coinbasewaleet-axtnsn[.]pages[.]dev

The domain coinbasewaleet-axtnsn.pages.dev was registered on February 21, 2026 through Cloudflare, Inc. and is currently taken offline. DNS resolution points to IP address 188.114.97.3, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The authoritative nameservers are javier.ns.cloudflare.com and adrian.ns.cloudflare.com, indicating the use of Cloudflare’s DNS infrastructure. The site presented the page title "Suspected phishing site | Cloudflare" and employed HSTS, HTTP/3, and Cloudflare services, consistent with a typical phishing‑hosting setup.

An SSL certificate issued by Google Trust Services under the label WE1 was observed, suggesting a legitimate‑looking TLS connection. Security telemetry shows that 13 of 93 VirusTotal scanners flagged the domain, and Google Safe Browsing classified it as social engineering. Gridinsoft assigned a trust score of 0 out of 100, and the domain appears on a single external blocklist. PhishDestroy has already blocked the host, and the HTTP response returned a 403 status code, indicating restricted access.

The threat is identified as a crypto scam that impersonates the Coinbase brand, aligning with the "brand impersonation" label in the intelligence. Defenders should continue to block the IP 188.114.97.3 at network perimeter devices, add the domain to internal blocklists, and monitor Cloudflare‑registered subdomains for similar naming patterns. Continuous observation of VirusTotal and Google Safe Browsing updates is advised, as additional detections may emerge. Organizations that rely on Coinbase services should alert users to the existence of this impersonation attempt and reinforce credential hygiene.