get-extension-bas[.]pages[.]dev

This domain, get-extension-bas.pages.dev, is under investigation for brand impersonation targeting Coinbase users. Analysis indicates the site masquerades as an official Coinbase browser extension download portal, presenting a high-risk vector for credential theft or malware distribution. The domain is currently offline but remains a documented threat in security databases. Infrastructure analysis reveals the domain was registered through Cloudflare, Inc. and resolves to the IP address 172.66.47.5. It was created on February 22, 2026, and employs security features such as HSTS and HTTP/3, likely to evade detection. Despite these measures, the domain has been flagged by 0 of 95 VirusTotal vendors, though it appears on 3 security blocklists. Additional technical indicators include a Google Trust Services SSL certificate and detection by MetaMask, SEAL, and PhishDestroy. The page title, 'Coinbase Extension - Coinbase Browser Extension [Full Guide],' reinforces the impersonation tactic. The domain’s current offline status does not eliminate its risk, as threat actors frequently reactivate such infrastructure. Organizations and users are advised to block the domain and associated IP (172.66.47.5) at the network level. Security teams should monitor for reactivation attempts and update endpoint protection rules to include this indicator. Users who may have interacted with the site should revoke any associated browser extensions and reset credentials for cryptocurrency platforms as a precaution.