guide-docs-extension-base[.]pages[.]dev

This domain, guide-docs-extension-base.pages.dev, is identified as a high-risk brand impersonation threat targeting Base, a cryptocurrency platform. Analysis indicates the site operated as a phishing page designed to deceive users into connecting wallets, likely deploying a wallet drainer kit to siphon digital assets. The infrastructure mimics legitimate Base documentation or extension resources, increasing the likelihood of successful social engineering attacks against cryptocurrency users. Infrastructure analysis reveals the following technical indicators: the domain is flagged by 12 out of 95 security vendors on VirusTotal, resolves to the IP address 188.114.97.3, and is registered through Cloudflare, Inc. It was created on October 29, 2025, and is currently listed on one security blocklist. Google Safe Browsing categorizes the domain as phishing, and its SSL certificate is issued by Google Trust Services (WE1). The page title, 'Suspected phishing site | Cloudflare,' further corroborates its malicious classification. As of the latest assessment, the domain has been taken offline, likely due to enforcement actions by the hosting provider or security teams. While the immediate threat is mitigated, residual risks remain for users who may have interacted with the site prior to its takedown. Affected individuals should revoke any connected wallet permissions, monitor accounts for unauthorized transactions, and verify system integrity. Security teams are advised to update blocklists and monitor for re-emergence of similar infrastructure under new domains or IPs.