coinbas-extansion[.]pages[.]dev

The domain coinbas-extansion.pages.dev was registered on 21 February 2026 through Cloudflare, Inc. and is hosted on Cloudflare’s network (AS13335) with the IP address 188.114.96.3 located in the United States. DNS resolution points to Cloudflare name servers algin.ns.cloudflare.com and nova.ns.cloudflare.com, confirming that the infrastructure is fully delegated to Cloudflare’s edge. The site presented a HTTP 403 response and the page title returned by the server is “Suspected phishing site | Cloudflare”, indicating that Cloudflare’s anti‑phishing service has already flagged the content. The SSL certificate is issued by Google Trust Services under the WE1 intermediate, which is typical for Cloudflare‑proxied sites and provides TLS 1.3 with HSTS enabled and HTTP/3 support. Reputation signals are strongly negative.

The Gridinsoft trust score is 0 out of 100, and the domain appears on one known security blocklist. PhishDestroy has taken the domain offline, and Google Safe Browsing categorises it as a social‑engineering threat. VirusTotal analysis shows that 16 of 93 scanning engines returned a detection, reinforcing the malicious assessment. The brand target is explicitly listed as Coinbase, and the scam type is identified as a crypto‑related scam, confirming that the domain is being used for brand impersonation aimed at cryptocurrency users.

Because the site is currently unreachable (offline) further content inspection is not possible, and the exact phishing page layout remains unverified. Nevertheless, the combination of a brand‑specific target, a Cloudflare‑served phishing warning page, multiple vendor detections, and a zero trust score provides ample evidence for a high‑risk classification. Defenders should immediately block coinbas-extansion.pages.dev at perimeter firewalls and DNS filters, add the IP address 188.114.96.3 to any malicious‑IP block lists, and monitor for other subdomains served from the same Cloudflare account.