learn-chrome-extenstion-coinbase[.]pages[.]dev

Analysis of learn-chrome-extenstion-coinbase.pages.dev indicates a high‑risk brand‑impersonation campaign targeting Coinbase users. The domain was registered through Cloudflare, Inc. on February 21, 2026 and resolves to IP address 188.114.96.3, which belongs to AS13335 Cloudflare in the United States. The site served an HTTP 403 response and presented the page title “Suspected phishing site | Cloudflare,” confirming that the host has been taken offline. SSL termination is performed by Google Trust Services using the WE1 certificate, and the site employed HSTS, Cloudflare’s CDN, and HTTP/3, suggesting a modern infrastructure that can be rapidly redeployed.

Google Safe Browsing has flagged the domain for social engineering, and VirusTotal recorded detections from 13 of 93 security vendors, reinforcing the malicious intent. The Gridinsoft trust score of 0 / 100 further demonstrates the site’s lack of legitimacy. It appears on a single security blocklist and has been blocked by PhishDestroy. Nameserver records point to joan.ns.cloudflare.com and dean.ns.cloudflare.com, both Cloudflare‑managed, which is consistent with the registrar information.

The campaign is classified as a crypto scam, leveraging the Coinbase brand to lure victims into credential or fund theft. No visual or content analysis is available beyond the page title, so the exact phishing vectors remain unknown. Defenders should immediately block the domain and its associated IP, incorporate the observed indicator set (domain, IP, nameservers, SSL certificate issuer, and detection signatures) into intrusion‑detection and web‑filtering rules, and monitor for similarly structured domains using the “learn‑chrome‑extenstion‑coinbase” naming pattern. Continuous watch of Cloudflare‑hosted assets and rapid response to new detections are recommended to mitigate further abuse.