info-blog[.]to

The domain info-blog.to was a phishing site engaged in brand impersonation targeting the cryptocurrency platform 'base'. It posed an elevated risk by presenting itself as a legitimate blockchain and cryptocurrency information blog to deceive users into disclosing sensitive information or engaging in fraudulent transactions. The site has since been taken offline, and no drainer kit was identified in this campaign.

Technical indicators confirm the malicious nature of info-blog.to. As of analysis, 2 of 95 VirusTotal security vendors flagged the domain, while Google Safe Browsing did not detect it. The domain appeared on 1 security blocklist (PhishDestroy) and was registered through the Government of Kingdom of Tonga on April 30, 2025. It resolved to the IP address 104.21.61.149, hosted by Cloudflare in the US, and used an SSL certificate issued by Google Trust Services / WE1. The observed page title was 'All About Blockchain and Cryptocurrencies', and the site employed technologies such as WordPress, MySQL, PHP, jQuery, and Cloudflare. Gridinsoft assigned it a trust score of 0/100, further indicating its fraudulent intent.

Users who interacted with info-blog.to should take immediate safety steps. If cryptocurrency transactions were attempted, revoke any token approvals and transfer funds to a new wallet to prevent unauthorized access. For credential phishing, change passwords on all affected accounts, enable two-factor authentication, and monitor for signs of fraud. Report the domain to relevant platforms, including the impersonated brand (base), anti-phishing organizations, and hosting providers like Cloudflare to aid in takedown efforts.