coinbascom-chrome-wallet[.]pages[.]dev

The domain coinbascom-chrome-wallet.pages.dev was created on February 21, 2026 and is registered through Cloudflare, Inc. It resolves to the IP address 188.114.97.3, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The site is protected by a Google Trust Services / WE1 SSL certificate and serves content over HTTP/3 with HSTS enabled, indicating modern web protocol support. An HTTP request to the host returns a 403 status code, and the page title presented by Cloudflare is "Suspected phishing site | Cloudflare," confirming that the domain has been flagged by the provider’s abuse mitigation system. The domain is listed on a single security blocklist and has been actively blocked by PhishDestroy.

Google Safe Browsing categorises the site as social engineering, and the Gridinsoft trust score assigns a rating of 0 out of 100, reflecting a high confidence of malicious intent. VirusTotal analysis shows that 14 of 93 scanned security vendors flagged the domain, reinforcing the suspicion of abuse. The identified scam type is a crypto scam, specifically a crypto drainer, targeting users of cryptocurrency wallets. The infrastructure evidence, including the use of Cloudflare’s DNS (nameservers sureena.ns.cloudflare.com and huxley.ns.cloudflare.com) and the low trust score, suggests a short‑lived operation designed to evade detection while leveraging reputable hosting services.

The current status is offline, which may indicate takedown or temporary suspension. Defenders should continue to monitor the associated IP range for related activity, enforce blocklist rules for the domain and its IP, and ensure that endpoint protection solutions are updated to reflect the 14 vendor detections. Organizations should also educate users about unsolicited wallet‑related links and advise verification of URL authenticity before any credential or transaction submission.