guide-coinbase-extension-eng[.]pages[.]dev

The domain guide-coinbase-extension-eng.pages.dev was created on February 21, 2026 and is hosted behind Cloudflare infrastructure (AS13335, United States). It resolves to the IP address 172.66.44.168 and presents an HTTP 403 response, indicating that the site is currently inaccessible. The SSL certificate is issued by Google Trust Services under the WE1 profile, and the domain is registered through Cloudflare, Inc., using the authoritative nameservers nancy.ns.cloudflare.com and dakota.ns.cloudflare.com. The page title returned by the server is "Suspected phishing site | Cloudflare," which aligns with the reported brand impersonation of Coinbase and the classification of the activity as a crypto scam.

Detection services have flagged the domain: fourteen of ninety‑five VirusTotal scanners raise alerts, Google Safe Browsing lists it for social engineering, and PhishDestroy has blocked it. Additional reputation data shows a Gridinsoft trust score of zero out of one hundred and the domain appears on a single security blocklist. The presence of HSTS, Cloudflare and HTTP/3 technologies confirms modern TLS configuration but does not mitigate the malicious intent.

While the site is presently taken offline, the combination of brand impersonation, low trust score, multiple vendor detections, and blocklist entries indicates a high‑risk credential‑harvesting or crypto‑related fraud campaign targeting Coinbase users. Defenders should continue to block the domain at perimeter controls, monitor DNS queries for the associated nameservers, and correlate any attempted connections with endpoint alerts. Threat‑intel feeds should be updated to include the domain and its IP address, and any observed user reports of Coinbase‑related phishing should be escalated for further investigation.