coinbase--wallet--extension-a[.]pages[.]dev

The domain coinbase--wallet--extension-a.pages.dev has been identified as a high-risk threat due to its involvement in brand impersonation. It specifically targets Coinbase, a well-known cryptocurrency exchange platform. No drainer kit has been identified, but the domain is suspected of being used to deceive users into providing sensitive information.

Technical analysis indicates that the domain has been flagged by 15 out of 95 security vendors on VirusTotal, suggesting a moderate level of consensus among security professionals regarding its malicious intent. The domain was registered through Cloudflare, Inc., and resolves to the IP address 188.114.96.3, which is located in the United States and is part of the AS13335 Cloudflare, Inc. network. The domain was created on November 03, 2025, and appears on one security blocklist. Google Safe Browsing has also flagged the domain for phishing, further corroborating its malicious nature.

As of the latest analysis, the domain coinbase--wallet--extension-a.pages.dev is offline, which may indicate that it has been taken down as part of a mitigation effort. Despite the current offline status, the domain remains a potential risk and should be monitored for any future activity. Security researchers recommend that affected parties, particularly Coinbase users, remain vigilant and avoid interacting with any similar domains or suspicious links.