base-degen-tools[.]gitbook[.]io

The domain base-degen-tools.gitbook.io is currently flagged as a high‑risk brand‑impersonation site targeting the Base ecosystem. Registration data shows the domain was created on March 30, 2014 and is hosted through Cloudflare, Inc., using the authoritative nameservers dahlia.ns.cloudflare.com and hugh.ns.cloudflare.com. DNS resolution points to the IP address 172.64.147.209, which belongs to AS13335 (Cloudflare, Inc.) and is geolocated in the United States. The site presents a valid SSL certificate issued by Google Trust Services under the WE1 intermediate, indicating that TLS connections are properly encrypted.

HTTP traffic returns a 307 temporary redirect status, a pattern often used to forward victims to malicious payloads while preserving the original URL in the browser address bar. The page title captured from the site reads "👋Introduction | Base Degen Tools V5.2," directly referencing Base and suggesting a crypto‑related toolset, consistent with the classified scam type of a Crypto Scam. VirusTotal analysis shows that 11 of 93 scanned security vendors have flagged the domain, and it appears on at least one external blocklist. PhishDestroy has already added the domain to its blocklist, reinforcing the consensus that the site is malicious.

The Gridinsoft trust score of 0 / 100 further reflects a lack of legitimacy. Given the combination of a reputable SSL issuer, Cloudflare edge hosting, and a deceptive subdomain that mimics a legitimate Base project, defenders should treat any traffic to this domain as hostile. Recommended mitigations include adding the domain and its resolving IP to network and DNS blocklists, monitoring for similar GitBook‑hosted subdomains referencing Base, and employing URL‑filtering solutions that reference the current blocklist entries. Continuous re‑evaluation is advised, as the infrastructure could be leveraged for additional phishing or crypto‑draining campaigns.