claim-nodes[.]firebaseapp[.]com

This domain, claim-nodes.firebaseapp.com, is identified as a high-risk brand impersonation threat targeting the Base decentralized protocol. Analysis indicates the infrastructure hosts a wallet drainer, designed to deceive users into connecting wallets to fraudulent claim pages titled 'Decentralized Protocol F.' The threat type aligns with known crypto phishing tactics, where attackers exploit trust in decentralized platforms to siphon assets. Infrastructure analysis reveals the domain is registered through Google LLC and resolves to IP address 199.36.158.100, located in the US under AS54113 (Fastly, Inc.). Security vendor detections on VirusTotal report 14/95 flags, while the domain appears on four security blocklists. The SSL certificate is issued by Google Trust Services (WR4), a common attribute in phishing campaigns leveraging Google-hosted infrastructure. No creation date is provided, but the domain's rapid takedown suggests recent deployment. The domain is currently offline, mitigating immediate risk to users. However, historical indicators—such as the IP, SSL certificate, and registrar details—remain viable for tracking related campaigns. Remaining risk includes potential re-deployment under similar infrastructure or secondary domains. Users are advised to verify domain authenticity via official Base communication channels and avoid interacting with unsolicited claim pages. Monitoring for SSL certificate reuse or IP associations may aid in detecting future iterations.