secure-coinbase-io-extensio[.]pages[.]dev

The domain secure-coinbase-io-extensio.pages.dev represents a significant phishing threat, specifically targeting the well-known brand Coinbase. This domain is designed to deceive users into believing it is associated with Coinbase, potentially leading to the unauthorized collection of sensitive information such as login credentials and financial data. The high risk is compounded by the domain's initial appearance of legitimacy, utilizing SSL certification from Google Trust Services / WE1, and an IP location in the United States under AS13335 Cloudflare, Inc.

In-depth analysis reveals specific indicators of the domain's malicious nature. According to VirusTotal, 15 out of 95 security vendors have flagged this domain as malicious. The domain was created on September 02, 2020, and it impersonates Coinbase by leveraging similar naming conventions. It is also registered through Cloudflare, Inc., a reputable service that provides an additional layer of deception. The domain resolves to IP address 172.66.47.72 and has been identified on one security blocklist. Furthermore, it is currently flagged by Google Safe Browsing as a phishing site, and its current status is offline, having been taken down by PhishDestroy.

Users who have visited this domain are advised to immediately change their Coinbase passwords and monitor their accounts for unauthorized transactions. It is crucial to enable two-factor authentication for an additional security layer. Users should also ensure their security software is up to date and perform a comprehensive scan of their systems to detect any potential malware that could have been downloaded from the site. Reporting the incident to security teams can also help mitigate further risks and assist in preventing future phishing attempts.