coinbase--ext-browser-x-en[.]pages[.]dev

Analysis of coinbase--ext-browser-x-en.pages.dev indicates a high-risk crypto phishing domain impersonating Coinbase. The domain was registered on February 21, 2026, through Cloudflare, Inc., and resolves to IP 172.66.47.179, hosted on AS13335 (Cloudflare, Inc.) in the US. Nameservers betty.ns.cloudflare.com and rajeev.ns.cloudflare.com further confirm Cloudflare infrastructure. The domain currently returns an HTTP 403 status, though its page title prior to takedown was flagged by Cloudflare as 'Suspected phishing site.' Security vendor assessments reinforce the malicious classification: Scamadviser assigned a trust score of 1/100, Gridinsoft rated it 0/100, and Google Safe Browsing labeled it as social engineering.

Sixteen of 93 security vendors on VirusTotal detected the domain as malicious. It appears on one security blocklist and is blocked by PhishDestroy. SSL certificate data shows issuance by Google Trust Services (WE1), a common pattern in phishing domains leveraging Cloudflare's free certificates.

While the domain is now offline, its registration date, hosting provider, and detection metrics align with known crypto scam infrastructure. Defenders should treat this domain as confirmed malicious and prioritize blocking it at DNS and proxy layers. No evidence of a specific phishing kit or exact payload is available from the supplied data, but the combination of brand impersonation, low trust scores, and vendor detections justifies immediate containment.