coin-base-exta-ntsion[.]pages[.]dev

On July 24, 2026 analysts observed that the domain coin-base-exta-ntsion.pages.dev was taken offline after being identified as a high‑risk brand‑impersonation site targeting Coinbase users. The site was registered on February 21, 2026 through Cloudflare, Inc., and the authoritative nameservers skip.ns.cloudflare.com and desi.ns.cloudflare.com resolve the domain to the IP address 172.66.47.167, which belongs to AS13335 Cloudflare, Inc. in the United States. The TLS certificate presented is issued by Google Trust Services under the WE1 certificate authority, indicating a valid HTTPS configuration, while HTTP headers reveal the use of HSTS, Cloudflare edge services, and HTTP/3. Accessing the URL returned an HTTP 403 response, and the page title displayed "Suspected phishing site | Cloudflare," confirming that Cloudflare has flagged the content as malicious.

The site was blocked by PhishDestroy and appears on one additional security blocklist. Google Safe Browsing classified the domain as social engineering, and VirusTotal reported that 11 of 95 scanned vendors flagged the domain, reinforcing the malicious assessment. Gridinsoft assigned a trust score of 0 out of 100, reflecting extreme distrust.

The identified scam type is a crypto scam that impersonates Coinbase, though the specific payload or credential‑harvesting mechanisms were not captured before the takedown. Defenders should continue to block the domain at perimeter controls, monitor for any resurgence of similar subdomains under the pages.dev namespace, and educate users that any unsolicited Coinbase‑related requests should be verified against official channels. Ongoing threat‑intel feeds should be consulted for potential re‑use of the underlying Cloudflare infrastructure in future campaigns.