exchange[.]base[.]software

This domain, exchange.base.software, is identified as a high-risk brand impersonation threat targeting Base, a cryptocurrency platform. Analysis indicates the infrastructure was designed to deceive users into interacting with fraudulent exchange services, likely aiming to facilitate unauthorized transactions or credential theft. No specific drainer kit signatures were confirmed, but the domain's design and targeting align with known cryptocurrency phishing campaigns. Infrastructure analysis reveals the following technical indicators: the domain was registered on May 11, 2026, through Porkbun LLC, an unusual future date suggesting potential registrar manipulation or typo-squatting tactics. It resolves to IP address 20.204.77.223, hosted on Microsoft Azure Cloud in central India. The SSL certificate is issued by Let's Encrypt (R12), a common choice for malicious actors due to its low cost and automation capabilities. Google Safe Browsing flags the domain as phishing, and it appears on three security blocklists, including PhishDestroy and MetaMask. VirusTotal reports 18 out of 95 security vendors detecting the domain as malicious, with detections spanning phishing and brand impersonation categories. The domain is currently offline, likely due to takedown actions or voluntary suspension by the hosting provider. Despite its inactive status, residual risk remains for users who may have interacted with the domain during its operational window. Organizations are advised to monitor for related indicators, including the IP address and SSL certificate thumbprint, in network logs. Users should be alerted to the impersonation tactics targeting Base and encouraged to verify domain authenticity through official channels before engaging with cryptocurrency services.