base-azul[.]com

The domain base-azul.com has been identified as a high-risk brand impersonation threat targeting the Base protocol, a decentralized platform. This domain is currently offline but was actively used to deceive users by mimicking the legitimate Base brand, likely for fraudulent activities such as credential harvesting or crypto asset theft. Analysis indicates the domain was designed to exploit trust in the Base ecosystem, potentially deploying social engineering tactics to manipulate victims. Infrastructure analysis reveals the domain was registered on May 26, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com, a registrar frequently associated with malicious domains. It resolves to the IP address 172.67.210.11, which has been linked to other suspicious activities. Security vendor detections include 3 of 95 flags on VirusTotal, with Google Safe Browsing categorizing it under SOCIAL_ENGINEERING. Additional technical indicators show a Gridinsoft trust score of 0/100 and presence on three security blocklists. The domain is blocked by multiple security entities, including PhishDestroy, MetaMask, and SEAL, further confirming its malicious nature. At present, base-azul.com has been taken offline, reducing immediate risk to users. However, the infrastructure may be reactivated or repurposed under a different domain. Organizations and individuals are advised to monitor for similar impersonation attempts, particularly those targeting decentralized platforms. Network administrators should update blocklists to include this domain and its associated IP address. Users should verify domain authenticity before interacting with any platform claiming affiliation with Base or other decentralized services, and report suspicious domains to relevant security authorities for further investigation.