get-coinbs--extension[.]pages[.]dev

This domain, get-coinbs--extension.pages.dev, is identified as a crypto wallet drainer phishing site designed to steal cryptocurrency credentials and assets. Analysis indicates the infrastructure was actively targeting users through deceptive wallet extension prompts, likely mimicking legitimate browser-based crypto wallet services. The domain is currently offline, though prior activity suggests it was operational for malicious purposes. Infrastructure analysis reveals the domain was registered through Cloudflare, Inc. on February 21, 2026, and resolved to the IP address 188.114.96.3, hosted on AS13335 (Cloudflare, Inc.) in the United States. The SSL certificate is issued by Google Trust Services (WE1), a common characteristic of phishing domains leveraging legitimate certificate authorities. Security vendors flagged the domain as malicious, with 14 of 95 VirusTotal engines detecting it as phishing. Additionally, the domain appears on one security blocklist and was explicitly flagged by Google Safe Browsing as a phishing threat. The page title, 'Suspected phishing site | Cloudflare,' further corroborates its malicious classification, as this is a default warning for domains suspended or detected by Cloudflare’s abuse systems. The domain’s current offline status reduces immediate risk, but historical activity and infrastructure characteristics warrant caution. Users who interacted with this domain should assume credential compromise and take immediate action, including revoking wallet permissions, transferring assets to a secure wallet, and monitoring for unauthorized transactions. Organizations should update blocklists to include this domain and its associated IP address (188.114.96.3) to prevent future access. Security teams are advised to review logs for connections to this domain and investigate potential lateral movement or data exfiltration tied to its use. Proactive monitoring of newly registered domains with similar patterns (e.g., Cloudflare Pages subdomains, crypto-related keywords) is recommended to mitigate emerging threats.