# coin-base-extantion-eng.pages.dev — MALICIOUS

> coin-base-extantion-eng.pages.dev poses a high phishing risk by mimicking Coinbase. Learn why this site is unsafe and how to stay protected.

## Summary
PhishDestroy identifies coin-base-extantion-eng.pages.dev as a high-risk phishing site impersonating the Coinbase brand to deceive users. The domain was flagged by multiple security tools and Google Safe Browsing for social engineering threats.

This phishing page tricks victims by mimicking Coinbase’s appearance, aiming to steal login credentials or sensitive data. It was registered through Cloudflare and has since been taken offline due to its malicious nature.

If you visited this site, immediately change your Coinbase passwords and enable two-factor authentication. Avoid clicking suspicious links and report any unusual account activity to Coinbase support for further assistance.

## Threat Details
- Verdict: MALICIOUS
- Site status: dead (HTTP 403)
- Target brand: Coinbase
- Page title: Suspected phishing site | Cloudflare

## Domain Intelligence
- Registered: 2026-02-21 07:01:08
- Registrar: Cloudflare, Inc.
- Country: US
- IP: 172.66.44.65
- IP Country: US
- IP City: San Francisco
- IP Org: AS13335 Cloudflare, Inc.
- Nameservers: ["vera.ns.cloudflare.com", "alec.ns.cloudflare.com"]
- SSL Issuer: Google Trust Services / WE1

## Detection Status
- VirusTotal: 14 vendors flagged
  Vendors: ["ADMINUSLabs", "ChainPatrol", "alphaMountain.ai", "BitDefender", "CRDF", "CyRadar", "ESET", "G-Data", "Google Safebrowsing", "Kaspersky", "Lionic", "Sophos", "VIPRE", "Webroot"]
- Google Safe Browsing: FLAGGED
- Blocklists: 3 hits
  Lists: ["PhishDestroy", "MetaMask", "SEAL"]

## Evidence
- Screenshot: https://urlscan.io/screenshots/019aa6c1-0aef-7752-8e4d-6f9852d8d752.png
- Cloudflare Radar: https://radar.cloudflare.com/scan/1e5bd6d8-ffcf-499b-b7c9-4d977d2d5e6d
- PhishDestroy: https://phishdestroy.io/domain/coin-base-extantion-eng.pages.dev/
- LLM endpoint: https://phishdestroy.io/domain/coin-base-extantion-eng.pages.dev/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/coin-base-extantion-eng.pages.dev/
Last updated: 2026-03-19