coinbasechrome-extension[.]pages[.]dev

coinbasechrome-extension.pages.dev is a tenant hostname on Cloudflare, not a separately registered domain. PhishDestroy first recorded this hostname on Feb 26, 2026. The hostname explicitly references Coinbase; stored content metadata identifies the same apparent target. The stored content classification is crypto scam. The assembled evidence scores 100/100 (critical).

Four independent sources are positive: VirusTotal, Google Safe Browsing, Cloudflare Radar, and URLScan. VirusTotal recorded 14 detections among 93 engines: ChainPatrol, Criminal IP, alphaMountain.ai, BitDefender, CyRadar, ESET, Forcepoint ThreatSeeker, Fortinet, G-Data, Google Safebrowsing, Lionic, Sophos, VIPRE, Webroot on Jul 18, 2026 at 16:45 UTC. Google Safe Browsing flagged the domain: Social Engineering on Mar 2, 2026 at 20:51 UTC. Cloudflare Radar classified the hostname as malicious and assigned the categories phishing and security threats; its verdict timestamp was not retained. URLScan returned a malicious verdict with score 100 on Mar 25, 2026 at 12:18 UTC. The evidence is not unanimous. The external blocklist snapshot contained no matches on Aug 7, 2026 at 18:20 UTC. URLQuery recorded no positive detection.

An access-restricted HTTP 403 response was recorded on Aug 7, 2026 at 01:01 UTC. Cloudflare is the hosting platform for this tenant, not its registrar. At collection time, the hostname resolved to 188.114.97.3 on AS13335 (CLOUDFLARENET - Cloudflare, Inc., US). The associated network metadata labels the endpoint as AS13335 Cloudflare, Inc. in San Francisco, US. This is shared platform infrastructure; the IP and ASN are hosting context, not attribution to unrelated tenants. The stored server header is cloudflare. Captured page title: “Suspected phishing site | Cloudflare”. DOM analysis completed on Apr 10, 2026 at 19:21 UTC; stored DOM score 0/100. The evidence archive retains 2 visual captures from PhishDestroy and URLScan. IoC extraction completed on Aug 1, 2026 at 04:27 UTC; stored 0 format-validated wallet addresses and 0 Telegram indicators. The platform TLS certificate was issued by Google Trust Services / WE1 with validity through May 4, 2026; checked Mar 15, 2026 at 08:10 UTC.

The 0/100 DOM score means that the DOM pass stored no scored indicators; it does not negate the independent source findings. Taken together, the page content and independent findings support classifying this hostname as Coinbase-themed crypto scam.