basecir[.]sbs

Analysis of the domain basecir.sbs confirms it as a high-risk crypto scam infrastructure targeting users of the 1inch decentralized exchange platform, while also displaying indicators associated with CoinBase impersonation. The domain was registered on October 1, 2025, through Dynadot LLC and currently resolves to 104.19.242.15, a Cloudflare IP address (AS13335) located in the United States. No SSL certificate is present, increasing the risk of unencrypted data interception. The page title, 'CoinBase,' suggests an attempt to deceive users by mimicking the CoinBase cryptocurrency exchange, though the primary brand target identified in threat intelligence is 1inch. Detection data indicates moderate but consistent flagging: 14 of 95 security vendors on VirusTotal classify the domain as malicious.

It appears on one security blocklist and is blocked by PhishDestroy. Google Safe Browsing categorizes the site as engaging in social engineering, while AlienVault OTX includes it in a threat intelligence pulse, confirming its presence in active phishing campaigns. Gridinsoft assigns a trust score of 0/100, reflecting high confidence in its malicious nature. Nameservers (achiel.ns.cloudflare.com and hazel.ns.cloudflare.com) further link the domain to Cloudflare infrastructure, commonly used by threat actors to obscure hosting origins.

The domain is currently offline, but prior activity aligns with crypto scam tactics, likely involving credential harvesting or fraudulent token transfers. Defenders should treat this domain as compromised infrastructure and prioritize blocking it at DNS and proxy levels. Monitoring for re-emergence under similar naming conventions or Cloudflare-hosted IPs is recommended. Given the discrepancy between the page title and the stated brand target, further investigation into the exact phishing kit or campaign is warranted, though no specific kit details are currently available in the intelligence.