sso-conbasepro-x-auth[.]wstd[.]io

This domain is flagged as a high-risk brand impersonation threat targeting Base, a cryptocurrency platform. Analysis indicates the domain was designed to mimic legitimate single sign-on (SSO) authentication portals, likely to harvest credentials or facilitate unauthorized access to user accounts. The specific threat type—brand impersonation—exploits user trust in the Base brand to deceive victims into entering sensitive information, such as login credentials or private keys, into a fraudulent interface. Infrastructure analysis reveals the domain sso-conbasepro-x-auth.wstd.io was registered on February 21, 2026, through NameCheap, Inc., and resolves to the IP address 104.19.163.34, hosted on Cloudflare’s network (AS13335). The domain appears on one security blocklist and is flagged by 14 out of 95 security vendors on VirusTotal. Google Safe Browsing classifies it as a phishing threat. The SSL certificate is issued by Let’s Encrypt (serial number E8), a common choice for both legitimate and malicious domains. Despite its current offline status, the domain’s infrastructure and registration details align with known patterns of credential harvesting campaigns. Mitigation steps specific to this threat type include immediate blocking of the domain and its associated IP (104.19.163.34) at the network perimeter. Organizations should deploy indicators of compromise (IOCs) such as the domain, IP, and SSL certificate fingerprint into security controls to prevent access. End-users should be educated on recognizing brand impersonation tactics, particularly in authentication flows, and encouraged to verify domain authenticity before entering credentials. Monitoring for similar domains registered through NameCheap or resolving to Cloudflare IPs may help identify related threats. Given the high-risk nature of this domain, incident response teams should review logs for any prior connections to this infrastructure.