wallet-extenstins-coinbasee-usa[.]pages[.]dev

The domain wallet-extenstins-coinbasee-usa.pages.dev was created on February 21, 2026 and is currently taken offline. It resolves to the IP address 188.114.97.3, which is allocated to AS13335 Cloudflare, Inc. in the United States. The site was registered through Cloudflare, Inc., and utilizes Cloudflare‑provided nameservers ariella.ns.cloudflare.com and walt.ns.cloudflare.com. TLS termination is performed by Google Trust Services under the WE1 certificate, and the site advertised HTTP security headers including HSTS and HTTP/3 support.

The HTTP response returned a 403 status code, indicating access denial at the time of observation. The page title reported by the scanner reads "Suspected phishing site | Cloudflare," and the threat is classified as a crypto‑related brand impersonation targeting Coinbase. Detection data shows that 14 of 93 security vendors on VirusTotal flagged the domain, and Google Safe Browsing labeled it as a social engineering threat. The domain appears on one external blocklist and has been blocked by the PhishDestroy service.

Independent scoring from Gridinsoft assigned a trust score of 0 out of 100, reflecting a high likelihood of malicious intent. While the site is no longer reachable, the infrastructure footprint—Cloudflare hosting, Google‑issued TLS, and the low trust score—suggests a deliberately crafted impersonation campaign. Defenders should continue to block the IP 188.114.97.3, add the domain to internal URL filtering and DNS sinkhole lists, and monitor for any re‑registration attempts or similar sub‑domains that reuse the same naming pattern. Continuous review of threat‑intel feeds for new entries referencing the same brand target or similar certificate parameters is recommended to pre‑empt potential re‑emergence.