coin-bae-extantion-eng[.]pages[.]dev

This domain is flagged as a high-risk cryptocurrency wallet phishing site targeting users through fraudulent browser extension impersonation. Analysis indicates the domain is designed to harvest login credentials, private keys, and recovery phrases from victims under the guise of a legitimate wallet extension, posing a direct financial theft risk. Infrastructure analysis reveals the domain coin-bae-extantion-eng.pages.dev was registered on November 05, 2025, through Cloudflare, Inc. and resolves to the IP address 172.66.47.83, hosted on AS13335 (Cloudflare, Inc.) in the United States. The SSL certificate is issued by Google Trust Services (WE1). Detection engines on VirusTotal flag the domain as malicious, with 10 out of 95 security vendors identifying it as phishing. The domain appears on one security blocklist and is explicitly marked as phishing by Google Safe Browsing. The page title, 'Suspected phishing site | Cloudflare,' further confirms its malicious classification, and the domain has since been taken offline. Mitigation against this specific threat type requires immediate action. Users who accessed the domain should revoke any connected wallet permissions, rotate private keys, and monitor transactions for unauthorized activity. Browser extensions should be audited for unauthorized installations, and all credentials associated with cryptocurrency services must be updated. Network-level protections should block the domain and its resolving IP (172.66.47.83) across all security gateways. Organizations should update endpoint detection rules to flag similar phishing patterns, particularly those mimicking wallet extensions or using Cloudflare Pages infrastructure for credential theft.