coinbase-shoud-extension[.]pages[.]dev

The domain coinbase-shoud-extension.pages.dev was registered on February 21, 2026 through Cloudflare, Inc. and uses the Cloudflare nameservers tosdana.ns.cloudflare.com and fiona.ns.cloudflare.com. DNS resolution points to IP address 188.114.96.3, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The site presented the HTTP status code 403 when accessed and carried a valid SSL certificate issued by Google Trust Services under the WE1 label. Cloudflare‑provided security headers such as HSTS and HTTP/3 were observed.

Google Safe Browsing has flagged the domain for social engineering, and the page title returned by the server is "Suspected phishing site | Cloudflare", indicating that the content has been classified as a phishing landing page. The domain is listed on a single security blocklist and has a Gridinsoft trust score of 0 out of 100, reflecting an extremely low reputation. VirusTotal analysis shows that 15 of 93 security vendors have flagged the domain, and the domain is currently blocked by PhishDestroy. The threat actor explicitly impersonates the Coinbase brand and the activity has been categorized as a crypto scam.

The site is currently offline, but historical evidence suggests it was used to lure victims with a Coinbase‑styled interface. Defenders should continue to block the domain at perimeter firewalls, update URL filtering policies to include the domain and associated IP address, and monitor for any resurgence of the domain or similar sub‑domains under the pages.dev namespace. Additional threat‑intel feeds should be queried for related indicators of compromise, and any internal logs that reference connections to 188.114.96.3 should be investigated for potential exposure.