coinbasechrome-extension[.]pages[.]dev

This domain, coinbasechrome-extension.pages.dev, was identified as a high-risk phishing infrastructure impersonating Coinbase, a cryptocurrency exchange platform. Registered on February 21, 2026, through Cloudflare, Inc., the domain leveraged Cloudflare's hosting and DNS services, resolving to the IP address 188.114.97.3 (AS13335, Cloudflare, Inc., US). The SSL certificate was issued by Google Trust Services (WE1), and the domain employed security technologies such as HSTS and HTTP/3, which are often used to lend legitimacy to malicious sites. At the time of assessment, the domain returned an HTTP 403 status, and its page title was 'Suspected phishing site | Cloudflare,' indicating it had been flagged by the hosting provider.

Analysis of detection vendor data reveals that 14 out of 93 security vendors on VirusTotal flagged the domain as malicious, while Google Safe Browsing classified it as engaging in social engineering. The domain appeared on at least one security blocklist and was blocked by PhishDestroy. Trust scores from Gridinsoft and Scamadviser were both 0/100 and 1/100, respectively, further supporting its classification as malicious. The domain's nameservers were nova.ns.cloudflare.com and nikon.ns.cloudflare.com, consistent with Cloudflare-managed infrastructure.

While the domain is currently offline, defenders should treat any residual DNS records, SSL certificates, or cached references as indicators of compromise. Historical WHOIS data and passive DNS records may reveal additional infrastructure tied to this campaign. Given the domain's explicit targeting of Coinbase users and its classification as a crypto scam, security teams should prioritize monitoring for similar domains leveraging Cloudflare Pages or other hosting services to impersonate cryptocurrency platforms. No evidence of a specific phishing kit or payload was provided, so further forensic analysis of archived content may be necessary to determine the exact attack methodology.