coin-base-io-extension[.]pages[.]dev

The domain coin-base-io-extension.pages.dev was registered on February 21, 2026 through Cloudflare, Inc. and resolves to the IP address 172.66.45.39, which is owned by AS13335 Cloudflare, Inc. and geolocated to the United States. The site presents a page titled "Suspected phishing site | Cloudflare" and returns an HTTP 403 response, indicating that access was blocked at the web server level. The TLS certificate for the domain is issued by Google Trust Services under the WE1 designation, and the site is served over HSTS and HTTP/3, confirming the use of modern security protocols despite its malicious intent. Google Safe Browsing has flagged the domain for social engineering, and VirusTotal reports that 13 of 93 security scanners have flagged the domain as malicious.

Additional reputation data include a Gridinsoft trust score of 0 out of 100 and inclusion on a single security blocklist. PhishDestroy has also taken the domain offline, and the current status is listed as offline. The domain’s nameservers are journey.ns.cloudflare.com and nile.ns.cloudflare.com. The infrastructure is clearly aligned with a crypto‑related impersonation campaign targeting the Coinbase brand, as indicated by the declared brand target and the "Crypto Scam" classification.

While the page content has not been publicly analyzed, the convergence of multiple detection sources, a low trust score, and a brand‑specific phishing label strongly suggests a high‑risk credential‑harvesting operation. Defenders should block the domain at DNS and firewall layers, monitor for any associated C2 traffic to the Cloudflare IP range, and advise users to avoid any unsolicited communications that reference Coinbase login portals. Ongoing vigilance is recommended, as the attackers may repurpose the same infrastructure under a different subdomain or host.