ultrabaserpc[.]xyz

This domain, ultrabaserpc.xyz, was registered on July 24, 2025, through Cosmotown Inc and remains active as of July 12, 2026. Analysis indicates it is explicitly targeting Base, a known cryptocurrency platform, through brand impersonation tactics. The domain currently resolves to IP address 104.21.16.138 and is flagged by 4 out of 95 security vendors on VirusTotal, with a Gridinsoft trust score of 0/100. It also appears on two security blocklists and has been referenced in 24 threat intelligence pulses on AlienVault OTX, suggesting persistent malicious activity. Infrastructure analysis reveals the use of Cloudflare services, including Cloudflare Browser Insights and HTTP/3, alongside common frontend libraries such as Materialize CSS, Bootstrap, and jQuery. The SSL certificate is issued by Google Trust Services, which may contribute to the domain's superficial legitimacy. However, the combination of brand impersonation, low detection thresholds among security vendors, and consistent blocklist presence indicates a high-risk threat. The domain's creation nearly a year prior to the current date, yet its continued activity, suggests it may be part of a long-term phishing campaign rather than a short-lived operation. Defenders should note that while the domain's hosting and SSL configuration appear standard, the impersonation of Base and its inclusion in multiple threat intelligence feeds warrant immediate blocking. The IP address 104.21.16.138 should be monitored for additional associated domains, as it may host other malicious infrastructure. Given the domain's persistence and the specific targeting of cryptocurrency users, security teams are advised to prioritize this domain for internal blocklisting and alerting. No evidence currently suggests compromise of legitimate Base infrastructure, but the impersonation vector remains a credible threat to end users.