bases-extension-coin[.]pages[.]dev

Analysis of the domain bases-extension-coin.pages.dev shows a high‑risk phishing infrastructure that was taken offline prior to the report date of July 23, 2026. The domain was registered on February 21, 2026 through Cloudflare, Inc., and resolves to the IP address 172.66.44.250, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The site served an HTTP 403 response and presented the page title "Suspected phishing site | Cloudflare," indicating that the content was flagged by Cloudflare’s own detection mechanisms. The SSL certificate in use is issued by Google Trust Services under the WE1 designation, confirming that the site employed a legitimate TLS certificate despite its malicious intent.

Google Safe Browsing classified the URL as a social engineering threat, and VirusTotal recorded detections from 11 of 93 security vendors, reinforcing the malicious assessment. The domain appears on a single security blocklist and has been actively blocked by the PhishDestroy service. Additional telemetry includes a Gridinsoft trust score of 0 out of 100 and the presence of custom nameservers sureena.ns.cloudflare.com and aiden.ns.cloudflare.com.

The observed scam type is Brand Impersonation, though the specific victim brand is not disclosed in the available data. While the site is currently offline, defenders should continue to monitor the associated IP range and Cloudflare name server patterns for re‑use, enforce blocklist entries for the domain and its IP, and ensure that endpoint protection solutions reference the Google Safe Browsing and VirusTotal detections. Ongoing vigilance is recommended because the infrastructure—particularly the Cloudflare‑provided hosting and the low‑trust score—suggests the potential for rapid redeployment under a new sub‑domain or similar naming scheme.