coinbas--en-extension-pro[.]pages[.]dev

The domain coinbas--en-extension-pro.pages.dev is identified as a brand impersonation threat targeting Coinbase. It was designed to deceive users by mimicking the legitimate platform and potentially harvesting sensitive information such as login credentials. No specific drainer kit has been associated with this domain yet, but the name similarity indicates a high risk of phishing attempts targeting Coinbase users.

The forensic investigation reveals several concrete technical indicators of malicious activity. The domain was flagged by 17 out of 95 security vendors on VirusTotal for phishing activity. Its registrar is Cloudflare, Inc., and it resolves to the IP address 188.114.96.3 under the US-based AS13335 network. The domain was created on October 08, 2025, and has been flagged by Google Safe Browsing as a phishing domain. Currently, it appears on one security blocklist, further confirming its malicious nature.

At present, the domain is offline, as indicated by its removal from active DNS resolution, and has been blocked by security providers such as PhishDestroy. Despite its offline status, the risk remains due to the potential existence of similar domains or reactivation under a different guise. Security teams should monitor for variations of this domain name and implement proactive blocking strategies via DNS and URL filtering to protect users from similar threats. Continuous user education on recognizing phishing attempts remains crucial in mitigating such risks.