felipe-santos-3[.]baseportal[.]io

This domain, felipe-santos-3.baseportal.io, is flagged as an active crypto scam site based on current threat intelligence. Registered on September 6, 2024, through GoDaddy.com, LLC, the domain remains operational with an HTTP 200 status, indicating a live and accessible webpage. Infrastructure analysis reveals hosting on Amazon.com, Inc. (AS16509) with an IP address of 66.33.60.193, located in the US. The site employs a Let's Encrypt SSL certificate (R12) and utilizes Cloudflare nameservers (alfred.ns.cloudflare.com, bella.ns.cloudflare.com) alongside Vercel DNS servers (ns1.vercel-dns-3.com, ns2.vercel). Detected technologies include Node.js, React, Vercel, Next.js, reCAPTCHA, HSTS, Google Tag Manager, and Facebook Pixel, suggesting a modern, potentially obfuscated phishing framework. The domain appears on one security blocklist and is explicitly labeled as a crypto scam. Ten of ninety-five security vendors on VirusTotal have flagged it, though this detection rate alone does not confirm the full scope of malicious activity. The page title, 'Baseportal,' provides no clear indication of the targeted brand or service, and no additional brand-specific details are available in the current intelligence. The domain's inclusion on PhishDestroy's blocklist further corroborates its classification as malicious. Defenders should treat this domain as high-risk. Immediate actions include blocking resolution at the DNS or network level, monitoring for related subdomains or IPs, and reviewing logs for connections from internal assets. Given the use of Cloudflare and Vercel infrastructure, defenders may encounter challenges in takedown efforts, necessitating coordination with hosting providers and registrar abuse teams. No evidence suggests lateral movement or secondary payload delivery, but the domain's active status and crypto scam classification warrant proactive containment.