basehub-bonddev[.]xyz

Analysis of basehub-bonddev.xyz shows a high‑risk generic phishing operation that was registered on July 19, 2026 and remains active as of the report date, July 20, 2026. The domain is listed on three security blocklists and is explicitly blocked by PhishDestroy, MetaMask, and SEAL. VirusTotal records indicate that two of ninety‑five scanned security vendors flagged the domain, confirming malicious intent. Infrastructure data reveals the domain resolves to IP address 45.9.148.81 and uses Cloudflare nameservers anastasia.ns.cloudflare.com and thaddeus.ns.cloudflare.com. Registration was performed through Unstoppable Domains Inc., a service often leveraged for rapid, low‑cost domain acquisition. No additional contextual details such as target brand or page content have been disclosed, leaving the exact phishing lure uncertain. Defenders should add basehub-bonddev.xyz to outbound and inbound deny lists, monitor traffic to the associated IP, and consider broader blocking of the involved Cloudflare nameservers if similar patterns emerge. Continuous threat‑intel feeds should be consulted for new indicators that may link this infrastructure to other campaigns, and any observed credential submissions to the domain should be treated as compromised and revoked where applicable.