basesecureonline[.]com

Analysis of the domain basesecureonline.com indicates a high‑risk brand‑impersonation campaign targeting Coinbase users. The domain was registered on February 21, 2026 through NiceNIC International Group Co., Limited and is hosted on Cloudflare’s network (ASN 13335) with the IP address 104.21.1.170 located in the United States. No SSL certificate is presented, meaning connections are unencrypted and vulnerable to interception. The HTTP response currently shows the page title "Coinbase Support," confirming the intent to masquerade as an official Coinbase support site.

Threat intelligence flags the site as employing the Airdrop Scam phishing kit, a known cryptocurrency‑draining template. Google Safe Browsing categorises the domain as a social‑engineering threat, and VirusTotal reports that 11 of 93 security vendors have flagged the host, reinforcing the malicious assessment. Reputation scoring from Gridinsoft assigns a score of 0 out of 100, indicating no trust. The domain appears on three public blocklists and has been actively blocked by the PhishDestroy, MetaMask, and SEAL filtering services, demonstrating that several defensive platforms have already taken mitigation steps.

While the site is presently taken offline, the infrastructure – Cloudflare edge nodes and the specific nameservers leia.ns.cloudflare.com and nico.ns.cloudflare.com – may be reused for future impersonation attempts. Defenders should continue to block the IP address 104.21.1.170, enforce strict DNS filtering for basesecureonline.com, and monitor for re‑registration or similar domain patterns. Users should be warned that any unsolicited communications referencing "Coinbase Support" that direct to this domain are fraudulent, and any credential or wallet information entered should be considered compromised.