web-conbasepro-login-run[.]tem3[.]io

This domain, web-conbasepro-login-run.tem3.io, is actively engaged in brand impersonation targeting Base, a known cryptocurrency platform. The site is currently operational and poses a high-risk threat for credential theft and potential financial fraud. Analysis indicates the domain is designed to mimic legitimate Base login portals, likely to harvest user credentials or facilitate unauthorized transactions. Infrastructure analysis reveals the domain was registered through GoDaddy.com, LLC on August 02, 2024. It resolves to the IP address 188.114.97.3 and is flagged by 19 of 95 security vendors on VirusTotal. The domain appears on three security blocklists, and its trust score from Gridinsoft is 0 out of 100. The SSL certificate is issued by Google Trust Services, which may lend a false sense of legitimacy. The page title, 'Suspected phishing site | Cloudflare,' suggests it is hosted behind Cloudflare infrastructure, a common tactic to obscure malicious activity. The domain remains active and continues to present a credible threat to users. Immediate mitigation steps include blocking the domain and its associated IP address at the network level. Organizations should update endpoint protection rules to detect and prevent access to this domain. Users who may have interacted with the site are advised to reset credentials immediately and monitor accounts for unauthorized activity. Security teams should treat this domain as a confirmed malicious resource and prioritize its inclusion in threat intelligence feeds.