chrome-extenstion-coinbase--page-dev[.]pages[.]dev

The domain chrome-extenstion-coinbase--page-dev.pages.dev was registered on February 21, 2026 through Cloudflare, Inc. and resolves to the Cloudflare edge address 188.114.96.3, which is geolocated to Canada. DNS is served by joan.ns.cloudflare.com and dean.ns.cloudflare.com, and the site advertises HSTS and HTTP/3 support, indicating a modern Cloudflare‑hosted configuration. The page title returned by the server is "Suspected phishing site | Cloudflare" and the HTTP response code is 403, suggesting that the content is being blocked by the hosting provider. Google Safe Browsing has flagged the URL for social engineering, and VirusTotal reports that 13 of 93 scanning vendors have identified the domain as malicious.

The domain appears on a single security blocklist and has been actively blocked by PhishDestroy. Gridinsoft assigns a trust score of 0 out of 100, reinforcing the assessment of high risk. The site claims to impersonate Coinbase and is classified as a crypto scam, aligning with the observed brand target and scam type.

Current status is offline, but the infrastructure—particularly the Cloudflare‑based hosting and the low trust score—suggests the domain could be reactivated or used in future campaigns. Defenders should add the fully qualified domain name to blocklists at network and endpoint layers, monitor the associated IP address for re‑use, and incorporate the observed indicators (HTTP 403 response, Cloudflare nameservers, low Gridinsoft score, and VirusTotal vendor detections) into detection rules. Continuous reconnaissance of newly registered Cloudflare‑hosted domains that reference Coinbase or other financial brands is advised to pre‑empt similar impersonation attempts.