shop[.]basepizzaitalia[.]com

Analysis of shop.basepizzaitalia.com indicates an active infrastructure that impersonates American Express as part of a crypto‑draining campaign. The domain resolves to 23.227.38.74, an address owned by Cloudflare, Inc. (AS13335) and is hosted in Canada. Registration data shows the domain was created on 16 February 2022 through Hosting Concepts B.V. d/b/a Registrar.eu. The TLS certificate is issued by Google Trust Services under the WE1 profile, and the site presents a valid HTTPS response (HTTP 200) with HSTS enabled and HTTP/3 support. The page title returned by the server is “Base Pizza Italia”, suggesting the site is unrelated to the targeted brand. Detected front‑end components include Shopify, jQuery, iubenda and a Facebook Pixel, indicating a typical e‑commerce stack. The domain is listed on a single blocklist (PhishDestroy) and has a Gridinsoft trust score of 0 / 100. VirusTotal scans show two of ninety‑five security vendors flag the domain. Nameservers are geb.italhosting.it, khonsu.italhosting.it and nut.italhosting.it. While the exact malicious payload has not been publicly disclosed, the combination of brand impersonation, low trust score, and inclusion on a blocklist warrants immediate mitigation. Defenders should block the domain at the DNS and proxy layers, monitor for related traffic, and consider adding it to internal threat intelligence feeds.