all-extension-help[.]pages[.]dev

This domain, all-extension-help.pages.dev, is currently flagged as an active brand impersonation threat targeting Coinbase users. Analysis indicates the page presents itself as a legitimate Coinbase extension under the title "Coinbase Extension – Getting Started," suggesting an intent to deceive victims into interacting with fraudulent cryptocurrency services. The domain remains operational as of the latest verification, posing a direct risk to users who may mistake it for an official Coinbase resource.

Infrastructure analysis reveals the domain was registered on April 9, 2026, through Cloudflare, Inc., a registrar commonly utilized for both legitimate and malicious hosting. It resolves to the IP address 188.114.96.3, geolocated in Canada and associated with Cloudflare’s network infrastructure. Despite its recent creation, the domain has already been flagged on one security blocklist, though it remains undetected by all 95 vendors on VirusTotal as of the latest scan. The SSL certificate, issued by Google Trust Services (WE1), provides an additional layer of perceived legitimacy, potentially increasing the success rate of social engineering attacks.

Current risk assessment categorizes this domain as under active investigation, with no confirmed payload delivery or specific attack vector identified at this time. However, the combination of brand impersonation, recent registration, and minimal detection suggests a high potential for malicious activity. Users are advised to avoid interaction with the domain and report any encountered links to security teams. Organizations should update blocklists to include all-extension-help.pages.dev and monitor for related infrastructure, such as subdomains or similarly named pages, which may emerge as part of this campaign.