public-extension-coibase[.]pages[.]dev

The domain public-extension-coibase.pages.dev was registered on February 21, 2026 through Cloudflare, Inc. and resolves to the IPv6 address 2606:4700:310c::ac42:2f6b, which is associated with AS13335 Cloudflare, Inc. located in the United States. The site presented the page title "Suspected phishing site | Cloudflare" and was classified as a crypto scam that impersonates the Coinbase brand. Security telemetry indicates the domain appears on a single blocklist and is actively blocked by PhishDestroy. VirusTotal analysis recorded eight detections out of ninety‑five scanning engines, and Google Safe Browsing flagged the URL for social engineering.

The TLS certificate is issued by Google Trust Services under the WE1 identifier, confirming the use of a valid HTTPS certificate. Infrastructure observations show the presence of HSTS, Cloudflare edge services, and HTTP/3 support. Gridinsoft assigned a trust score of zero out of one hundred, reinforcing the malicious assessment. An HTTP 403 response was returned at the time of testing, and the domain is currently marked offline.

Nameservers listed are deborah.ns.cloudflare.com and yisroel.ns.cloudflare.com. While the technical fingerprint confirms a credential‑theft infrastructure targeting Coinbase users, the exact payload or phishing page content has not been captured. Defenders should continue to block the domain at network perimeter devices, update URL filtering lists with the observed indicators, and monitor for any re‑registration attempts that reuse the same nameserver pattern or Cloudflare‑based hosting. Incident response teams should also consider notifying affected Coinbase customers of the impersonation attempt and advise them to verify URLs before entering credentials.