coinbaseextensions[.]io

Coinbaseextensions.io is an active phishing domain impersonating the popular cryptocurrency platform Coinbase. Despite being flagged by only 1 out of 91 vendors on VirusTotal, the domain is already listed on three public blocklists, including PhishDestroy, MetaMask, and SEAL. The site uses a "Bot Verification" page to lure users into providing sensitive information.

The domain was registered with Sav.com, LLC and is hosted on IP address 198.251.84.236 in the United States, under the organization FranTech Solutions. The SSL certificate is issued by Let's Encrypt, which is commonly used by both legitimate and malicious sites due to its ease of access and free offering. The domain's creation date is June 19, 2026, and PhishDestroy detected it just three days later, highlighting the rapid identification of threats within the critical early window before antivirus databases typically update.

Coinbaseextensions.io exploits the trust users place in the Coinbase brand, aiming to steal credentials or financial information. The low abuse score of 10/100 suggests limited reporting activity, which may indicate the site is either new or not widely accessed yet. However, its presence on multiple blocklists suggests a growing recognition of its malicious intent. The early detection by PhishDestroy underscores the importance of proactive threat intelligence in identifying and mitigating risks before they proliferate.