base-br[.]cc

Analysis of the domain base-br.cc indicates active infrastructure linked to brand impersonation scams, as classified in threat intelligence records. The domain was registered on February 21, 2026, through NiceNIC International Group Co., Limited, and currently resolves to IP address 172.67.169.116, hosted on Cloudflare's network (AS13335) in the United States. The site is protected by Cloudflare technologies, including HTTP/3, and presents a 302 HTTP redirect status, though the destination remains unconfirmed. The SSL certificate is issued by Google Trust Services (WE1), a common feature of both legitimate and malicious sites leveraging Cloudflare. At the time of assessment, the domain appears on one security blocklist, specifically PhishDestroy, and is flagged by 4 of 93 security vendors on VirusTotal as malicious.

The page title 'base-br.cc | 522: Connection timed out' suggests either a misconfigured or intentionally obscured backend, a pattern observed in phishing campaigns designed to evade automated detection. The Gridinsoft trust score of 0/100 further supports the classification of this domain as high-risk. Defenders should treat this domain as part of an active phishing operation, particularly given its association with brand impersonation. The use of Cloudflare nameservers (terry.ns.cloudflare.com and ximena.ns.cloudflare.com) and hosting infrastructure is consistent with threat actors attempting to mask origin servers and complicate takedown efforts.

While the exact brand being impersonated is not specified in available data, the scam type is explicitly documented as brand impersonation. Recommended actions include blocking the domain and its resolving IP at network and endpoint layers, monitoring for related domains registered through the same registrar, and reviewing logs for connections to 172.67.169.116. Given the domain's recent registration and active status, additional indicators of compromise may emerge as the campaign evolves.