# coinbase-us--wallet-extension.pages.dev — MALICIOUS

> coinbase-us--wallet-extension.pages.dev is a phishing site impersonating Coinbase. Learn how to protect your crypto assets from this scam.

## Summary
PhishDestroy identifies coinbase-us--wallet-extension.pages.dev as a high-risk phishing domain impersonating Coinbase, a well-known cryptocurrency platform. This site poses a serious danger by attempting to trick users into revealing sensitive information such as login credentials, putting their digital assets at risk.

This phishing attempt works by mimicking the Coinbase wallet extension interface to deceive users into entering their private keys or passwords. The domain was flagged by multiple security services, including Google Safe Browsing for social engineering, and appeared on several security blocklists. Although now taken offline, the domain was active since February 21, 2026, and resolved to an IP address linked to Cloudflare.

If you have visited this site, immediately change your Coinbase and related account passwords. Enable two-factor authentication where possible and monitor your accounts for suspicious activity. Avoid clicking on suspicious links or entering sensitive data on unverified websites. For ongoing protection, rely on trusted sources and official Coinbase channels only.

## Threat Details
- Verdict: MALICIOUS
- Site status: dead (HTTP 403)
- Target brand: Coinbase
- Page title: Suspected phishing site | Cloudflare

## Domain Intelligence
- Registered: 2026-02-21 07:01:08
- Registrar: Cloudflare, Inc.
- Country: US
- IP: 172.66.47.64
- IP Country: US
- IP City: San Francisco
- IP Org: AS13335 Cloudflare, Inc.
- Nameservers: ["crystal.ns.cloudflare.com", "jeremy.ns.cloudflare.com"]
- SSL Issuer: Google Trust Services / WE1

## Detection Status
- VirusTotal: 13 vendors flagged
  Vendors: ["ADMINUSLabs", "ChainPatrol", "alphaMountain.ai", "BitDefender", "CyRadar", "ESET", "Fortinet", "G-Data", "Google Safebrowsing", "Kaspersky", "Lionic", "Sophos", "VIPRE"]
- Google Safe Browsing: FLAGGED
- Blocklists: 3 hits
  Lists: ["PhishDestroy", "MetaMask", "SEAL"]

## Evidence
- Screenshot: https://urlscan.io/screenshots/019ceff4-d678-763e-b37e-7f356daf3b9a.png
- Cloudflare Radar: https://radar.cloudflare.com/scan/8cc9c5d4-e181-4b40-bddb-8e4c3a98d846
- PhishDestroy: https://phishdestroy.io/domain/coinbase-us--wallet-extension.pages.dev/
- LLM endpoint: https://phishdestroy.io/domain/coinbase-us--wallet-extension.pages.dev/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/coinbase-us--wallet-extension.pages.dev/
Last updated: 2026-03-19