use-base-extension-wallet[.]pages[.]dev

The domain use-base-extension-wallet.pages.dev was registered on February 21, 2026 through Cloudflare, Inc. and is currently hosted on Cloudflare’s network (AS13335) with the IPv4 address 172.66.47.82 located in the United States. The site presents a page titled "Suspected phishing site | Cloudflare" and serves an SSL certificate issued by Google Trust Services under the WE1 identifier, indicating a valid TLS connection but offering no assurance of legitimacy. HTTP responses return a 403 status code, and the site employs HSTS and HTTP/3, consistent with typical Cloudflare‑protected deployments. Google Safe Browsing has flagged the domain for social engineering, and VirusTotal records show that 13 of 93 security vendors have flagged it as malicious, reinforcing the suspicion of abuse.

The domain appears on a single known blocklist and is actively blocked by PhishDestroy. Independent reputation scoring from Gridinsoft assigns a trust score of 0 out of 100, reflecting a high likelihood of malicious intent. Nameserver resolution points to ainsley.ns.cloudflare.com and carlos.ns.cloudflare.com, both owned by Cloudflare, confirming the registrar’s involvement. The listed scam type is a crypto scam, specifically a crypto drainer, suggesting that the domain may be used to harvest cryptocurrency credentials or redirect transactions.

At the time of reporting (July 24, 2026) the site has been taken offline, but the infrastructure remains observable and could be re‑activated. Defenders should continue to block the domain at network perimeters, update URL filtering policies, and monitor the associated IP address for any future activity. Threat intelligence feeds should ingest the domain, its IP, and the associated nameservers to improve detection of related campaigns.