coinbase-extension-oss[.]pages[.]dev

This domain, coinbase-extension-oss.pages.dev, poses a high-risk brand impersonation threat specifically targeting Coinbase users. Analysis indicates the site is designed to deceive visitors into entering legitimate credentials or wallet recovery phrases, likely functioning as a credential harvester or crypto drainer. The infrastructure mimics Coinbase’s official branding, including logos, color schemes, and login interfaces, to trick users into believing they are interacting with a trusted platform. Such impersonation attacks are commonly used to facilitate unauthorized access to cryptocurrency wallets or financial accounts, leading to asset theft or identity compromise. Evidence supporting the malicious classification includes detection by 14 out of 95 security vendors on VirusTotal, with Google Safe Browsing explicitly flagging the domain as phishing. The domain was registered on November 1, 2025, through Cloudflare, Inc., and resolves to the IP address 172.66.44.76, hosted under AS13335 (Cloudflare, Inc.). Additionally, the domain appears on one security blocklist and is blocked by PhishDestroy, further corroborating its fraudulent nature. The SSL certificate issued by Google Trust Services (WE1) does not mitigate the risk, as threat actors frequently abuse legitimate certificate authorities to lend credibility to malicious sites. Users who visited coinbase-extension-oss.pages.dev should immediately revoke any sessions or credentials entered on the site. If login details or wallet recovery phrases were provided, affected accounts must be secured by changing passwords and enabling multi-factor authentication where available. Cryptocurrency wallets should be reviewed for unauthorized transactions, and any suspicious activity reported to the relevant platform. Monitoring for follow-up phishing attempts via email or SMS is also advised, as threat actors may leverage stolen credentials for further attacks. The domain is currently offline, but users should remain vigilant for similar impersonation attempts targeting Coinbase or other financial services.