extension-coenbase-io[.]pages[.]dev

The domain extension-coenbase-io.pages.dev was created on February 21, 2026 and is registered through Cloudflare, Inc. It resolves to the IPv6 address 2606:4700:310c::ac42:2ce5, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The site presents a Cloudflare‑generated page titled "Suspected phishing site | Cloudflare" and returns an HTTP 403 status code. Technical fingerprints show the use of HSTS, Cloudflare services, and HTTP/3, with authoritative nameservers gina.ns.cloudflare.com and clint.ns.cloudflare.com. The SSL certificate is issued by Google Trust Services under the WE1 label.

Threat intelligence classifies the content as a brand‑impersonation generic phishing campaign. The domain appears on a single security blocklist and is blocked by PhishDestroy. Its Gridinsoft trust score is 0 out of 100, indicating a lack of trust. Google Safe Browsing flags the domain for social‑engineering, and VirusTotal reports that 10 of 93 security vendors have flagged the domain as malicious.

The current operational status is offline, which may be temporary or a takedown action. Defenders should continue to block the domain at perimeter defenses, monitor for any reappearance of the same IP or hosting infrastructure, and update detection rules to include the observed nameservers and SSL certificate details. Because the site is already listed on a blocklist and flagged by multiple vendors, proactive filtering is recommended. Uncertainty remains around the specific brand being impersonated, as the page title does not disclose a target brand, so additional investigation of any associated URLs or email campaigns is advised to determine the full scope of the impersonation attempt.