baasetogether[.]pages[.]dev

This domain, baasetogether.pages.dev, operates as a credential phishing site specifically designed to impersonate Coinbase Wallet, a widely used cryptocurrency wallet service. The infrastructure is engineered to harvest login credentials, recovery phrases, and other sensitive authentication details from unsuspecting users. Analysis indicates the site employs visual and functional mimicry of the legitimate Coinbase Wallet interface, increasing the likelihood of successful deception. The primary threat vector involves tricking users into entering their private keys or passwords, which are then exfiltrated to attacker-controlled servers for unauthorized account access or asset theft. Infrastructure analysis reveals multiple technical indicators supporting the phishing classification. The domain was registered on April 17, 2026, through Cloudflare, Inc., and resolves to the IP address 172.66.47.98, located in California. The SSL certificate is issued by Google Trust Services (WE1), a common characteristic of both legitimate and malicious sites leveraging Cloudflare’s hosting infrastructure. As of the latest assessment, 18 out of 95 security vendors on VirusTotal flag this domain as malicious. Additionally, the domain appears on two security blocklists and is actively blocked by at least two anti-phishing tools. The page title, 'Coinbase Wallet,' further confirms the intent to deceive users into believing they are interacting with the official service. Users who visited baasetogether.pages.dev and entered any credentials or recovery phrases should assume their information has been compromised. Immediate action is required: revoke access to any connected sessions, change passwords for associated accounts, and enable multi-factor authentication where available. If cryptocurrency wallet details were entered, users should transfer assets to a new wallet with a fresh recovery phrase. Monitor accounts for unauthorized transactions and report the incident to the targeted service provider for further mitigation. Given the domain’s current offline status, continued vigilance is advised, as threat actors may reactivate similar infrastructure under different domains.