get-extnsion-basse[.]pages[.]dev

The domain get-extnsion-basse.pages.dev has been identified as a sophisticated crypto drainer phishing operation, now taken offline. This threat targets cryptocurrency users by impersonating legitimate browser extension download pages to trick victims into connecting their wallets, resulting in asset theft. Cloudflare's security systems currently display a 'Suspected phishing site' warning on this domain.

Technical analysis reveals that this domain was registered through Cloudflare, Inc. on October 25, 2025, and resolved to IP address 188.114.96.3. It was flagged by 10 out of 95 VirusTotal vendors as malicious, and appeared on at least one security blocklist. The SSL certificate was issued by Google Trust Services (WE1), further masking its fraudulent nature. Google Safe Browsing also flagged the site as phishing, corroborating the threat assessment.

Although the domain is currently offline and inactive, users who may have interacted with it should take immediate precautions. PhishDestroy recommends revoking any permissions granted to suspicious dApps or browser extensions, transferring assets to new wallets, and running a full security scan on affected devices. Stay vigilant against similar domains using variations of 'get-extension' or 'base' in their URLs.