help-coinbas-exttnsion[.]pages[.]dev

This domain, help-coinbas-exttnsion.pages.dev, poses a high-risk brand impersonation threat targeting users of a major cryptocurrency exchange platform. The site was designed to mimic legitimate login or wallet interfaces, tricking visitors into entering sensitive credentials, recovery phrases, or two-factor authentication codes. Such phishing infrastructure is frequently used to gain unauthorized access to digital asset accounts, leading to immediate financial theft or long-term account compromise. The domain's naming convention—incorporating terms like 'coinbas' and 'exttnsion'—suggests an attempt to deceive users searching for browser extensions or support portals associated with the targeted brand. Analysis indicates the domain was registered on November 04, 2025, through Cloudflare, Inc., and was hosted on infrastructure associated with the same provider, resolving to the IP address 172.66.46.243 within AS13335. The SSL certificate, issued by Google Trust Services (WE1), is commonly used by legitimate services, which may lend a false sense of security to unsuspecting users. At the time of detection, 11 out of 95 security vendors on VirusTotal flagged the domain as malicious, with additional confirmations from Google Safe Browsing and one security blocklist. The page title, 'Suspected phishing site | Cloudflare,' suggests the hosting provider later identified and restricted the content, though this occurred after initial exposure. Users who visited help-coinbas-exttnsion.pages.dev should assume their credentials or sensitive information may have been compromised. Immediate action is required: revoke any active sessions on the legitimate platform, change all associated passwords, and enable multi-factor authentication if not already in place. Monitor the targeted account for unauthorized transactions or configuration changes, and report any suspicious activity to the platform’s official support channels. Additionally, scan local devices for malware, as some phishing sites deploy scripts to harvest additional data or install backdoors. Avoid interacting with any links or communications claiming to be from the targeted brand unless verified through official, independently accessed channels.