coinbas-en--extension-pro[.]pages[.]dev

This domain, coinbas-en--extension-pro.pages.dev, was registered on February 21 2026 through Cloudflare, Inc. and resolves to the Cloudflare‑owned address 188.114.96.3 (AS13335, United States). The site presents the title “Suspected phishing site | Cloudflare” and serves HTTP/3 traffic over TLS with HSTS enabled. The TLS certificate is issued by Google Trust Services under the WE1 identifier, indicating a legitimate certificate chain but not confirming content safety. Google Safe Browsing classifies the URL as a social‑engineering threat, and Gridinsoft assigns a trust score of 0 / 100, the lowest possible rating.

VirusTotal records 16 of 93 scanning engines flagging the domain, consistent with its classification as a brand‑impersonation campaign targeting Coinbase. The domain appears on a single blocklist and has been actively blocked by PhishDestroy. The HTTP response code is 403, suggesting the page is currently inaccessible; the status field confirms the domain has been taken offline. Nameservers vick.ns.cloudflare.com and nina.ns.cloudflare.com are standard Cloudflare delegations.

The combined evidence points to a high‑risk, brand‑impersonation operation that leverages Cloudflare infrastructure to host malicious content. Defenders should add the domain to outbound filtering rules, monitor DNS queries for the associated IP address, and consider broader blocklisting of the entire pages.dev sub‑domain space when similar patterns emerge. Continuous re‑evaluation is advised in case the site is re‑hosted or the IP address is reused for other malicious payloads.