moz-extension-getstarted-coinbase-extension[.]pages[.]dev

Analysis dated July 24 2026 identifies the domain moz-extension-getstarted-coinbase-extension.pages.dev as an offline site used for brand impersonation of Coinbase. The site resolves to 188.114.97.3, a Cloudflare‑hosted address located in the United States under ASN 13335. Nameserver records point to coco.ns.cloudflare.com and kellen.ns.cloudflare.com, confirming Cloudflare registration. The TLS certificate is issued by Google Trust Services (WE1), indicating a valid HTTPS endpoint despite the malicious purpose. HTTP response code 451 was returned, and the server advertises HSTS, Cloudflare, and HTTP/3 support.

The page title “Coinbase Wallet – Your key to the world of crypto” directly references Coinbase, aligning with the declared brand‑impersonation scam type. The domain appears on three independent blocklists—PhishDestroy, MetaMask, and SEAL—and is listed in three security blocklists overall. VirusTotal analysis shows nine of ninety‑one scanners flag the domain, and Gridinsoft assigns a trust score of 0 / 100, reinforcing the high‑risk assessment. Infrastructure evidence suggests the operator leveraged Cloudflare’s free tier to obtain a trusted certificate and hide behind a globally distributed edge network, a common tactic for rapid takedown evasion. The current offline status prevents direct content inspection, leaving the exact page payload unknown.

However, the combination of brand‑specific page title, blocklist presence, low trust score, and multiple vendor detections provides sufficient confidence to classify the domain as an elevated‑risk brand‑impersonation vector. Defenders should continue to block the domain at network perimeter and DNS layers, update URL filtering lists with the full domain, and monitor for any re‑registration or similar sub‑domains using the same naming pattern. Incident response teams should also alert users of Coinbase‑related phishing attempts and advise verification of URLs before credential entry.