coinbase-us--wallet-extension[.]pages[.]dev

This domain, coinbase-us--wallet-extension.pages.dev, operates as a fraudulent imitation of the legitimate Coinbase cryptocurrency wallet service. The site is designed to deceive users into entering sensitive account credentials, recovery phrases, or personal information under the false pretense of a Coinbase wallet extension. Such data, once captured, is typically used for unauthorized account access, financial theft, or further targeted attacks against victims. The domain mimics official Coinbase branding, including logos, color schemes, and interface elements, to increase the likelihood of successful deception, particularly among users expecting to interact with legitimate wallet services. Analysis indicates this domain was registered on October 28, 2025, through Cloudflare, Inc., and is hosted on infrastructure associated with the same provider. At the time of assessment, 13 out of 95 security vendors on VirusTotal had flagged the domain as malicious, with detections including phishing, brand impersonation, and fraudulent activity. The domain resolves to the IP address 172.66.47.64, located within Cloudflare’s autonomous system (AS13335), and uses an SSL certificate issued by Google Trust Services. Despite its current offline status, the domain remains a documented threat in security blocklists, including Google Safe Browsing and at least one other independent phishing detection service. Users who visited coinbase-us--wallet-extension.pages.dev should assume potential exposure of any entered credentials or sensitive data. Immediate steps include revoking access to any connected cryptocurrency wallets, changing passwords for associated accounts, and enabling multi-factor authentication where available. Monitor linked financial accounts and wallet addresses for unauthorized transactions. If recovery phrases or private keys were submitted, consider migrating assets to a new, secure wallet. Report the incident to the legitimate service provider for further guidance and to contribute to threat intelligence efforts. Avoid interacting with any communications claiming to be from Coinbase that reference this domain, as they may be part of follow-up phishing attempts.