harvest-fx[.]com

This domain, harvest-fx.com, is flagged for brand impersonation targeting Base, a cryptocurrency platform. Analysis indicates the site mimics Base's interface to harvest user credentials or financial information, classified under elevated risk due to its deceptive design and active distribution. No specific drainer kit signatures were identified, but the infrastructure aligns with common phishing frameworks leveraging PHP and Bootstrap for rapid deployment. Infrastructure analysis reveals the domain was registered on November 22, 2024, through Atak Domain, resolving to IP address 86.107.77.165. VirusTotal detection shows 4 out of 95 security vendors flagging the domain as malicious, while it appears on one security blocklist. The SSL certificate is issued by Let's Encrypt, a common choice for both legitimate and malicious sites due to its free availability. Technologies detected include LiteSpeed web server, GSAP for animations, and third-party CDNs like jsDelivr and jQuery CDN, which may facilitate obfuscation or payload delivery. Currently, harvest-fx.com has been taken offline, reducing immediate exposure risk. However, the domain's recent creation date and use of bulletproof hosting infrastructure suggest potential for re-emergence under a different address or IP. Organizations should monitor for related indicators, including the IP 86.107.77.165 and registrar Atak Domain, and implement network-level blocking for the domain and its resolved IP. Users should verify platform authenticity via official channels before entering credentials or financial details.