homepage-coinbase-extension[.]pages[.]dev

On 23 July 2026, analysts observed that the domain homepage-coinbase-extension.pages.dev was taken offline after being identified as a high‑risk brand‑impersonation site targeting Coinbase users. The site resolved to the IP address 188.114.96.3, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. Hosting metadata shows the domain is registered through Cloudflare, Inc., and uses Cloudflare‑provided nameservers kayleigh.ns.cloudflare.com and dan.ns.cloudflare.com. The web server presented an HTTP 403 response and advertised the page title "Suspected phishing site | Cloudflare".

TLS negotiation employed a certificate issued by Google Trust Services under the WE1 designation, and the connection employed HSTS and HTTP/3, indicating modern security features on the infrastructure despite malicious intent. Google Safe Browsing classified the domain as "social engineering", and VirusTotal recorded twelve detections out of ninety‑three scanned vendors. The site appeared on a single security blocklist and received a Gridinsoft trust score of 0 / 100. The content was labeled as a "Crypto Scam" and explicitly impersonated the Coinbase brand.

The domain was created on 21 February 2026 and was subsequently blocked by PhishDestroy. While the page content has not been examined, the combination of brand impersonation, cryptoscamming classification, and multiple vendor detections confirms a high‑confidence malicious profile. Defenders should continue to block the domain at perimeter and DNS layers, monitor for any re‑registration attempts, and advise users to verify any unsolicited Coinbase‑related communications against official channels.