basedandy[.]next-cryptolist[.]net

PhishDestroy has identified basedandy.next-cryptolist.net as an elevated-risk domain engaged in brand impersonation, specifically targeting the Base cryptocurrency platform. This domain was created on April 11, 2026, and is actively being used to deceive users into believing it is affiliated with Base, potentially to steal credentials or funds.

Technical analysis reveals that the domain resolves to IP address 104.21.64.107 and is registered through Key-Systems GmbH. VirusTotal reports that only 1 out of 95 security vendors flag this domain as malicious, indicating low detection across the industry. Additionally, it appears on one security blocklist and uses an SSL certificate issued by Google Trust Services / WE1, which may lend a false sense of legitimacy. The low blocklist presence and minimal vendor flags suggest that this threat is relatively new or evasive.

To protect against this brand impersonation threat, users should avoid clicking any links or downloading files from this domain. Verify the authenticity of any communication claiming to be from Base by checking official channels. If you have already interacted with the domain, change your passwords immediately and enable two-factor authentication on your Base account. Report the domain to security teams and monitor for unusual activity.