coinbasswallet-extension[.]pages[.]dev

Analysis of coinbasswallet-extension.pages.dev shows a high‑risk crypto‑drainer infrastructure that has been taken offline as of the report date (23 July 2026). The domain was registered on 21 February 2026 through Cloudflare, Inc., and resolves to 172.66.44.149, an address owned by AS13335 Cloudflare, Inc. in the United States. HTTP responses return status 451 — Unavailable For Legal Reasons — which aligns with the observed page title and indicates the content has been removed, likely under a takedown request. The site employed HSTS, HTTP/3, and a Google Trust Services / WE1 SSL certificate, confirming the use of modern TLS hygiene despite its malicious purpose.

Google Safe Browsing classifies the URL as a social‑engineering threat, and PhishDestroy has added it to its blocklist. VirusTotal scans flagged the domain in 15 of 93 vendor engines, reinforcing the malicious reputation. The domain appears on a single external security blocklist, suggesting limited exposure but sufficient detection by reputable sources.

Uncertainty remains regarding the exact payload delivery mechanism, as the site is offline and no page content has been captured. Defenders should continue to block the domain at DNS and proxy layers, monitor for any re‑registration attempts, and correlate any traffic to 172.66.44.149 with known crypto‑drainer patterns. Threat Intel feeds should be updated to retain the indicator for future correlation, and incident response teams should treat any contact involving the domain as compromised and instruct users to revoke any cryptocurrency credentials that may have been exposed.