coinbaseextension-guide[.]pages[.]dev

Analysis of the domain coinbaseextension-guide.pages.dev indicates a high-risk brand impersonation targeting Coinbase, a cryptocurrency exchange platform. The domain was registered on February 21, 2026, through Cloudflare, Inc., and is hosted on Cloudflare infrastructure (AS13335) with an IP resolution of 172.66.47.156. The site is currently offline, returning an HTTP 403 status, and is flagged under the page title 'Suspected phishing site | Cloudflare.' Google Safe Browsing has classified this domain as engaging in social engineering, while PhishDestroy has blocked access to it. As of the report date, the domain appears on one security blocklist, and 17 of 95 security vendors on VirusTotal have flagged it as malicious, though the exact nature of the threat remains unverified due to the site's offline status.

Infrastructure analysis reveals the use of Cloudflare nameservers (rustam.ns.cloudflare.com and priscilla.ns.cloudflare.com) and an SSL certificate issued by Google Trust Services (WE1). The domain's trust score from Gridinsoft is 0/100, further supporting its classification as high-risk. While the scam type is identified as a crypto scam, specific details about the phishing mechanics—such as credential harvesting, wallet drainers, or fraudulent token schemes—are not available due to the lack of active content analysis. Defenders should treat this domain as malicious and prioritize blocking it at the DNS or proxy level.

Given its association with Coinbase impersonation and crypto-related fraud, organizations handling cryptocurrency transactions or user data should monitor for related indicators of compromise, such as unusual login attempts or wallet activity linked to this domain. If historical traffic logs exist, retroactive analysis may reveal additional compromised accounts or fraudulent transactions. The domain's current offline status does not guarantee permanent mitigation, and continued monitoring for reactivation is recommended.