get-coinbase-extnsion[.]pages[.]dev

The domain get-coinbase-extnsion.pages.dev was created on February 21, 2026 and registered through Cloudflare, Inc. DNS resolution points to the IP address 172.66.44.57, which belongs to AS13335 Cloudflare, Inc. and is located in the United States. The domain is served behind Cloudflare’s edge network, employing HSTS and HTTP/3, and presents a TLS certificate issued by Google Trust Services (WE1). An HTTP request returns a 403 status code, indicating that the site is inaccessible, and the page title reported by the server is "Suspected phishing site | Cloudflare." Threat intelligence classifies the site as a brand‑impersonation campaign targeting Coinbase, specifically a crypto‑related scam. The platform is listed on one security blocklist and is actively blocked by PhishDestroy.

Reputation scoring from Gridinsoft assigns a trust score of 0 out of 100, reflecting extreme suspicion. Google Safe Browsing flags the domain for social engineering, and VirusTotal analysis shows that 15 of 93 scanning engines flag the domain as malicious. The combination of a low trust score, blocklist presence, and multiple vendor detections supports a high‑risk assessment. Defenders should immediately block any outbound or inbound traffic to get-coinbase-extnsion.pages.dev at the DNS or network level, and add the domain to internal threat intelligence feeds.

Monitoring for re‑registration or changes to the underlying IP address is advisable, as Cloudflare may host future variants. Since the site is currently offline, any attempts to access it will likely result in a 403 response, but the underlying infrastructure remains under the attacker’s control and could be re‑used. Continuous scrutiny of related Cloudflare‑hosted subdomains and similar naming patterns is recommended to prevent re‑deployment of the impersonation campaign.