rewards-base[.]org

This domain, rewards-base.org, is identified as a brand impersonation threat targeting users of the Base cryptocurrency platform. Analysis indicates the domain hosts a fraudulent page titled 'Base Pay,' designed to deceive visitors into believing they are interacting with legitimate Base services. The intent is to harvest sensitive credentials, wallet information, or other personally identifiable data under false pretenses of rewards or payments. The domain exhibits characteristics consistent with phishing infrastructure, including the use of deceptive branding and social engineering tactics to exploit user trust in the targeted platform. Infrastructure analysis reveals multiple technical indicators supporting the malicious classification of rewards-base.org. The domain was registered on December 30, 2025, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. It resolves to the IP address 104.21.39.116, hosted on AS13335 (Cloudflare, Inc.), a network commonly leveraged to obfuscate malicious activity. Security vendor detections on VirusTotal report 8 out of 95 engines flagging the domain as malicious. Additionally, the domain appears on three distinct security blocklists, further corroborating its elevated risk profile. The SSL certificate (WE1) provides minimal validation, offering no meaningful assurance of legitimacy. Users who visited rewards-base.org should take immediate corrective actions to mitigate potential compromise. Any credentials, wallet addresses, or personal information entered on the site must be considered exposed and should be revoked or changed across all associated accounts. Affected individuals should monitor their financial and cryptocurrency accounts for unauthorized transactions and enable multi-factor authentication where available. Network-level protections, such as DNS filtering or endpoint detection rules, should be updated to block this domain and its associated IP address (104.21.39.116) to prevent further exposure. If cryptocurrency wallets were connected to the site, users are advised to transfer assets to a new wallet and audit all linked services for signs of unauthorized access.