base-recovery[.]cloud

The domain base-recovery.cloud is identified as a high-risk brand impersonation threat targeting Coinbase users, specifically designed to harvest wallet verification credentials. Analysis confirms the domain is currently offline, though it previously hosted a fraudulent page titled Verify - Coinbase Wallet, mimicking the legitimate Coinbase authentication process to deceive victims into disclosing sensitive information. Infrastructure analysis reveals the domain was registered on November 16, 2025, through HOSTINGER operations, UAB, and resolved to the IP address 62.72.37.251, located in France under AS47583 (Hostinger International Limited). Security telemetry indicates the domain was flagged by 18 of 95 VirusTotal vendors as malicious, appears on one security blocklist, and is explicitly labeled as phishing by Google Safe Browsing. Notably, the domain operated without an SSL certificate, increasing its detectability as fraudulent due to the absence of encrypted connections. Current status confirms base-recovery.cloud has been taken offline, likely due to enforcement actions or infrastructure takedowns. However, the threat remains relevant for retrospective analysis and incident response. Organizations and individuals are advised to block the domain and its associated IP (62.72.37.251) at the network level, monitor for credential reuse attempts, and educate users on recognizing brand impersonation tactics. Security teams should review logs for connections to the domain or IP during its active period and reset any credentials potentially exposed through this phishing attempt.