walat-eng-coiibase-extt[.]daftpage[.]com

This domain, walat-eng-coiibase-extt.daftpage.com, is flagged for brand_impersonation targeting the Base cryptocurrency platform. Analysis indicates the infrastructure was designed to mimic legitimate Base services, likely to deceive users into disclosing sensitive credentials or transferring assets. The page title, walat-eng-coiibase-extt, suggests an attempt to create a false association with Base through obfuscated naming conventions. Infrastructure analysis reveals the domain was registered on October 24, 2021, through OVH, SAS. It resolves to the IP address 216.150.1.193, hosted on AS16509 (Amazon.com, Inc.) in the United States. The domain is flagged by 13 out of 95 security vendors on VirusTotal and appears on one security blocklist. A Let's Encrypt SSL certificate (R13) was issued, providing a superficial layer of legitimacy. No active Google Safe Browsing (GSB) detection is recorded at this time, though this does not preclude prior or future listings. The domain is currently offline, having been taken down following detection. However, the infrastructure remains a residual risk, particularly if the threat actors retain control of the registrar account or associated IP space. Users who interacted with the domain prior to takedown may still be exposed to follow-up attacks, such as credential replay or secondary phishing attempts. Organizations are advised to monitor for related indicators, including the IP address 216.150.1.193 and the Let's Encrypt certificate fingerprint, and to block the domain at perimeter security controls. Affected users should rotate credentials and review transaction histories for unauthorized activity.