learn-extsion-base-extion[.]pages[.]dev

PhishDestroy identifies the domain learn-extsion-base-extion.pages.dev as a high-risk brand impersonation phishing site targeting the cryptocurrency platform Base. The domain was registered through Cloudflare, Inc. and employs a fraudulent login page designed to harvest user credentials and potentially seed phrases, though no specific drainer kit has been identified in this investigation.

Technical indicators are robust: VirusTotal reports 14 out of 95 security vendors flagging this domain as malicious, and Google Safe Browsing explicitly categorizes it as phishing. The domain resolves to IP address 172.66.47.145, was created on October 06, 2025, and appears on one security blocklist. Its SSL certificate is issued by Google Trust Services (WE1), lending a false sense of legitimacy. The page title observed was "Suspected phishing site | Cloudflare," indicating that Cloudflare's own systems had already flagged the page as suspicious before it was taken offline.

As of the current report, the domain status is offline—likely removed by Cloudflare or the hosting provider in response to abuse reports. However, users who may have visited the site before takedown should immediately change their Base account passwords and enable two-factor authentication. No further active threat remains from this domain, but similar phishing campaigns may reappear under different subdomains or TLDs. Users are advised to always verify URLs directly through official channels and avoid clicking links in unsolicited messages.