base-bridge[.]gunz[.]dev

PhishDestroy analysts flagged base-bridge.gunz.dev for active Base brand impersonation designed to deceive users into connecting wallets and draining crypto assets via a fake Base bridge interface. This domain uses the subdomain 'base-bridge' to mimic Base's official bridge services, creating a high-risk lure for cryptocurrency holders. No drainer kit artifacts were observable in initial sandbox analysis, suggesting the payload may be delivered dynamically upon user interaction. The threat is currently classified as under_investigation due to limited behavioral telemetry.

This domain was registered using a privacy-protected registrar and resolves to IPv4 address 104.26.3.175 hosted on a shared infrastructure node. VirusTotal currently shows 0 out of 95 detection engines flagging the domain, indicating it remains under the radar of mainstream security scanners. The SSL certificate was issued by Let's Encrypt with a validity window overlapping the domain's recent creation, which aligns with opportunistic certificate abuse. Google Safe Browsing and major threat intelligence feeds have not yet flagged base-bridge.gunz.dev, contributing to its low blocklist footprint.

As of this report, base-bridge.gunz.dev remains active and unblocked across most threat platforms, posing an elevated risk to users navigating to the domain under the assumption it is an official Base bridge service. Users should avoid interacting with any links or assets associated with this domain until further validation is completed. PhishDestroy continues network and behavioral monitoring while coordinating with hosting providers and certificate authorities for takedown. Remaining risk is assessed as active and escalating given the absence of current detections despite confirmed impersonation tactics.