# coinbase-com-extension-en.pages.dev — MALICIOUS

> The domain coinbase-com-extension-en.pages.dev is a phishing site targeting Coinbase users. Avoid it and never share personal info online.

## Summary
PhishDestroy identifies coinbase-com-extension-en.pages.dev as a high-risk phishing domain impersonating the Coinbase brand. This type of threat is critical because it attempts to deceive users into revealing sensitive information, such as login credentials or financial data, which can lead to identity theft or financial loss.

The domain was registered through Cloudflare, Inc. and resolves to IP address 172.66.44.199. It was created on February 21, 2026, and has been flagged by 14 out of 95 security vendors on VirusTotal. Additionally, Google Safe Browsing labels it as a social engineering threat, and it appears on three separate security blocklists. The site has since been taken offline, reducing immediate risk.

Users should remain vigilant and avoid interacting with coinbase-com-extension-en.pages.dev or any suspicious links claiming to be associated with Coinbase. Always verify URLs carefully and access Coinbase services through official channels only. If you suspect you have entered information on this or similar phishing sites, change your passwords immediately and monitor your accounts for unauthorized activity.

## Threat Details
- Verdict: MALICIOUS
- Site status: dead (HTTP 403)
- Target brand: Coinbase
- Page title: Suspected phishing site | Cloudflare

## Domain Intelligence
- Registered: 2026-02-21 07:01:08
- Registrar: Cloudflare, Inc.
- Country: US
- IP: 172.66.44.199
- IP Country: US
- IP City: San Francisco
- IP Org: AS13335 Cloudflare, Inc.
- Nameservers: ["sureena.ns.cloudflare.com", "huxley.ns.cloudflare.com"]
- SSL Issuer: Google Trust Services / WE1

## Detection Status
- VirusTotal: 14 vendors flagged
  Vendors: ["ADMINUSLabs", "ChainPatrol", "alphaMountain.ai", "BitDefender", "CyRadar", "ESET", "Fortinet", "G-Data", "Google Safebrowsing", "Kaspersky", "Lionic", "Sophos", "VIPRE", "Webroot"]
- Google Safe Browsing: FLAGGED
- Blocklists: 3 hits
  Lists: ["PhishDestroy", "MetaMask", "SEAL"]

## Evidence
- Screenshot: https://urlscan.io/screenshots/019cc7e3-9947-74b1-990a-285d15c64f58.png
- Cloudflare Radar: https://radar.cloudflare.com/scan/da760963-4ee7-4189-bfc2-605a0613e697
- PhishDestroy: https://phishdestroy.io/domain/coinbase-com-extension-en.pages.dev/
- LLM endpoint: https://phishdestroy.io/domain/coinbase-com-extension-en.pages.dev/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/coinbase-com-extension-en.pages.dev/
Last updated: 2026-03-19