usser-coinbse-extsn[.]pages[.]dev

PhishDestroy has assessed usser-coinbse-extsn.pages.dev as a high-risk phishing threat, specifically targeting Coinbase users through a credential harvesting attack. This domain was designed to impersonate Coinbase's extension or login page, tricking victims into entering sensitive account information. The site has since been taken offline, but the threat remains relevant as similar domains may still be active.

Technical indicators reveal a clear malicious profile. The domain was created on October 25, 2025, just days before being flagged, and is registered through Cloudflare, Inc., resolving to IP address 172.66.47.190. VirusTotal analysis shows 16 out of 95 security vendors flagging this domain as malicious, and Google Safe Browsing lists it as a phishing site. The page title displayed 'Suspected phishing site | Cloudflare', indicating Cloudflare's own security mechanisms blocked access. The SSL certificate is issued by Google Trust Services (WE1), which is common for Cloudflare-proxied sites. The domain appears on one security blocklist and has a Cloudflare-generated seed of 60c3d7, which helps track its origin.

To protect against such Coinbase-themed phishing attacks, users should always verify URLs before entering credentials. Coinbase will never ask for login details via external pages or extensions. Enable two-factor authentication and use a password manager to avoid reusing passwords. If you have interacted with this domain, change your Coinbase password immediately and contact Coinbase support. Report any suspicious domains to Google Safe Browsing and your email provider to help block future threats.