web-coinbaseextensionn[.]pages[.]dev

The domain web-coinbaseextensionn.pages.dev has been identified as a phishing site engaging in brand impersonation, specifically targeting users of Coinbase. This domain is currently offline, but while active, it posed a high risk to users by attempting to deceive them into providing sensitive information under the guise of a legitimate service. The site was flagged for phishing activities and was not safe for users.

Technical indicators for web-coinbaseextensionn.pages.dev include detection by 14 of 95 security vendors on VirusTotal, including ADMINUSLabs, ChainPatrol, and alphaMountain.ai. It was registered through Cloudflare, Inc., with a creation date of September 10, 2025, and resolved to the IP address 172.66.45.10. The domain was listed on one security blocklist, PhishDestroy, and its SSL certificate was issued by Google Trust Services / WE1. The Google Safe Browsing service flagged it for 'SOCIAL_ENGINEERING'. The site utilized technologies such as HSTS, Cloudflare, and HTTP/3.

For users who may have interacted with web-coinbaseextensionn.pages.dev, it is crucial to take immediate safety steps. If this was a cryptocurrency-related scam, users should revoke any token approvals and transfer their funds to a new secure wallet. If credentials were compromised, changing passwords and enabling two-factor authentication (2FA) is advised. Users should also monitor their accounts for any fraudulent activity. To report further issues with phishing, users can contact security services or platforms like Google Safe Browsing.