get-extnsion-base[.]pages[.]dev

This domain is flagged as a high-risk brand impersonation threat targeting Base, a cryptocurrency platform. Analysis indicates the site was designed to deceive users into disclosing wallet credentials or installing malicious browser extensions under the guise of legitimate Base services. Infrastructure analysis reveals the domain get-extnsion-base.pages.dev was registered on November 05, 2025, through Cloudflare, Inc. and resolves to IP address 188.114.96.3, located in the United States under AS13335. The SSL certificate is issued by Google Trust Services (WE1), a common feature in phishing campaigns to appear legitimate. The domain appears on one security blocklist and is flagged by PhishDestroy. VirusTotal detection shows 13 out of 95 security vendors classify this domain as malicious, while Google Safe Browsing explicitly labels it as phishing. The page title, 'Suspected phishing site | Cloudflare,' further confirms its deceptive nature, though the domain is currently offline. Mitigation against Base wallet impersonation requires immediate action from both users and platform operators. Users should verify domain authenticity by cross-referencing official Base communication channels before entering credentials or installing extensions. Platform operators are advised to monitor for similar domain squatting patterns, particularly those using misspelled variations of 'extension' and 'base' in subdomains. Network-level blocking of the IP 188.114.96.3 and domains registered through the same infrastructure on November 05, 2025, can prevent further exposure. Security teams should treat any interaction with this domain as a potential credential compromise and initiate password resets for affected accounts.