Security Scan: Coinbase Chrome Extension

Summary

API

This view is built from:

Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/40d53c1b-e762-4eac-8fde-6188a5f23ef5 Domain and IP registration (RDAP)/api/v1/rdap/40d53c1b-e762-4eac-8fde-6188a5f23ef5 Certificate Transparency/api/v1/ct/coin-base-extantion-wellet.pages.dev How often this domain was scanned/api/v1/domain/stats/coin-base-extantion-wellet.pages.dev Scan history for this domain/api/v1/domain/history/coin-base-extantion-wellet.pages.dev?limit=15

This website contacted 2 IPs in 1 country across 1 domain to perform 2 HTTP transactions. The main domain is coin-base-extantion-wellet.pages.dev and was registered 6 years ago.

Submitted URL: https://coin-base-extantion-wellet.pages.dev/"%3ECoinbase

AI Security Verdict

High Risk

Confidence: 78%

Risk Score

Fake 'Coinbase Chrome Extension' wallet page on a typosquatted pages.dev subdomain, displaying Coinbase branding and copyright on a domain Coinbase does not own. No forms or malware, but clear brand impersonation.

Risk Factors (4)

Typosquatting / brand impersonation of Coinbase on a non-official domain

Deceptive subdomain imitating a Coinbase browser-extension wallet

Free hosting-platform subdomain with unknown and potentially very recent creation date

Unranked domain claiming association with a major financial brand

Domain age information unavailable

Details

Page Title

Coinbase Chrome Extension

Scan Type

public

Favicon Hash

MMH3: 2044479060

MD5: 50f22036b3746620bd6dadc733a9cac5

Domain Name Analysis

The domain 'coin-base-extantion-wellet.pages.dev' uses the developer-focused generic top-level domain (.dev) and includes subdomain 'coin-base-extantion-wellet'. The registrable portion 'pages' spans 5 characters containing two vowels alongside three consonants. Tokenizing the label suggests one word: pages. No strong language cues emerged from the frequency lists.

Screenshot

Page Load Overview

4.84s

Total Load Time

3 KB

Total Size

Language Analysis

Primary Language

🇺🇸English

Code: en

Confidence:80%

Script:Latin

Direction:ltr

Detection Details

HTML Lang Attribute:en

Text Length:596 chars

Detector Agreement:67%

Website Classification

Primary Category

cryptocurrency45% confidence

Type: static

Method: structural

All Detected Categories

cryptocurrency

45%

Detected Features

No structural features detected

Domain & IP Information

Requests	IP Address	Location	AS Autonomous System
1	172.66.44.197Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
1	172.66.47.59Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
2	2	-	-

Detected Technologies3

HTTP/3

40%

Cloudflare Bot Management

40%

Cloudflare

40%

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T18B81401BA9F32042A443D4B56BB357982B74D817950FCA3C3B9D2298AF966D9C4A324C

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

96:THPsGJ0o5PcH0/5jgoZjnJpJL/NASLPwdFz1:LPsGJ0oRcHm5jgoVnJphurz1

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:3907:FgEDgAAwBgAgCQMoAAAAgACADJAAhAgKgAAgQAAHAGxAABAggsAAAAAJQEAgggEIggwEBBKCgCwCFggBIAwAQBIGUCAAAAAB

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:00030f3f3f0f030f

Perceptual Hash:805c79478367b6a7

Difference Hash:fdf7fffdfdffffff

Wavelet Hash:01031f3f3f1f070f

Color Hash:#8440bf

Other Hashes

Crop Resistant:fffffff3b3b3f3ff,d9ea3a36e8c93ffb,ffffffffffffffff,fdf7fffdfdffffff

Scan History

Scan history not available

Unable to load historical scan data

Security Scan Report: coin-base-extantion-wellet.pages.dev