jweb-baseiinetmx[.]one

This domain, jweb-baseiinetmx.one, is identified as a brand impersonation threat targeting Base, a Layer 2 blockchain network. Analysis indicates the site employs crypto wallet credential harvesting tactics, likely deploying token drainer kits to siphon digital assets from victims. The infrastructure mimics legitimate Base interfaces, increasing the likelihood of successful deception among users seeking wallet connections or token swaps. Infrastructure analysis reveals the domain resolves to IP address 199.59.243.228, hosted on AS16509 (Amazon.com, Inc.) in the United States. The domain was registered on February 21, 2026, through an undisclosed registrar. Detection metrics show 14 out of 95 security vendors on VirusTotal flag the domain as malicious, while it appears on a single security blocklist. The SSL certificate is classified as R12, and no entries were found in Google Safe Browsing at the time of assessment. The domain has been taken offline, reducing immediate exposure risk. However, residual threats persist due to potential victim data compromise from prior interactions. Users who connected wallets or entered credentials are advised to revoke active session approvals, transfer assets to new wallets, and monitor transaction histories for unauthorized activity. Organizations should update blocklists with the domain and IP address to prevent future access attempts.