exten-coinbase-learn[.]pages[.]dev

The domain exten-coinbase-learn.pages.dev has been identified as a high-risk threat due to brand impersonation. This domain is currently offline and is known to impersonate the Coinbase brand, which is a prominent cryptocurrency exchange platform. It has been flagged for malicious activity and is suspected of attempting to deceive users by mimicking a legitimate service associated with Coinbase.

Technical analysis indicates that this domain resolves to IP address 172.66.47.178, registered through Cloudflare, Inc. The domain was created on October 14, 2025, and its SSL certificate is issued by Google Trust Services / WE1. Notably, it has been flagged by 14 out of 95 security vendors on VirusTotal, indicating a significant risk of exploitation. Google Safe Browsing has marked it for phishing activities, and it appears on one security blocklist. The domain is hosted in the United States under AS13335, associated with Cloudflare, Inc.

Currently, the domain is offline, reducing immediate risk to users. However, given its previous malicious activity, it is recommended that security teams continue monitoring for similar domain patterns and update blocklists accordingly. Users should be advised against interacting with any communications or links originating from this domain. It is crucial to educate users on verifying the authenticity of websites and services to prevent credential theft and financial loss, particularly from domains impersonating well-known brands like Coinbase.