en-extensn-coinbe[.]pages[.]dev

The domain en-extensn-coinbe.pages.dev is associated with a phishing scam involving brand impersonation of Coinbase. This domain has been flagged for phishing activities, specifically targeting users through social engineering tactics. It is currently offline, reducing immediate risk, but it previously posed an elevated threat level to users due to its intent to deceive individuals by mimicking the well-known cryptocurrency platform, Coinbase.

Technical indicators for en-extensn-coinbe.pages.dev include detection by 1 of 95 VirusTotal vendors, namely Trustwave. The domain was registered through Cloudflare, Inc., and was created on October 9, 2025. It resolves to the IP address 172.66.46.242 and has been blocked by PhishDestroy, appearing on one security blocklist. The SSL certificate was issued by Google Trust Services / WE1, and the domain has been flagged by Google Safe Browsing for 'SOCIAL_ENGINEERING'. The page title observed was 'CryptoWallet Browser Extension – Quick Guide', and the HTTP status is 403.

For those who may have interacted with en-extensn-coinbe.pages.dev, it is crucial to take immediate safety steps. Users should change their passwords, enable two-factor authentication, and closely monitor their accounts for any unauthorized activities. It is advisable to report any suspicious activities to security authorities and the impersonated brand, Coinbase. Staying vigilant and informed about phishing scams is essential to maintaining online security.