coinbase-exxtansion[.]pages[.]dev

This report analyzes the domain coinbase-exxtension.pages.dev. The site's page title is "Suspected phishing site | Cloudflare," and it is designed to impersonate the Coinbase brand. It poses a threat as a cryptocurrency scam, specifically a phishing site intended to steal user credentials or funds by mimicking a legitimate platform.

Technical evidence confirms the malicious nature of this domain. VirusTotal shows 12 out of 95 security vendors flagged the site as malicious, with detections from ADMINUSLabs, ChainPatrol, BitDefender, CyRadar, and ESET. Google Safe Browsing has flagged the site for social engineering. The domain was created on 2025-10-14, registered through Cloudflare, Inc., and hosted on IP address 2a06:98c1:3121::3 (US), which belongs to AS13335 Cloudflare, Inc. It uses an SSL certificate from Google Trust Services / WE1 and is listed on 1 blocklist.

The site is currently down or offline. Its GridinSoft trust rating is 0 out of 100, and the DOM risk score is 100, indicating a very high risk. Given the confirmed phishing activity and multiple security vendor flags, this domain represents a severe threat and should be avoided.