coin-bse-extension[.]pages[.]dev

The domain coin-bse-extension.pages.dev is a confirmed generic phishing site designed to steal user credentials through credential phishing tactics. It does not impersonate a specific brand or utilize a known drainer kit. As of the latest verification, the site has been taken offline, but it previously posed a high risk to users who may have interacted with it.

Technical analysis of coin-bse-extension.pages.dev reveals multiple indicators of malicious activity. The domain was flagged by 11 of 95 security vendors on VirusTotal, including ChainPatrol, BitDefender, and CyRadar, and was listed on one security blocklist (PhishDestroy). Google Safe Browsing marked it for 'SOCIAL_ENGINEERING' under phishing threats. Registered through Cloudflare, Inc. on October 17, 2025, the domain resolved to the IP address 172.66.47.54, hosted by Cloudflare in the US (AS13335). The SSL certificate was issued by Google Trust Services / WE1, and the observed page title was 'Suspected phishing site | Cloudflare'. Technologies detected include HSTS, Cloudflare, and HTTP/3, with an HTTP status of 403 at the time of takedown.

Users who may have entered credentials on coin-bse-extension.pages.dev should immediately change passwords for all accounts accessed from the same device or network, enable two-factor authentication (2FA) where available, and monitor accounts for unauthorized activity. Report the phishing domain to Google Safe Browsing, the registrar (Cloudflare), and platforms like PhishTank or the Anti-Phishing Working Group (APWG) to aid in broader mitigation efforts.