cloud-base-extension-cuq[.]pages[.]dev

The domain cloud-base-extension-cuq.pages.dev is currently active and engaged in brand impersonation targeting Coinbase, a major cryptocurrency exchange platform. Analysis of the page title, "Coinbase Extension - Secure Crypto Trading," confirms the intent to deceive users into believing the site is an official Coinbase service. This domain represents a high-risk threat due to its active status and targeted impersonation of a trusted financial brand. Infrastructure analysis reveals the domain was registered through Cloudflare, Inc., on March 29, 2026, and resolves to the IP address 188.114.97.3, located in Canada and associated with Cloudflare, Inc. Detection metrics indicate limited but concerning visibility: the domain is flagged by 2 of 95 security vendors on VirusTotal and appears on one security blocklist. The SSL certificate is issued by Google Trust Services (WE1), a common feature in both legitimate and malicious domains leveraging Cloudflare infrastructure. The creation date, while future-dated, suggests potential typosquatting or preemptive registration for malicious use. As of the latest assessment, cloud-base-extension-cuq.pages.dev remains active and accessible. Organizations and users are advised to block the domain at the network level and include it in endpoint protection rules. Security teams should monitor for related indicators, including the IP address 188.114.97.3 and any subdomains or certificates associated with the registrar Cloudflare, Inc. User education on recognizing brand impersonation tactics, particularly in cryptocurrency contexts, is strongly recommended to mitigate exposure.