coinbase-chrom-ext[.]pages[.]dev

Analysis of the domain coinbase-chrom-ext.pages.dev indicates a high-risk crypto scam impersonating Coinbase, active as of February 2026 and taken offline by July 23, 2026. The domain was registered through Cloudflare, Inc. and resolved to IP 172.66.44.106 (AS13335, US), leveraging Cloudflare hosting and security features including HSTS and HTTP/3. SSL certification was issued by Google Trust Services (WE1), a common infrastructure choice for both legitimate and malicious sites. At the time of assessment, the domain returned an HTTP 403 status with the page title 'Suspected phishing site | Cloudflare', suggesting Cloudflare's automated detection or manual intervention flagged the content as malicious.

Google Safe Browsing classified the domain under 'social engineering', consistent with phishing or fraudulent activity targeting users of the Coinbase platform. The domain appeared on at least one security blocklist, and Gridinsoft assigned a trust score of 0/100, reflecting high confidence in its malicious nature. VirusTotal detections from 15 of 93 security vendors further corroborate the domain's association with phishing or scam activity, though the specific payload or attack vector remains unconfirmed due to the site's offline status. Defenders should treat this domain as confirmed malicious infrastructure.

Blocklist the domain and its resolving IP (172.66.44.106) at network and endpoint levels. Monitor for related subdomains under *.pages.dev or similar Cloudflare-hosted patterns, particularly those referencing cryptocurrency brands. Given the domain's use of Cloudflare nameservers (mark.ns.cloudflare.com, jewel.ns.cloudflare.com), consider monitoring DNS queries to these nameservers for additional indicators of compromise. No evidence suggests persistence or lateral movement, but historical logs should be reviewed for connections to this domain prior to its takedown.