key-coinbas-extension-getting[.]pages[.]dev

The domain key-coinbas-extension-getting.pages.dev was registered on February 21, 2026 through Cloudflare, Inc., and its DNS is served by the Cloudflare nameservers brian.ns.cloudflare.com and ashley.ns.cloudflare.com. The site resolves to the IP address 188.114.96.3, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. When accessed, the server returns HTTP 403, and the presented TLS certificate is issued by Google Trust Services under the "WE1" label, indicating a valid certificate chain but not confirming legitimacy of the content. The page title returned is "Suspected phishing site | Cloudflare," matching the pattern used by Cloudflare’s default block page.

Google Safe Browsing has classified the URL as a social‑engineering threat, and the domain appears on a single security blocklist, currently blocked by PhishDestroy. VirusTotal analysis shows that 16 of 93 scanning engines flag the domain, reinforcing its malicious reputation. The site is identified as a crypto‑related scam that impersonates the Coinbase brand, aligning with the reported "brand impersonation" and "Crypto Scam" categories. Gridinsoft assigns a trust score of 0 / 100, indicating the lowest possible confidence in the domain’s safety.

The infrastructure is presently offline, suggesting that the operators have taken the site down or that it has been seized. Defenders should continue to block the domain at the DNS and proxy layers, monitor the associated IP address for any re‑use, and update detection rules to capture similar Cloudflare‑hosted impersonation patterns. Further analysis of any residual artifacts, such as URLs cached by security vendors or user reports, would clarify whether the site hosted additional malicious payloads before takedown.