in-coin-browser-extension[.]pages[.]dev

The domain in-coin-browser-extension.pages.dev is flagged for credential theft and is currently offline. It is suspected to impersonate a legitimate browser extension, potentially targeting users of a popular cryptocurrency service. This domain was registered through Cloudflare, Inc. and resolves to the IP address 188.114.96.3, which is located in the United States and belongs to AS13335 Cloudflare, Inc.

Analysis indicates that the domain was created on October 30, 2025, and has been flagged by 13 out of 95 security vendors on VirusTotal. The SSL certificate for this domain is issued by Google Trust Services / WE1. The domain appears on one security blocklist and has been blocked by PhishDestroy. Google Safe Browsing also identifies this domain as a phishing site. These indicators suggest a high risk of credential theft, where attackers may attempt to steal login credentials or other sensitive information from unsuspecting users.

Currently, the domain is offline, which may indicate that it has been taken down by the registrar or security organizations. However, users should remain vigilant and avoid accessing any related sites or installing any browser extensions from untrusted sources. Security teams are advised to monitor for any resurgence of this domain and to educate users on the risks of phishing and the importance of verifying the authenticity of browser extensions and websites.