coenbase-io-extension[.]pages[.]dev

This domain, coenbase-io-extension.pages.dev, poses a significant threat as it impersonates the Base brand, likely aiming to deceive users into providing sensitive information such as login credentials or financial details. The domain was designed to mimic the legitimate Base website, potentially leading users to believe they are interacting with a trusted service.

Analysis indicates that the domain was flagged by 9 out of 95 security vendors on VirusTotal, suggesting that it has been identified as a potential phishing site. The domain was created on February 21, 2026, and is registered through Cloudflare, Inc. The SSL certificate is issued by Google Trust Services, which may initially lend an air of credibility to the site. However, the domain resolves to an IP address (188.114.96.3) located in the United States and managed by AS13335 Cloudflare, Inc. The site is currently offline and appears on one security blocklist, further confirming its suspicious nature.

If a user has visited coenbase-io-extension.pages.dev, they should immediately check their accounts for any unauthorized activity, especially those associated with Base or any financial services. It is recommended to change passwords and enable two-factor authentication (2FA) on affected accounts. Users should also monitor their financial statements closely for any unusual transactions. Reporting the incident to Base’s customer support and the relevant financial institutions is crucial to mitigate potential damage. Additionally, users should consider running a full system scan to ensure no malware was installed during the visit.