egvmu-ejrp-8rmc[.]royalbase3[.]workers[.]dev

This domain, egvmu-ejrp-8rmc.royalbase3.workers.dev, is flagged as a high-risk brand impersonation threat targeting the Base cryptocurrency platform. Analysis indicates it employs deceptive tactics to mimic legitimate Base infrastructure, likely to facilitate credential harvesting or wallet-draining attacks. The domain exhibits characteristics consistent with phishing campaigns, including a non-standard subdomain structure and a placeholder page title ('Loading...'), which may conceal malicious payloads upon full deployment. Infrastructure analysis reveals the following technical indicators: the domain resolves to IP address 188.114.96.3, hosted by Cloudflare, Inc. in Canada. It was registered through Cloudflare on April 22, 2026, though this future date suggests potential falsification or misconfiguration. The SSL certificate is issued by Let's Encrypt (serial E7), a common choice for both legitimate and malicious domains. VirusTotal detection shows 13 out of 95 security vendors flagging the domain as malicious. It appears on one security blocklist and is currently categorized as active by threat intelligence sources. As of the latest assessment, the domain remains operational with no evidence of takedown or mitigation. The placeholder page title and lack of visible content suggest the campaign may still be in a preparatory phase, increasing the risk of imminent malicious activity. Users are advised to block traffic to this domain at the network level and monitor for related subdomains or IP associations. Given the high-risk classification and active status, organizations should treat this domain as a confirmed threat vector until further remediation is observed.