just-coinbase-io-extension[.]pages[.]dev

Analysis of the domain just-coinbase-io-extension.pages.dev indicates a high-risk crypto scam impersonating Coinbase, confirmed by multiple technical indicators. The domain was registered on February 21, 2026, through Cloudflare, Inc., and resolved to the IP address 188.114.96.3, hosted on AS13335 (Cloudflare, Inc.) in the United States. At the time of assessment, the domain returned an HTTP 403 status with the page title 'Suspected phishing site | Cloudflare,' suggesting automated detection by the hosting provider. Security vendor engagement is limited but conclusive: 12 of 93 vendors on VirusTotal flagged the domain as malicious, while PhishDestroy explicitly blocked it.

The domain appears on one security blocklist, and Google Safe Browsing classified it under 'social engineering.' Trust scores reinforce the risk, with Scamadviser assigning a 10/100 and Gridinsoft a 0/100. The SSL certificate, issued by Google Trust Services (WE1), provides no additional red flags beyond standard encryption. Infrastructure analysis reveals the use of Cloudflare nameservers (rachel.ns.cloudflare.com and elmo.ns.cloudflare.com) and technologies including HSTS and HTTP/3.

The domain was taken offline prior to this report, though residual DNS records may persist. Defenders should treat this domain as confirmed malicious, block all resolutions, and monitor for re-emergence under similar naming patterns (e.g., Coinbase branding with appended subdomains or paths). No further content analysis is available, as the site is no longer accessible for inspection.