web[.]baselnet-bank[.]com

web.baselnet-bank.com was registered through Name.com, Inc. on 13 October 2025 and resolves to the IPv4 address 185.162.10.205, which is owned by AS59729 GREEN FLOID LLC in Bulgaria. The domain operates without an SSL/TLS certificate, indicating that any traffic was delivered over plain HTTP. DNS resolution is delegated to four distinct name servers—ns1jsv.name.com, ns2fgv.name.com, ns3sxz.name.com, and ns4lrt.name.com—an arrangement frequently seen in short‑lived malicious deployments that rely on rapid reconfiguration. The page title reported by scanners reads “Banco BASE”, matching the declared impersonation of the “base” brand and supporting the classification of a crypto‑related scam.

VirusTotal analysis shows 11 detections out of 95 scanning engines, and the domain appears on at least one public blocklist, confirming that multiple independent security services have flagged it as malicious. Gridinsoft assigns a trust score of 0 / 100, and PhishDestroy lists the domain as blocked, further reinforcing the elevated risk assessment. The site’s status is currently offline, but historical evidence indicates that it was active prior to takedown and likely used to lure victims into cryptocurrency fraud.

No SSL certificate, no Safe Browsing or OTX entries, and no publicly available page snapshots limit the ability to describe the exact content served. Defenders should continue to block the domain at perimeter firewalls and proxy filters, monitor the associated IP range for reuse, and consider adding the four authoritative name servers to reputation or sink‑hole lists. Threat‑intel teams ought to update brand‑impersonation watchlists for “base” and track any future domains that reuse similar naming patterns, hosting infrastructure, or the same name‑server set, as these indicators often precede re‑deployment of the campaign.