info-safe-coinbase-wal-extension[.]pages[.]dev

This domain, info-safe-coinbase-wal-extension.pages.dev, is identified as a high-risk brand impersonation site targeting Coinbase, a cryptocurrency exchange platform. Analysis indicates the domain mimics Coinbase’s wallet extension interface, likely to harvest credentials or facilitate unauthorized transactions. No specific drainer kit signatures were confirmed, but the structure aligns with credential phishing tactics observed in prior cryptocurrency-related fraud campaigns. Infrastructure analysis reveals the domain was registered on October 09, 2025, through Cloudflare, Inc., and resolves to the IP address 172.66.44.216, hosted on AS13335 (Cloudflare, Inc.) in the United States. VirusTotal detections show 17 out of 95 security vendors flagging the domain as malicious. Google Safe Browsing classifies it as phishing, and it appears on at least one security blocklist. The SSL certificate is issued by Google Trust Services (WE1), a common attribute in both legitimate and malicious Cloudflare-hosted domains. The domain is currently offline, mitigating immediate user exposure. However, residual risk persists due to the potential for re-activation or migration to alternative infrastructure. Recommended actions include monitoring for re-registration under similar naming conventions, blocking the resolved IP at perimeter defenses, and alerting users to verify domain authenticity before interacting with cryptocurrency-related services. Historical patterns suggest such domains may resurface with minor variations, necessitating continuous vigilance.