base-en-web3wallet[.]pages[.]dev

Analysis of base-en-web3wallet.pages.dev shows a high‑risk crypto‑drainer infrastructure that was taken offline prior to the report date of July 23, 2026. The domain was registered on February 21, 2026 through Cloudflare, Inc. and uses Cloudflare‑provided nameservers ganz.ns.cloudflare.com and elinore.ns.cloudflare.com. DNS resolution points to IP address 172.66.47.81, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The site served an HTTP 403 status code and advertised the page title "Suspected phishing site | Cloudflare," indicating that the host was flagged by Cloudflare’s own detection mechanisms.

SSL termination is performed by Google Trust Services under the WE1 certificate, confirming a valid TLS chain but offering no mitigation against the underlying malicious activity. Google Safe Browsing classified the domain as a social‑engineering threat, and VirusTotal recorded 14 positive detections out of 93 scanned security vendors, reinforcing the malicious assessment. The domain appears on a single security blocklist and has been actively blocked by PhishDestroy. Additional reputation metrics show a Gridinsoft trust score of 0 out of 100, reflecting extreme distrust.

The combination of HSTS enforcement, HTTP/3 support, and Cloudflare‑managed infrastructure suggests an attempt to obscure the origin while maintaining a modern delivery stack. While the exact payload or phishing page content has not been captured, the convergence of registrar data, IP ownership, multiple vendor detections, and the explicit "suspected phishing" title provide compelling evidence of a crypto‑drainer operation. Defenders should continue to block the domain at DNS and proxy layers, monitor for any re‑registration attempts, and add the associated IP address to threat‑intel feeds. Continuous observation of Cloudflare‑associated domains for similar naming patterns is recommended to pre‑empt future deployments.