coinbase-en-extension[.]surge[.]sh

This domain, coinbase-en-extension.surge.sh, is a confirmed brand impersonation targeting Coinbase. It was registered through Surge.sh and hosted on a DigitalOcean server in the Netherlands (IP 188.166.132.94, AS14061). At the time of analysis, the domain was offline, returning an HTTP 404 status, and had been taken down by PhishDestroy. The page title was 'Coinbase Extension - Secure Crypto Management', consistent with a crypto scam designed to trick users into connecting wallets or revealing credentials. Security telemetry is strong: 16 of 95 security vendors on VirusTotal flagged the domain as malicious, and Google Safe Browsing classified it as social engineering.

It also appeared on at least one security blocklist. The SSL certificate was issued by Sectigo Limited (Sectigo RSA Domain Validation Secure Server CA), which is common for both legitimate and fraudulent sites. Nameservers were not found (NS_NOT_FOUND), likely due to the domain being taken offline. Infrastructure analysis shows the domain was set up specifically for phishing, with no legitimate Coinbase association.

Defenders should block this domain at the DNS and email gateway levels, and users who may have visited the site should be warned to avoid entering any credentials or connecting cryptocurrency wallets. The exact content of the landing page was not captured, but the title and brand target confirm the intent. No other scam categories beyond crypto brand impersonation are supported by the available data. The takedown action by PhishDestroy indicates the domain was actively monitored and neutralized, but similar domains may reappear under different subdomains or TLDs.