home-extension-coinbase-wallet[.]pages[.]dev

The domain home-extension-coinbase-wallet.pages.dev has been identified as a threat under the category of brand impersonation, specifically targeting Coinbase. The domain's current status is offline, indicating prompt action has been taken against this phishing attempt. The site's page title, 'Suspected phishing site | Cloudflare,' suggests that measures have been put in place to prevent any further harm.

Analysis of the domain reveals that it was flagged by 14 out of 95 security vendors on VirusTotal, showcasing a credible threat level. The domain was created on August 30, 2025, and was registered through Cloudflare, Inc. It resolves to the IP address 172.66.44.124 located in the United States, under AS13335 Cloudflare, Inc. Currently, the domain appears on one security blocklist and has been flagged by Google Safe Browsing as a phishing site. The SSL certificate is issued by Google Trust Services / WE1, which adds a layer of complexity to the impersonation.

Given its offline status, the immediate risk is mitigated. However, users and organizations should remain vigilant, especially those associated with Coinbase, to prevent exposure to similar threats. It is recommended that security teams update their blocklists to include this domain and perform routine checks on domains with similar naming conventions. Continuous monitoring of phishing feeds and threat intelligence services is advised to quickly identify and respond to emerging threats. Additionally, educating users about recognizing phishing attempts and reporting suspicious domains can aid in prevention efforts.