base-browser-extension[.]pages[.]dev

This domain, base-browser-extension.pages.dev, is flagged as an active brand impersonation threat targeting Coinbase users. Analysis indicates the page masquerades as the Coinbase Wallet Extension under the title 'Coinbase Wallet Extension - Secure Web3 Access,' attempting to deceive users into installing malicious browser components. The infrastructure appears designed to harvest cryptocurrency wallet credentials or deploy crypto drainer functionality, though no specific drainer kit signature has been confirmed at this time. Infrastructure analysis reveals the domain was registered through Cloudflare on March 25, 2026, resolving to IP address 172.66.47.49 (Cloudflare, Inc., CA). The domain appears on one security blocklist and is flagged by 6 of 95 security vendors on VirusTotal. The SSL certificate is issued by Google Trust Services (WE1), a common pattern observed in both legitimate and malicious Cloudflare-hosted domains. No Google Safe Browsing detections were reported at the time of analysis. The domain remains active as of the latest verification, though it has been blocked by at least one security provider. Response actions should include immediate blacklisting of the domain and IP across security gateways, as well as monitoring for related subdomains or newly registered lookalike domains. Users are advised to verify browser extensions exclusively through official vendor marketplaces and to inspect SSL certificates for anomalies. The remaining risk is classified as high due to the domain's active status and direct targeting of cryptocurrency wallet credentials, which could lead to immediate financial loss if successful.