imp-coinbase-extension[.]pages[.]dev

Analysis of imp-coinbase-extension.pages.dev indicates a high‑risk brand‑impersonation campaign targeting Coinbase users. The domain was registered on 21 February 2026 through Cloudflare, Inc., and resolves to the Cloudflare edge address 172.66.47.92, which belongs to ASN 13335 (Cloudflare, Inc.) located in the United States. The site presents the generic Cloudflare page title “Suspected phishing site | Cloudflare” and returns HTTP 403, suggesting the content has been removed or access denied. Security‑vendor scanning on VirusTotal shows that 13 of 93 engines flagged the domain as malicious, and Google Safe Browsing lists it as a social‑engineering threat.

Independent reputation services assign a Gridinsoft trust score of 0 / 100 and the domain appears on a single security blocklist. The SSL certificate is issued by Google Trust Services under the WE1 root, confirming the use of a valid TLS certificate despite the malicious intent. Nameservers are aspen.ns.cloudflare.com and darl.ns.cloudflare.com, both owned by Cloudflare.

The campaign is classified as a crypto‑scam, leveraging Coinbase’s brand to lure victims. Defensive recommendations include adding the domain and its IP address to network blocklists, monitoring for similar sub‑domains under the *.pages.dev namespace, and enforcing DNS‑level filtering for Cloudflare‑hosted malicious domains. Continuous re‑evaluation is advised because the domain’s status may change if the operators reactivate the site.