demo[.]servicebase[.]net

This domain is flagged for elevated-risk brand impersonation targeting Base, specifically designed to mimic a legitimate login portal. Analysis indicates the page title "ServiceBase | Login" closely resembles authentic Base service interfaces, increasing the likelihood of credential harvesting or account takeover attempts against users of the targeted platform. Infrastructure analysis reveals the domain was registered on May 10, 2015, through NameCheap, Inc., and currently resolves to IP address 3.33.193.101. Security vendor detections on VirusTotal stand at 2/95, with one confirmed presence on a security blocklist. The domain uses a Let's Encrypt SSL certificate, which while providing encryption, does not validate legitimacy. Additional trust indicators include a Gridinsoft trust score of 0/100, reinforcing its malicious classification. The domain has since been taken offline, though historical activity remains a concern. Mitigation steps for organizations include adding demo.servicebase.net to internal blocklists and monitoring for residual DNS queries or cached references. Security teams should alert users to verify domain authenticity before entering credentials, particularly for Base-related services. Network defenders are advised to inspect logs for connections to 3.33.193.101 or related subdomains. If credentials were entered on this portal, immediate password resets and multi-factor authentication enforcement are recommended for affected accounts.