base-attestation[.]basename[.]app

PhishDestroy has identified a brand impersonation campaign targeting Base users, with the domain base-attestation.basename.app flagged at an elevated risk level. This specific threat type involves a fake attestation page designed to harvest credentials from cryptocurrency platform users, mimicking the legitimate Base ecosystem to steal login details or private keys. The domain is currently offline, but such campaigns often resurface under similar names.

Technical indicators show that base-attestation.basename.app was flagged by 6 out of 95 security vendors on VirusTotal, indicating moderate but concerning detection coverage. The domain resolves to IP address 104.21.32.5 and was registered through NameCheap, Inc. on March 05, 2023. It appears on one security blocklist and carries a low trust score. The SSL certificate was issued by Let's Encrypt (R12), which is commonly abused by phishers due to its free and automated issuance. The page title found was "EAS," likely an abbreviation for Ethereum Attestation Service, further confirming the targeted impersonation of Base infrastructure.

To mitigate this threat, Base users should never interact with unsolicited attestation or verification links. Always verify domain names against official Base communications. Enable two-factor authentication on all crypto accounts and use hardware wallets for sensitive transactions. Report any similar domains to security teams and blocklist providers. PhishDestroy continues to monitor this threat family under seed 6098b1 and recommends checking the full report for additional indicators of compromise.