base-extension-coinbase[.]pages[.]dev

The domain base-extension-coinbase.pages.dev has been identified as a high-risk brand impersonation threat, specifically targeting users of the cryptocurrency platform Coinbase. This domain was designed to deceive users by mimicking legitimate Coinbase websites, potentially leading to the theft of sensitive information such as login credentials or financial data. The threat level is deemed high because of the domain's intent to exploit the trust placed in a well-known brand, posing significant risks to individuals who may inadvertently enter personal information.

Technical evidence corroborates the malicious nature of this domain. The domain is registered through Cloudflare, Inc., with an SSL certificate issued by Google Trust Services, indicating an attempt to appear legitimate. Created on November 5, 2025, the domain has been flagged by 14 out of 95 security vendors on VirusTotal, highlighting widespread recognition of its malicious intent. Furthermore, it is currently listed on one security blocklist, and Google Safe Browsing has flagged it as a phishing site. The domain resolved to the IP address 172.66.47.83, which is associated with AS13335, Cloudflare, Inc., located in the United States.

Users who have visited this domain should take immediate steps to protect their information. It is recommended to change any passwords associated with their cryptocurrency accounts, monitor financial transactions for unauthorized activity, and enable multi-factor authentication where possible. Additionally, users should remain vigilant against similar phishing attempts by verifying website URLs and looking for inconsistencies in emails or communications purportedly from trusted brands. If any suspicious activity is detected, it should be reported to the relevant authorities for further investigation.