process--extension-cobase[.]pages[.]dev

process--extension-cobase.pages.dev is flagged as a brand‑impersonation site targeting Coinbase users. The domain was registered on 7 November 2025 through Cloudflare, Inc. and uses the Cloudflare name servers pat.ns.cloudflare.com and sam.ns.cloudflare.com. DNS resolution points to 172.66.47.178, an address owned by AS13335 Cloudflare, Inc. in the United States. The site presents the page title “Coinbase Chrome Extension | Secure Crypto Access — Presentation,” which aligns with the declared scam type of wallet/seed phishing. SSL termination is performed by Google Trust Services under the WE1 certificate, and the server advertises HSTS, Cloudflare, and HTTP/3.

An HTTP GET returns status code 403, indicating that the content is no longer publicly reachable; the current status is listed as offline. Security‑engine analysis shows that PhishDestroy has blocked the domain, and it appears on one external blocklist. VirusTotal reports that ten of ninety‑five scanning engines flagged the domain as malicious. Independent reputation scoring from Gridinsoft assigns a trust score of 0 out of 100.

No additional intelligence such as Safe Browsing or OTX identifiers is available. Given the confirmed use of the Coinbase brand in the page title, the association with wallet/seed phishing, and the multiple detections across vendor feeds, the infrastructure should be treated as high‑confidence malicious. Defenders should add the fully qualified domain to URL filtering and DNS block lists, monitor the hosting IP 172.66.47.178 for any new subdomains, and enforce strict outbound traffic controls for Cloudflare edge nodes serving similar content. Continuous review of Cloudflare‑registered domains that reference Coinbase or cryptocurrency extensions is recommended to detect future deployments that may reuse this hosting pattern.