coinbase--extension-set[.]pages[.]dev

This domain, coinbase--extension-set.pages.dev, is a high-risk credential phishing site specifically designed to impersonate the Coinbase cryptocurrency exchange platform. The site targets users by mimicking the legitimate Coinbase interface, aiming to harvest login credentials, two-factor authentication codes, and sensitive financial information. Analysis indicates the domain was constructed to exploit trust in the Coinbase brand, leveraging realistic UI elements and deceptive URLs to trick victims into disclosing account access details. The threat extends beyond individual compromise, as stolen credentials can facilitate unauthorized transactions, account takeovers, and broader financial fraud schemes targeting the cryptocurrency ecosystem. Infrastructure analysis reveals multiple concrete indicators supporting the phishing classification. The domain was registered on October 8, 2025, through Cloudflare, Inc., and is flagged by 16 out of 95 security vendors on VirusTotal as malicious. It appears on one security blocklist and is explicitly blocked by PhishDestroy. The domain resolves to the IP address 172.66.47.137, hosted on Cloudflare's US-based network (AS13335), and uses an SSL certificate issued by Google Trust Services (WE1). Google Safe Browsing has also classified the domain as phishing, further corroborating its fraudulent nature. The page title, 'Suspected phishing site | Cloudflare,' suggests even the hosting provider's automated systems detected and flagged the malicious intent. Users who visited coinbase--extension-set.pages.dev or entered credentials on the site should take immediate remedial action. First, revoke any active sessions and change passwords for Coinbase and any other accounts where identical or similar credentials may have been reused. Enable multi-factor authentication using an authenticator app or hardware key, avoiding SMS-based methods due to susceptibility to interception. Monitor all linked financial accounts and cryptocurrency wallets for unauthorized transactions, and report any suspicious activity to the legitimate platform. If personal or financial information was disclosed, consider placing a fraud alert with credit bureaus and reviewing identity theft protection measures. The domain has since been taken offline, but users should remain vigilant for follow-up phishing attempts via email or messaging platforms.