a crypto scam that impersonates the Coinbase brand, aligning with the reported brand impersonation intent.

As of the July 25, 2026 report date the site is offline, likely due to Cloudflare's takedown actions. While the available data confirms the infrastructure and the branding misuse, the specific payload or credential‑capture mechanisms have not been captured, leaving the exact malicious behavior uncertain. Defenders should add the domain to network and DNS blocklists, ensure endpoint security solutions are updated to recognize the reported vendor detections, and monitor for any re‑registration attempts that may reuse similar naming patterns or Cloudflare infrastructure.