coimbase-extension[.]pages[.]dev

This domain, coimbase-extension.pages.dev, is flagged as a high-risk brand impersonation phishing site targeting users of the Base cryptocurrency platform. Analysis indicates the infrastructure was designed to mimic legitimate Base services, likely to deceive users into disclosing sensitive credentials or authorizing fraudulent transactions. The domain’s intent appears to be credential harvesting or crypto asset theft, a common tactic in targeted phishing campaigns against decentralized finance users. The use of a typosquatted domain name (substituting 'o' for 'i' in 'coinbase') suggests an attempt to exploit user inattention during high-stakes interactions, such as wallet connections or transaction approvals. Infrastructure analysis reveals multiple high-confidence threat indicators. The domain was registered on October 9, 2025, through Cloudflare, Inc., and resolves to the IP address 188.114.97.3, associated with Cloudflare’s Anycast network. Security vendors on VirusTotal flagged the domain as malicious, with 11 out of 95 engines detecting it as phishing or fraudulent. The domain appears on at least one security blocklist, and Google Safe Browsing has classified it as a phishing site. The SSL certificate, issued by Google Trust Services (WE1), does not mitigate the risk, as phishing domains frequently use valid certificates to appear legitimate. The page title, 'Suspected phishing site | Cloudflare,' further corroborates its malicious classification, though this may have been applied post-detection. Users who visited coimbase-extension.pages.dev should assume their interactions were compromised. Immediate steps include revoking any active wallet authorizations or session tokens associated with the domain, particularly those linked to Base or other cryptocurrency services. Affected users should also scan their devices for malware, as phishing sites may deploy secondary payloads. If credentials or private keys were entered, users must migrate assets to a new wallet and monitor all connected accounts for unauthorized activity. Given the domain’s high-risk classification and offline status, users should remain vigilant for follow-up phishing attempts via email or social engineering, as attackers may pivot to alternative infrastructure.