rapidofincoura-ai[.]net

This domain, rapidofincoura-ai.net, is flagged as a high-risk brand impersonation threat targeting the Base cryptocurrency platform. The site presented itself as an official trading platform under the title 'Rápido Fincoura - Plataforma Oficial | Trading IA 2026,' attempting to deceive users into engaging with fraudulent financial services. No drainer kit signatures were identified in initial analysis, though the impersonation tactics align with common cryptocurrency phishing schemes. Analysis indicates the domain was registered through PDR Ltd. d/b/a PublicDomainRegistry.com on February 21, 2026, and resolved to the IP address 104.21.6.153, hosted on Cloudflare infrastructure (AS13335). VirusTotal detections reached 16 out of 95 security vendors, while the domain appeared on three distinct security blocklists. No SSL certificate was present, and the site was actively blocked by multiple threat intelligence feeds prior to takedown. The page title and branding elements closely mimicked Base’s official design, increasing the likelihood of successful social engineering. The domain is currently offline, having been taken down following coordinated response actions by security providers. Despite its inactive status, residual risk remains for users who may have interacted with the site before its removal. Organizations are advised to monitor for related indicators, including the IP address 104.21.6.153 and the registrar PDR Ltd., as these may be reused in future campaigns. Users should verify platform authenticity through official channels and report any suspicious domains matching these patterns.