# guide-coinbase-extension-eng.pages.dev — MALICIOUS

> guide-coinbase-extension-eng.pages.dev is flagged for phishing and social engineering. Learn the risks and protect your info. Avoid this site now.

## Summary
PhishDestroy identifies guide-coinbase-extension-eng.pages.dev as a high-risk phishing domain designed to deceive users. This site attempts to trick visitors into revealing sensitive data by impersonating trusted platforms, posing a serious threat to personal and financial information.

The phishing operation typically mimics Coinbase or related crypto services, using fake extensions or guides to lure users. Visitors may be prompted to enter login credentials or financial data, which attackers then steal for fraudulent purposes. The domain was quickly flagged by multiple security services and Google Safe Browsing due to its social engineering tactics.

If you have visited guide-coinbase-extension-eng.pages.dev, it is crucial to avoid entering any personal information and run a security scan on your device. Change passwords for any affected accounts immediately and monitor for suspicious activity. Always verify domain authenticity before interacting with crypto-related extensions or guides.

## Threat Details
- Verdict: MALICIOUS
- Site status: dead (HTTP 403)
- Target brand: Coinbase
- Page title: Suspected phishing site | Cloudflare

## Domain Intelligence
- Registered: 2026-02-21 07:01:08
- Registrar: Cloudflare, Inc.
- Country: US
- IP: 172.66.44.168
- IP Country: US
- IP City: San Francisco
- IP Org: AS13335 Cloudflare, Inc.
- Nameservers: ["nancy.ns.cloudflare.com", "dakota.ns.cloudflare.com"]
- SSL Issuer: Google Trust Services / WE1

## Detection Status
- VirusTotal: 14 vendors flagged
  Vendors: ["ADMINUSLabs", "ChainPatrol", "alphaMountain.ai", "BitDefender", "CyRadar", "ESET", "Fortinet", "G-Data", "Google Safebrowsing", "Kaspersky", "Lionic", "Sophos", "VIPRE", "Webroot"]
- Google Safe Browsing: FLAGGED
- Blocklists: 3 hits
  Lists: ["PhishDestroy", "MetaMask", "SEAL"]

## Evidence
- Screenshot: https://urlscan.io/screenshots/019caafa-3ff9-7605-88b8-4d1835ec8ac9.png
- Cloudflare Radar: https://radar.cloudflare.com/scan/2a9b888b-7e5a-4ab9-89f6-04a879e2aa60
- PhishDestroy: https://phishdestroy.io/domain/guide-coinbase-extension-eng.pages.dev/
- LLM endpoint: https://phishdestroy.io/domain/guide-coinbase-extension-eng.pages.dev/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/guide-coinbase-extension-eng.pages.dev/
Last updated: 2026-03-19