extecoinbasecom[.]pages[.]dev

PhishDestroy has identified extecoinbasecom.pages.dev as an elevated-risk domain engaged in brand impersonation, specifically targeting Coinbase users. This threat is not a generic phishing attempt but a calculated impersonation of a well-known cryptocurrency platform, designed to trick users into divulging sensitive credentials or funds. The domain was registered on August 14, 2025, through Cloudflare, Inc., and resolved to IP address 172.66.44.175, which is associated with Cloudflare's infrastructure. Its SSL certificate was issued by Google Trust Services (WE1), lending a false sense of legitimacy to the fraudulent site. At the time of analysis, the domain was taken offline, but its presence on at least one security blocklist and a VirusTotal detection rate of 13 out of 95 security vendors underscore the risk it posed. The page title displayed by Cloudflare—'Suspected phishing site | Cloudflare'—indicates that hosting provider intervention occurred, likely due to abuse reports.

For users who may have encountered this domain, immediate action is necessary. Since this is a brand impersonation of Coinbase, victims should change their Coinbase account passwords and enable two-factor authentication (2FA) if not already active. Additionally, review account activity for unauthorized transactions and contact Coinbase support if any suspicious activity is found. Avoid clicking any links or downloading files from the domain, and ensure that any saved passwords for 'coinbase' are not reused elsewhere. PhishDestroy recommends monitoring financial accounts for unusual activity and running a security scan on devices that may have accessed the site. The domain's rapid takedown reflects proactive security measures, but users remain the last line of defense against such threats.