extension-coin-base-io[.]pages[.]dev

The domain extension-coin-base-io.pages.dev was observed on July 23, 2026 as part of a brand‑impersonation campaign targeting Coinbase. The site was hosted on Cloudflare’s edge network, indicated by the presence of HSTS, HTTP/3 support and the nameservers aurora.ns.cloudflare.com and otto.ns.cloudflare.com. DNS resolution points to IP address 172.66.47.62, which belongs to ASN 13335 (Cloudflare, Inc.) and is geolocated in the United States. Registration data show the domain was created on 21 February 2026 and was registered through Cloudflare, Inc., suggesting the attacker leveraged the provider’s free sub‑domain service.

The TLS certificate presented is issued by Google Trust Services under the WE1 root, a legitimate certificate chain, which may help evade naïve certificate checks. Reputation services indicate an extremely low trust rating: Scamadviser assigns 1 / 100 and Gridinsoft 0 / 100. The page title returned by the server is “Suspected phishing site | Cloudflare”, and the HTTP response code is 403, consistent with the domain being taken offline at the time of analysis. VirusTotal reports that 13 of 93 scanners flagged the domain, confirming malicious activity, and the domain appears on a single external blocklist.

Additionally, PhishDestroy has listed the domain as blocked, reinforcing the assessment that it was used for a crypto‑related scam. Evidence confirms the campaign’s objective was to impersonate the Coinbase brand, but the exact content of the landing page has not been captured, leaving the specific phishing vector unclear. Defenders should block the domain and its associated IP address, monitor for other sub‑domains under pages.dev that contain similar naming patterns, and update URL filtering rules to include the observed nameservers and certificate issuer as indicators of compromise. Ongoing intelligence collection should focus on any re‑registration attempts or related domains that reuse the same Cloudflare infrastructure.