support-cnbase[.]netlify[.]app

This domain, support-cnbase.netlify.app, is identified as a brand impersonation threat targeting Base, a Layer 2 cryptocurrency platform. Analysis indicates the site was designed to mimic legitimate Base support channels, likely to deceive users into disclosing wallet credentials, recovery phrases, or private keys. No specific drainer kit signatures were detected in the available data, but the domain structure and naming convention strongly suggest credential harvesting intent. Infrastructure analysis reveals the domain was registered through Netlify and currently resolves to the IP address 98.84.224.111, hosted on Amazon.com, Inc. infrastructure (AS14618). The domain is flagged by 17 out of 95 security vendors on VirusTotal, indicating moderate detection coverage. It appears on two security blocklists and is actively blocked by at least two threat intelligence platforms. The SSL certificate is issued by DigiCert Inc, a legitimate certificate authority, which may have been exploited to lend false credibility to the phishing site. No creation date is available in the provided data, limiting temporal analysis. The domain is currently offline, with a 'Site not found' page title returned. While this reduces immediate risk, the infrastructure remains registered and could be reactivated. Users who interacted with the domain should revoke any connected wallet permissions and monitor for unauthorized transactions. Organizations are advised to update blocklists with the domain and IP address, and to alert users to the impersonation risk associated with Base-related support scams. The elevated risk level persists due to the potential for re-deployment on the same infrastructure.