baselinkexplore[.]pages[.]dev

This domain is flagged for brand impersonation targeting Base, a Layer 2 blockchain network. The threat type involves credential harvesting and wallet-draining schemes, where attackers mimic legitimate Base interfaces to deceive users into disclosing private keys or seed phrases. Analysis indicates the domain remains under investigation due to its active status and lack of widespread detection, despite its malicious intent. Infrastructure analysis reveals the following technical indicators: the domain baselinkexplore.pages.dev was registered on June 19, 2025, through Cloudflare, Inc., and resolves to the IP address 188.114.96.3, geolocated to Cloudflare’s infrastructure in Canada. VirusTotal reports 0 detections out of 95 engines, suggesting evasion of initial automated scans. The SSL certificate is issued by Google Trust Services (WE1), a common provider for both legitimate and malicious domains. The domain appears on one security blocklist, specifically PhishDestroy, and presents a page titled BASELINK EXPLORE, further indicating its impersonation of Base’s branding. Mitigation steps for this threat type include immediate blocklisting of the domain and IP address across enterprise and consumer security tools. Network administrators should monitor for connections to 188.114.96.3 and inspect SSL certificates for the Google Trust Services WE1 issuer as a potential indicator of compromise. End users should verify domain authenticity by cross-referencing with official Base communication channels and avoid interacting with unsolicited links, particularly those prompting for wallet credentials or private key inputs. Given the domain’s recent creation and low detection rate, heightened scrutiny is warranted for any activity associated with baselinkexplore.pages.dev.