baseloopz[.]xyz

On July 24, 2026, baseloopz.xyz was observed hosting a page titled “BaseloopZ | Spin to Earn Crypto & Meme Coins – Free Crypto Game on Base”. The domain was registered on March 6, 2026 through NameCheap, Inc. and resolves to the Amazon Web Services address 216.198.79.65, ASN 16509 located in the United States. The site presents a giveaway‑style phishing kit that impersonates a cryptocurrency brand, as indicated by the page title and the classification “Brand Impersonation”. SSL is provided by a Let's Encrypt R12 certificate, and the HTTP response returned a 404 status, suggesting the content was removed before analysis could be completed.

VirusTotal scans recorded 2 of 94 security vendors marking the domain as malicious. The domain appears on three external blocklists and is explicitly blocked by PhishDestroy, MetaMask, and SEAL. MX records point to eforward1.registrar-servers.com with priority 10, and the authoritative nameservers are dns1.registrar-servers.com and dns2.registrar-servers.com. Current activity status is offline.

While the page title and kit classification provide clear evidence of a crypto‑related giveaway scam, no additional payload or credential‑capture details have been captured, leaving the exact phishing flow uncertain. The infrastructure—AWS hosting and standard Let's Encrypt TLS—matches a common pattern for rapidly deployed scam sites, and the short lifespan (registered in March 2026 and taken offline by the report date) aligns with typical “hit‑and‑run” campaigns. Defenders should continue to block the domain at network perimeter controls, update threat intelligence feeds with the observed IP and MX host, and monitor for any re‑use of the same hosting provider or certificate fingerprint in future campaigns. Continuous re‑scanning of the domain, even after takedown, is recommended to capture any resurgence.