started-extension[.]wixstudio[.]com

This domain is flagged for high-risk brand impersonation. The site posed as a legitimate platform associated with Coinbase, specifically targeting users of Coinbase Wallet®. The malicious intent was likely to deceive users into providing sensitive information under the guise of a trusted brand. By mimicking familiar branding elements and using a fraudulent page title 'Coinbase Extension® — Getting Started | Coinbase Wallet®', it aimed to exploit the trust of unwary users.

Analysis indicates that the threat is confirmed with 14 out of 95 security vendors on VirusTotal flagging the domain as malicious. The domain, registered through GoDaddy.com, LLC, was created on April 12, 2026, suggesting recent and deliberate intent to impersonate. Further, the domain has been listed on three security blocklists and is blocked by specific security services, including MetaMask and PhishDestroy. The domain resolved to IP address 34.144.206.118, and technologies such as Wix, Envoy, and Google Cloud were employed in its infrastructure, supported by a Let's Encrypt SSL certificate.

If you visited this domain or suspect you have interacted with it, immediately perform a security check on your device. Change any passwords that may have been compromised, especially related to cryptocurrency accounts. Monitor your financial statements and accounts for unusual activity and consider contacting your financial institution for further guidance. Ensure your security software is updated and conduct a thorough malware scan to detect any potential infections.