coinbase-xtnsion-log[.]pages[.]dev

This domain, coinbase-xtnsion-log.pages.dev, was identified as a high-risk phishing site impersonating Coinbase, a cryptocurrency exchange platform. The site likely aimed to deceive users into entering sensitive credentials, such as login details or wallet recovery phrases, under the pretense of a legitimate Coinbase extension or service. Such impersonation attacks often lead to unauthorized account access, financial theft, or installation of malicious software designed to drain cryptocurrency wallets. Users encountering this domain may have been exposed to fake login portals or fraudulent transaction prompts, increasing the risk of financial loss or identity compromise. Analysis indicates the domain was registered through Cloudflare, Inc., on February 21, 2026, and resolved to the IP address 172.66.44.57, hosted under AS13335 (Cloudflare, Inc.). The domain appears on one security blocklist and is flagged by Google Safe Browsing as phishing. VirusTotal detection shows 17 out of 95 security vendors marked the domain as malicious, with a page title of 'Suspected phishing site | Cloudflare.' The SSL certificate is issued by Google Trust Services (WE1), a common certificate authority, which does not mitigate the domain's fraudulent intent. The domain's infrastructure and hosting provider align with patterns observed in phishing campaigns leveraging cloud services to evade detection. Individuals who visited coinbase-xtnsion-log.pages.dev should immediately revoke any active sessions on Coinbase or related cryptocurrency platforms. Reset passwords using a secure device and enable multi-factor authentication if not already active. Monitor financial accounts and transaction histories for unauthorized activity, particularly focusing on cryptocurrency wallets or linked bank accounts. If credentials were entered, assume they are compromised and avoid reusing them across other platforms. Report the incident to the targeted brand's security team for further investigation and consider submitting the domain to additional threat intelligence platforms to aid in broader detection efforts.