eth[.]denver-programs[.]com

This domain, eth.denver-programs.com, was registered on February 21, 2026, through Tucows Domains Inc. and hosted on DigitalOcean (AS14061) at IP address 162.243.208.163, located in the United States. The domain employs nameservers from Njalla (1-you.njalla.no, 2-can.njalla.in, 3-get.njalla.fo), a privacy-oriented provider. Its page title is 'Domain Default page', indicating no active content was served at time of analysis or the domain was parked. The domain impersonates the brand 'base' and is classified as a crypto scam.

Security vendor detection is low, with only 2 out of 93 VirusTotal engines flagging the domain. It appears on three blocklists—PhishDestroy, MetaMask, and SEAL—and has a Gridinsoft trust score of 0/100. The domain lacks an SSL certificate, which is common for malicious or inactive sites. As of the report date of July 24, 2026, the domain is offline, suggesting it has been taken down or suspended.

Defenders should monitor for similar domains using the Njalla nameserver pattern and DigitalOcean IP range, as the threat actor may register new variants. The exact phishing mechanism or landing page content is unknown since the site was not live during analysis, but the blocklist presence and brand impersonation target indicate a likely attempt to steal cryptocurrency credentials or seed phrases related to the Base ecosystem. Organizations affiliated with Base should educate users about this domain and add it to threat intelligence feeds.