base-ext-extension[.]wixstudio[.]com

This domain, base-ext-extension.wixstudio.com, operates as a high-risk brand impersonation site targeting users of the Base cryptocurrency platform. Analysis of the page title, Coinbase®® - Wallet Extension™, reveals an attempt to deceive visitors into believing they are interacting with an official Coinbase or Base wallet extension. The domain mimics legitimate wallet services to harvest credentials or distribute malicious payloads, likely functioning as a crypto drainer or fake login portal designed to exfiltrate sensitive information such as private keys or recovery phrases. Infrastructure analysis reveals multiple technical indicators confirming malicious intent. The domain is flagged by 12 out of 95 security vendors on VirusTotal, with detections spanning phishing, brand impersonation, and malicious web content categories. It appears on three security blocklists, including PhishDestroy, PhishingArmy, and OISD. The domain was registered through GoDaddy.com, LLC, and resolves to the IP address 34.144.206.118. The SSL certificate is issued by Let's Encrypt, a common tactic to lend superficial legitimacy to phishing infrastructure. No legitimate creation date or historical context aligns with official Base or Coinbase services. Users who visited base-ext-extension.wixstudio.com should immediately revoke any permissions granted to browser extensions or applications linked to the domain. Clear browser cache, cookies, and active sessions to eliminate residual tracking or session hijacking risks. If credentials or private keys were entered, transfer assets to a new wallet and monitor all associated accounts for unauthorized transactions. Report the incident to relevant security teams or platforms, and avoid interacting with any further communications claiming to originate from Base or Coinbase until verified through official channels. The domain has been taken offline, but similar threats may persist under different infrastructure.