base-terminal[.]pages[.]dev

PhishDestroy has identified base-terminal.pages.dev as a confirmed brand impersonation phishing site, specifically targeting users of the Base platform. This domain was designed to mimic legitimate Base services in order to steal sensitive information from unsuspecting victims. No specific drainer kit was identified on the site, but the phishing infrastructure was clearly set up to harvest credentials and other personal data.

Technical indicators for this threat are alarming. VirusTotal analysis shows that 14 out of 95 security vendors flagged the domain as malicious. The domain was registered through Cloudflare, Inc. on March 6, 2026, and resolves to IP address 188.114.97.3. It appears on 3 security blocklists and is not listed on Google Safe Browsing. The SSL certificate is issued by Google Trust Services (WE1), which is unusual for a malicious site but helps it appear legitimate to visitors.

As of the latest check, the phishing site has been taken offline, with the page title now displaying "Suspected phishing site | Cloudflare," indicating that hosting provider or security services have intervened. However, the risk remains high because the domain may be reactivated or the attackers could deploy similar sites under different domains. Users who may have interacted with this site should immediately change their passwords for Base and any other services using the same credentials, enable two-factor authentication, and monitor accounts for suspicious activity. PhishDestroy recommends avoiding any unsolicited links and verifying URLs directly with official sources.