cobase-page[.]wixstudio[.]com

The domain cobase-page.wixstudio.com was identified as a brand impersonation phishing site targeting users of Base, a cryptocurrency platform associated with Coinbase. Analysis indicates the site presented itself as a legitimate Coinbase Wallet portal, using the page title "Coinbase Extension® — Getting Started | Coinbase Wallet®" to deceive visitors into entering credentials or sensitive information. The domain is currently offline, but prior activity and infrastructure details confirm malicious intent. Infrastructure analysis reveals the domain was registered through GoDaddy.com, LLC and resolved to the IP address 34.144.206.118, hosted on Google Cloud infrastructure. It was flagged by 13 of 95 security vendors on VirusTotal, with a Gridinsoft trust score of 0/100. The domain appeared on five security blocklists, including MetaMask, PhishDestroy, PhishingArmy, SEAL, and OISD. Detected technologies include Wix, React, RequireJS, Lodash, HSTS, and Google Cloud CDN, suggesting a structured phishing framework designed to mimic legitimate platforms. Given the high-risk classification and confirmed brand impersonation tactics, users who interacted with this domain should assume credential exposure. Immediate actions include resetting passwords for any accounts accessed via the site, enabling multi-factor authentication, and monitoring for unauthorized transactions. Organizations should update blocklists to include this domain and its associated IP, while security teams should investigate logs for connections to 34.144.206.118. Despite its current offline status, the domain may resurface under a different name or infrastructure, warranting continued vigilance.