sso-base-com[.]pages[.]dev

This domain, sso-base-com.pages.dev, is a confirmed phishing site designed to impersonate Base, a cryptocurrency platform. The site presents a fraudulent login interface to trick users into entering credentials or wallet recovery phrases, which are then harvested by attackers. Such impersonation attacks are commonly used to drain crypto wallets or gain unauthorized access to accounts, leading to financial loss or identity compromise. The threat is particularly dangerous for users who mistake the site for the legitimate Base platform due to its deceptive design and URL structure. Analysis indicates the domain was created on November 04, 2025, and is registered through Cloudflare, Inc. It resolves to the IP address 172.66.47.108, hosted on Cloudflare’s infrastructure (AS13335). Security vendors on VirusTotal flagged the domain as malicious, with 18 out of 95 engines detecting it as phishing. The SSL certificate is issued by Google Trust Services (WE1), a common feature in phishing sites to appear legitimate. The domain appears on one security blocklist and is flagged by Google Safe Browsing as a phishing threat. The page title, 'Suspected phishing site | Cloudflare,' further confirms its malicious nature, as Cloudflare often displays this warning for flagged content. If you visited sso-base-com.pages.dev or entered any credentials, take immediate action to mitigate risks. First, disconnect the device from the internet to prevent further data transmission. Reset passwords for any accounts accessed through the site, prioritizing cryptocurrency wallets and email accounts. Enable multi-factor authentication (MFA) on all critical services. Scan the device for malware using updated security tools, as phishing sites may deliver additional payloads. Monitor financial accounts and crypto wallets for unauthorized transactions. Report the incident to the legitimate platform (Base) and consider filing a complaint with relevant cybersecurity authorities. Avoid reusing passwords and remain vigilant for follow-up phishing attempts via email or messaging platforms.