coinbase-started-extnsn[.]pages[.]dev

The domain coinbase-started-extnsn.pages.dev was observed for the first time on February 21, 2026. Registration data show the domain was created through Cloudflare, Inc., and the authoritative name servers are norm.ns.cloudflare.com and monika.ns.cloudflare.com. DNS resolution points to the IP address 172.66.44.144, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The web server presents an SSL certificate issued by Google Trust Services under the WE1 root, indicating a valid TLS handshake, but HTTP requests receive a 403 response, suggesting that access is being denied or the content is being blocked.

Reputation services assign extremely low confidence scores: Gridinsoft rates the domain 0 out of 100 and Scamadviser assigns a score of 10 out of 100. The domain appears on a single security blocklist and is explicitly blocked by the PhishDestroy service. VirusTotal analysis records 14 positive detections out of 93 scanned engines, and Google Safe Browsing classifies the URL as a social‑engineering threat. The page title returned by the server is “Suspected phishing site | Cloudflare,” reinforcing the classification as a fraudulent site.

The threat profile indicates a brand‑impersonation campaign targeting Coinbase users, labeled as a “Crypto Scam.” No additional content has been harvested, and the 403 status prevents direct observation of the landing page. Consequently, the exact payload, credential‑stealing mechanisms, or redirect behavior remain unknown. Defenders should add the fully qualified domain name and its resolving IP to outbound and inbound blocklists, monitor for any future re‑registration of similar sub‑domains under the pages.dev namespace, and enforce multi‑factor authentication for Coinbase accounts. Continuous threat‑intel feeds should be consulted for updates, and any alerts from the listed security vendors should be investigated promptly.